Bug 1709610
| Summary: | Security Group filtering hides rules from user | |||
|---|---|---|---|---|
| Product: | Red Hat OpenStack | Reporter: | Robin Cernin <rcernin> | |
| Component: | openstack-neutron | Assignee: | Slawek Kaplonski <skaplons> | |
| Status: | CLOSED ERRATA | QA Contact: | Candido Campos <ccamposr> | |
| Severity: | medium | Docs Contact: | ||
| Priority: | medium | |||
| Version: | 13.0 (Queens) | CC: | amuller, bcafarel, chrisw, mgarciac, nate.johnston, ndeevy, scohen, shdunne, skaplons, slinaber | |
| Target Milestone: | z9 | Keywords: | Reopened, Triaged, ZStream | |
| Target Release: | 13.0 (Queens) | Flags: | skaplons:
needinfo-
|
|
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | openstack-neutron-12.1.1-5.el7ost | Doc Type: | Bug Fix | |
| Doc Text: |
Previously, it was possible for admin role users to create security group rules for regular users without the security group owner being aware.
With this update, the owner of a security group can use `admin_context` to list the rules of a security group when processing GET /security-groups API requests, even if a rule was created by another user.
|
Story Points: | --- | |
| Clone Of: | ||||
| : | 1803253 (view as bug list) | Environment: | ||
| Last Closed: | 2020-02-12 13:19:26 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 1803253 | |||
|
Comment 1
Slawek Kaplonski
2019-05-29 06:25:49 UTC
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2019:2629 I reopened this bug according to comment #11 from Candido. Basically there are two different API calls: 1. GET /v2.0/security-groups/<sec_group_id> which will return also list of rules in each group. This call is used in python-neutronclient and this was changed by my patch above in this BZ, 2. GET /v2.0/security-group-rules?security_group_id=<sec_group_id> which wasn't changed in my patch and will not return proper list of rules but only rules which belongs to tenant which is doing request, So to solve 2 I will need to do some additional modifications in neutron/db/securitygroups_db.py but also propose new policy rule OWNER_OR_SG_OWNER - which will be similar to already existing OWNER_OR_NETWORK_OWNER Moving this back to CLOSED ERRATA. CLOSED ERRATA bugs should not be reopened. If the bug is not fixed, please clone it to a new bug. |