Reviewed: https://review.openstack.org/351077 Committed: https://git.openstack.org/cgit/openstack/nova/commit/?id=16a38564cb61031466bf60ac393363bfeaedbd93 Submitter: Jenkins Branch: master
commit 16a38564cb61031466bf60ac393363bfeaedbd93 Author: Takashi NATSUME <natsume.taka...@lab.ntt.co.jp> Date: Thu Aug 4 17:56:58 2016 +0900 Fix server operations' policies to admin only Before the following policies were set to admin only operations by default. * detail:get_all_tenants * index:get_all_tenants * create:forced_host But currently they are not limited to admin users by default. They were changed unintentionally in I71b3d1233255125cb280a000b990329f5b03fdfd. So set them admin only again. And a unit test for policy is fixed. Change-Id: I1c0a4f1ff19d68152953dd6b265a7fb2e0f6271a Closes-Bug: #1609625 Closes-Bug: #1609691 Closes-Bug: #1611628 ** Changed in: nova Status: In Progress => Fix Released -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to OpenStack Compute (nova). https://bugs.launchpad.net/bugs/1609691 Title: Non-admin users can lists VM instances of other projects (tenants) by default Status in OpenStack Compute (nova): Fix Released Status in OpenStack Security Advisory: Won't Fix Bug description: Non-admin users can lists VM instances of other projects (tenants) by default. They should not be able to see VM instances of other projects by default. stack@devstack-master:/opt/devstack$ openstack project list +----------------------------------+--------------------+ | ID | Name | +----------------------------------+--------------------+ | 33621006e3744ecea0b7090658601929 | alt_demo | | 6773c471c311455d862ed22f685574b0 | admin | | 850f809b7ee5469f8aa639b4717f58a5 | demo | | 95a64b7c097e4b69bd8af9224f332cd6 | invisible_to_admin | | c65ecc9a29e64e83bedf0609bb27266f | service | +----------------------------------+--------------------+ stack@devstack-master:/opt/devstack$ openstack user list +----------------------------------+----------+ | ID | Name | +----------------------------------+----------+ | 60066d4ac41a44d1ab6abea61809e78a | admin | | 896d17cb7d0f49f585ce460f61f35a5a | demo | | 6fcc02a6cfa64de097d15d2535d0108e | alt_demo | | b703f8d08aae46e0bad0fe3022d13250 | nova | | 205a38f88db84c13bb84274456da8b69 | glance | | c2a64c7cffae430493dac9d8b4ef6470 | cinder | | 5ad6f4ce7c64489e965d56eba081e2a9 | neutron | | 2d16f7d5f324446dbfa30db2a04f9658 | heat | +----------------------------------+----------+ stack@devstack-master:/opt/devstack$ openstack user role list --project admin admin +----------------------------------+-------+---------+-------+ | ID | Name | Project | User | +----------------------------------+-------+---------+-------+ | 915b08cc7e6b40ceb55a803e8a843d0d | admin | admin | admin | +----------------------------------+-------+---------+-------+ stack@devstack-master:/opt/devstack$ openstack user role list --project demo demo +----------------------------------+-------------+---------+------+ | ID | Name | Project | User | +----------------------------------+-------------+---------+------+ | cf49079e087a4c61935bac9a5c6c224d | Member | demo | demo | | 664e30492b954257ae579e8498c4fc78 | anotherrole | demo | demo | +----------------------------------+-------------+---------+------+ Operated by admin: stack@devstack-master:/opt/devstack$ nova show server1 +--------------------------------------+----------------------------------------------------------------+ | Property | Value | +--------------------------------------+----------------------------------------------------------------+ (snipped...) | OS-EXT-STS:vm_state | active | (snipped...) | id | 853d681b-de17-4fd3-bcd6-0f91d153ccd6 | (snipped...) | name | server1 | (snipped...) | tenant_id | 6773c471c311455d862ed22f685574b0 | * admin | updated | 2016-08-04T08:09:49Z | | user_id | 60066d4ac41a44d1ab6abea61809e78a | * admin +--------------------------------------+----------------------------------------------------------------+ Operated by demo: stack@devstack-master:/opt/devstack$ env | grep OS (snipped...) OS_USERNAME=demo OS_TENANT_NAME=demo (snipped...) stack@devstack-master:/opt/devstack$ nova list +----+------+--------+------------+-------------+----------+ | ID | Name | Status | Task State | Power State | Networks | +----+------+--------+------------+-------------+----------+ +----+------+--------+------------+-------------+----------+ stack@devstack-master:/opt/devstack$ nova list --all-tenants +--------------------------------------+---------+----------------------------------+--------+------------+-------------+--------------------------------+ | ID | Name | Tenant ID | Status | Task State | Power State | Networks | +--------------------------------------+---------+----------------------------------+--------+------------+-------------+--------------------------------+ | 853d681b-de17-4fd3-bcd6-0f91d153ccd6 | server1 | 6773c471c311455d862ed22f685574b0 | ACTIVE | - | Running | public=2001:db8::4, 10.0.2.201 | +--------------------------------------+---------+----------------------------------+--------+------------+-------------+--------------------------------+ [Environment] OS: Ubuntu 14.04.1 LTS (64bit) nova master(commit: 5d040245e750aab06c620344828c2182703515b7) To manage notifications about this bug go to: https://bugs.launchpad.net/nova/+bug/1609691/+subscriptions -- Mailing list: https://launchpad.net/~yahoo-eng-team Post to : yahoo-eng-team@lists.launchpad.net Unsubscribe : https://launchpad.net/~yahoo-eng-team More help : https://help.launchpad.net/ListHelp