Red Hat Bugzilla – Bug 1302034
It's possible to remove inherited permissions from Everyone's group
Last modified: 2016-07-05 03:38:35 EDT
Description of problem:
It's possible to remove inhertied permissions from Everyone's group.
If for example user will inherit UserTemplateBasedVm role on Blank template.
Then if he check in webadmin this inhertited permission, he can't remove it,
but if he try to remove this inherited permission via REST it's removed successfully
and also removed from Everyone's group.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. Add external user to system.
2. Remove some of the inhertied permissions from Everyone group from user
$ curl -X DELETE -H "Content-type: application/xml" -k -u admin@internal:password $URL/users/1905239d-0c8a-48bb-b454-f24915a128f7/permissions/00000004-0004-0004-0004-000000000355
It's successfully deleted. Also from Everyone group
Inherited permissions from group shouldn't be possible to remove.
Or could be, but don't remove it from group as well.
The API doesn't perform this kind of check, it just forwards the request from the caller to the backend. If deleting these permissions shouldn't be allowed then the backend should reject the operation and respond to the API with the appropriate error message.
oVirt 4.0.0 has been released, closing current release.