Skip to content

Commit f7b0d1c

Browse files
author
ghanshyam mann
committed
RBAC updates: drop system scope
Based on the operator feedback, we have updated the RBAC community wide goal to drop the system scope from all the OpenStack services except Ironic and Keystone[1]. We are keeping scope_type in policy-in-code and every policy will be scoped to project whihc will help to return better error code (403) if system token is used to access the glance APIs (in case deployment having Ironic, Keystone using the scope checks). [1] https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html Change-Id: Ie3174593454e35d23a3e2be439a9213bbfa1a89e
1 parent c342c0e commit f7b0d1c

File tree

6 files changed

+84
-69
lines changed

6 files changed

+84
-69
lines changed

‎glance/policies/base.py‎

Lines changed: 3 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -54,16 +54,9 @@
5454
#
5555
# These check strings do not support tenancy with the `admin` role. This means
5656
# anyone with the `admin` role on any project can execute a policy, which is
57-
# typical in OpenStack services. Eventually, these check strings will be
58-
# superseded by check strings that implement scope checking and system-scope
59-
# for applicable APIs (e.g., making an image public). But, we have a lot of
60-
# cleanup to do in different parts of glance to sweep all the authorization
61-
# code into a single layer before we can safely consume system-scope and
62-
# implement scope checking. This refactoring also needs significant API testing
63-
# to ensure we don't leave doors open to unintended users, or expose
64-
# authoritative regressions. In the mean time, we can use the following check
65-
# strings to offer formal support for project membership and a read-only
66-
# variant consistent with other OpenStack services.
57+
# typical in OpenStack services. But following check strings offer formal
58+
# support for project membership and a read-only variant consistent with
59+
# other OpenStack services.
6760
ADMIN_OR_PROJECT_MEMBER = f'role:admin or ({PROJECT_MEMBER})'
6861
ADMIN_OR_PROJECT_READER = f'role:admin or ({PROJECT_READER})'
6962
ADMIN_OR_PROJECT_READER_GET_IMAGE = (

‎glance/policies/discovery.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
policy.DocumentedRuleDefault(
2020
name="stores_info_detail",
2121
check_str='role:admin',
22-
scope_types=['system', 'project'],
22+
scope_types=['project'],
2323
description='Expose store specific information',
2424
operations=[
2525
{'path': '/v2/info/stores/detail',

‎glance/policies/image.py‎

Lines changed: 23 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
policy.DocumentedRuleDefault(
2525
name="add_image",
2626
check_str=base.ADMIN_OR_PROJECT_MEMBER_CREATE_IMAGE,
27-
scope_types=['system', 'project'],
27+
scope_types=['project'],
2828
description='Create new image',
2929
operations=[
3030
{'path': '/v2/images',
@@ -38,7 +38,7 @@
3838
policy.DocumentedRuleDefault(
3939
name="delete_image",
4040
check_str=base.ADMIN_OR_PROJECT_MEMBER,
41-
scope_types=['system', 'project'],
41+
scope_types=['project'],
4242
description='Deletes the image',
4343
operations=[
4444
{'path': '/v2/images/{image_id}',
@@ -52,7 +52,7 @@
5252
policy.DocumentedRuleDefault(
5353
name="get_image",
5454
check_str=base.ADMIN_OR_PROJECT_READER_GET_IMAGE,
55-
scope_types=['system', 'project'],
55+
scope_types=['project'],
5656
description='Get specified image',
5757
operations=[
5858
{'path': '/v2/images/{image_id}',
@@ -66,7 +66,7 @@
6666
policy.DocumentedRuleDefault(
6767
name="get_images",
6868
check_str=base.ADMIN_OR_PROJECT_READER,
69-
scope_types=['system', 'project'],
69+
scope_types=['project'],
7070
description='Get all available images',
7171
operations=[
7272
{'path': '/v2/images',
@@ -80,7 +80,7 @@
8080
policy.DocumentedRuleDefault(
8181
name="modify_image",
8282
check_str=base.ADMIN_OR_PROJECT_MEMBER,
83-
scope_types=['system', 'project'],
83+
scope_types=['project'],
8484
description='Updates given image',
8585
operations=[
8686
{'path': '/v2/images/{image_id}',
@@ -94,7 +94,7 @@
9494
policy.DocumentedRuleDefault(
9595
name="publicize_image",
9696
check_str='role:admin',
97-
scope_types=['system', 'project'],
97+
scope_types=['project'],
9898
description='Publicize given image',
9999
operations=[
100100
{'path': '/v2/images/{image_id}',
@@ -104,7 +104,7 @@
104104
policy.DocumentedRuleDefault(
105105
name="communitize_image",
106106
check_str=base.ADMIN_OR_PROJECT_MEMBER,
107-
scope_types=['system', 'project'],
107+
scope_types=['project'],
108108
description='Communitize given image',
109109
operations=[
110110
{'path': '/v2/images/{image_id}',
@@ -119,7 +119,7 @@
119119
policy.DocumentedRuleDefault(
120120
name="download_image",
121121
check_str=base.ADMIN_OR_PROJECT_MEMBER_DOWNLOAD_IMAGE,
122-
scope_types=['system', 'project'],
122+
scope_types=['project'],
123123
description='Downloads given image',
124124
operations=[
125125
{'path': '/v2/images/{image_id}/file',
@@ -133,7 +133,7 @@
133133
policy.DocumentedRuleDefault(
134134
name="upload_image",
135135
check_str=base.ADMIN_OR_PROJECT_MEMBER,
136-
scope_types=['system', 'project'],
136+
scope_types=['project'],
137137
description='Uploads data to specified image',
138138
operations=[
139139
{'path': '/v2/images/{image_id}/file',
@@ -148,7 +148,7 @@
148148
policy.DocumentedRuleDefault(
149149
name="delete_image_location",
150150
check_str="role:admin",
151-
scope_types=['system', 'project'],
151+
scope_types=['project'],
152152
description='Deletes the location of given image',
153153
operations=[
154154
{'path': '/v2/images/{image_id}',
@@ -162,7 +162,7 @@
162162
policy.DocumentedRuleDefault(
163163
name="get_image_location",
164164
check_str=base.ADMIN_OR_PROJECT_READER,
165-
scope_types=['system', 'project'],
165+
scope_types=['project'],
166166
description='Reads the location of the image',
167167
operations=[
168168
{'path': '/v2/images/{image_id}',
@@ -176,7 +176,7 @@
176176
policy.DocumentedRuleDefault(
177177
name="set_image_location",
178178
check_str=base.ADMIN_OR_PROJECT_MEMBER,
179-
scope_types=['system', 'project'],
179+
scope_types=['project'],
180180
description='Sets location URI to given image',
181181
operations=[
182182
{'path': '/v2/images/{image_id}',
@@ -191,7 +191,7 @@
191191
policy.DocumentedRuleDefault(
192192
name="add_member",
193193
check_str=base.ADMIN_OR_PROJECT_MEMBER,
194-
scope_types=['system', 'project'],
194+
scope_types=['project'],
195195
description='Create image member',
196196
operations=[
197197
{'path': '/v2/images/{image_id}/members',
@@ -205,7 +205,7 @@
205205
policy.DocumentedRuleDefault(
206206
name="delete_member",
207207
check_str=base.ADMIN_OR_PROJECT_MEMBER,
208-
scope_types=['system', 'project'],
208+
scope_types=['project'],
209209
description='Delete image member',
210210
operations=[
211211
{'path': '/v2/images/{image_id}/members/{member_id}',
@@ -219,7 +219,7 @@
219219
policy.DocumentedRuleDefault(
220220
name="get_member",
221221
check_str=base.ADMIN_OR_PROJECT_READER_OR_SHARED_MEMBER,
222-
scope_types=['system', 'project'],
222+
scope_types=['project'],
223223
description='Show image member details',
224224
operations=[
225225
{'path': '/v2/images/{image_id}/members/{member_id}',
@@ -233,7 +233,7 @@
233233
policy.DocumentedRuleDefault(
234234
name="get_members",
235235
check_str=base.ADMIN_OR_PROJECT_READER_OR_SHARED_MEMBER,
236-
scope_types=['system', 'project'],
236+
scope_types=['project'],
237237
description='List image members',
238238
operations=[
239239
{'path': '/v2/images/{image_id}/members',
@@ -247,7 +247,7 @@
247247
policy.DocumentedRuleDefault(
248248
name="modify_member",
249249
check_str=base.ADMIN_OR_SHARED_MEMBER,
250-
scope_types=['system', 'project'],
250+
scope_types=['project'],
251251
description='Update image member',
252252
operations=[
253253
{'path': '/v2/images/{image_id}/members/{member_id}',
@@ -262,17 +262,14 @@
262262
policy.RuleDefault(
263263
name="manage_image_cache",
264264
check_str='role:admin',
265-
# NOTE(lbragstad): Remove 'project' from the list below when glance
266-
# fully supports system-scope and this policy is updated to reflect
267-
# that in the check string.
268-
scope_types=['system', 'project'],
265+
scope_types=['project'],
269266
description='Manage image cache'
270267
),
271268

272269
policy.DocumentedRuleDefault(
273270
name="deactivate",
274271
check_str=base.ADMIN_OR_PROJECT_MEMBER,
275-
scope_types=['system', 'project'],
272+
scope_types=['project'],
276273
description='Deactivate image',
277274
operations=[
278275
{'path': '/v2/images/{image_id}/actions/deactivate',
@@ -286,7 +283,7 @@
286283
policy.DocumentedRuleDefault(
287284
name="reactivate",
288285
check_str=base.ADMIN_OR_PROJECT_MEMBER,
289-
scope_types=['system', 'project'],
286+
scope_types=['project'],
290287
description='Reactivate image',
291288
operations=[
292289
{'path': '/v2/images/{image_id}/actions/reactivate',
@@ -301,11 +298,10 @@
301298
policy.DocumentedRuleDefault(
302299
name="copy_image",
303300
check_str='role:admin',
304-
# Eventually, we need to make sure we update the check string here to
305-
# be scope-aware, but for now this is restricted to system-admins and
306-
# project-admins. That might change in the future if we decide to push
301+
# For now this is restricted to project-admins.
302+
# That might change in the future if we decide to push
307303
# this functionality down to project-members.
308-
scope_types=['system', 'project'],
304+
scope_types=['project'],
309305
description='Copy existing image to other stores',
310306
operations=[
311307
{'path': '/v2/images/{image_id}/import',

0 commit comments

Comments
 (0)