Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1340932

Summary: [z-stream clone 3.6.8] It's possible to remove inherited permissions from Everyone's group
Product: Red Hat Enterprise Virtualization Manager Reporter: Martin Perina <mperina>
Component: ovirt-engineAssignee: Ondra Machacek <omachace>
Status: CLOSED ERRATA QA Contact: Gonza <grafuls>
Severity: low Docs Contact:
Priority: low    
Version: 3.6.3CC: bugs, gklein, lsurette, mgoldboi, mperina, ncredi, oourfali, pstehlik, rbalakri, Rhev-m-bugs, sbonazzo, srevivo, ykaul
Target Milestone: ovirt-3.6.8Keywords: Automation, ZStream
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: 1302034 Environment:
Last Closed: 2016-07-27 14:12:02 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: Infra RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1302034    
Bug Blocks:    

Description Martin Perina 2016-05-30 18:44:36 UTC 
+++ This bug was initially created as a clone of Bug #1302034 +++

Description of problem:
It's possible to remove inhertied permissions from Everyone's group.
If for example user will inherit UserTemplateBasedVm role on Blank template.
Then if he check in webadmin this inhertited permission, he can't remove it,
but if he try to remove this inherited permission via REST it's removed successfully
and also removed from Everyone's group.

Version-Release number of selected component (if applicable):
3.6.3

How reproducible:
always

Steps to Reproduce:
1. Add external user to system.
2. Remove some of the inhertied permissions from Everyone group from user
$ curl -X DELETE -H "Content-type: application/xml" -k -u admin@internal:password $URL/users/1905239d-0c8a-48bb-b454-f24915a128f7/permissions/00000004-0004-0004-0004-000000000355

Actual results:
It's successfully deleted. Also from Everyone group

Expected results:
Inherited permissions from group shouldn't be possible to remove.
Or could be, but don't remove it from group as well.

Additional info:

--- Additional comment from Juan Hernández on 2016-01-26 10:54:23 EST ---

The API doesn't perform this kind of check, it just forwards the request from the caller to the backend. If deleting these permissions shouldn't be allowed then the backend should reject the operation and respond to the API with the appropriate error message.
Comment 1 Martin Perina 2016-05-31 12:31:35 UTC 
Retargeting to 3.6.8 as we missed today's last normal 3.6.7 build
Comment 2 Gonza 2016-07-13 10:18:29 UTC 
Verified with:
rhevm-4.0.0.5-0.1.el7ev.noarch

# curl -X DELETE -H "Content-type: application/xml" -k -u admin@internal:pass $URL/users/e18a0c55-567f-4419-a6df-1c03c944b3e7/permissions/00000017-0017-0017-0017-000000000229
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<fault>
    <detail>[Cannot remove inherited permission]</detail>
    <reason>Operation Failed</reason>
</fault>
Comment 4 errata-xmlrpc 2016-07-27 14:12:02 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-1507.html