Skip to content

Commit f8551de

Browse files
konan-abhikk7ds
konan-abhi
authored and
kk7ds
committed
Make some metadef operations admin-only
This restricts all metadef resource manipulation to admin-only, but still allow users to see everything. There are multiple low-grade security issues with the metadef API, detailed in the related bug. Restricting resource manipulation to admin-only solves most of these concerns. SecurityImpact Depends-On: https://review.opendev.org/c/openstack/tempest/+/780108 Change-Id: I333c58e73c202c1f523030e54e03f2868459b595 Related-Bug: #1916926
1 parent 50cd037 commit f8551de

File tree

6 files changed

+231
-145
lines changed

6 files changed

+231
-145
lines changed

‎api-ref/source/v2/metadefs-index.rst‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,10 @@ constraints, and the resource types to which it can be associated. See
5555
<http://docs.openstack.org/developer/glance/metadefs-concepts.html>`_ in the
5656
Glance Developer documentation for more information.
5757

58+
.. note:: By default, only admins can manipulate the data exposed by
59+
this API, but all users may list and show public
60+
resources. This changed from a default of "open to all" in
61+
the Wallaby release.
5862

5963
.. include:: metadefs-namespaces.inc
6064
.. include:: metadefs-resourcetypes.inc

‎doc/source/user/metadefs-concepts.rst‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,17 @@ the property is applied to different types of resources, such as "hw\_" for
4343
images and "hw:" for flavors. So, on an image, the user would know to set the
4444
property as "hw_cpu_cores=1".
4545

46+
.. note:: Resource manipulation via this API is restricted to admins
47+
by default since the Wallaby release. This API does not
48+
provide limits suitable for exposure to all users, and can
49+
also leak information between users unintentionally. Even as
50+
an admin, be careful with the names you use for resources
51+
you create that are intended to be private, in order to
52+
avoid unintentional exposure. See Bug 1916926_ for more
53+
information.
54+
55+
.. _1916926: https://bugs.launchpad.net/glance/+bug/1916926/
56+
4657
Terminology
4758
-----------
4859

‎glance/policies/metadef.py‎

Lines changed: 45 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -14,46 +14,64 @@
1414

1515

1616
metadef_policies = [
17-
policy.RuleDefault(name="get_metadef_namespace", check_str="rule:default"),
17+
policy.RuleDefault(name="metadef_default", check_str=""),
18+
policy.RuleDefault(name="metadef_admin", check_str="role:admin"),
19+
policy.RuleDefault(name="get_metadef_namespace",
20+
check_str="rule:metadef_default"),
1821
policy.RuleDefault(name="get_metadef_namespaces",
19-
check_str="rule:default"),
22+
check_str="rule:metadef_default"),
2023
policy.RuleDefault(name="modify_metadef_namespace",
21-
check_str="rule:default"),
22-
policy.RuleDefault(name="add_metadef_namespace", check_str="rule:default"),
24+
check_str="rule:metadef_admin"),
25+
policy.RuleDefault(name="add_metadef_namespace",
26+
check_str="rule:metadef_admin"),
2327
policy.RuleDefault(name="delete_metadef_namespace",
24-
check_str="rule:default"),
28+
check_str="rule:metadef_admin"),
2529

26-
policy.RuleDefault(name="get_metadef_object", check_str="rule:default"),
27-
policy.RuleDefault(name="get_metadef_objects", check_str="rule:default"),
28-
policy.RuleDefault(name="modify_metadef_object", check_str="rule:default"),
29-
policy.RuleDefault(name="add_metadef_object", check_str="rule:default"),
30-
policy.RuleDefault(name="delete_metadef_object", check_str="rule:default"),
30+
policy.RuleDefault(name="get_metadef_object",
31+
check_str="rule:metadef_default"),
32+
policy.RuleDefault(name="get_metadef_objects",
33+
check_str="rule:metadef_default"),
34+
policy.RuleDefault(name="modify_metadef_object",
35+
check_str="rule:metadef_admin"),
36+
policy.RuleDefault(name="add_metadef_object",
37+
check_str="rule:metadef_admin"),
38+
policy.RuleDefault(name="delete_metadef_object",
39+
check_str="rule:metadef_admin"),
3140

3241
policy.RuleDefault(name="list_metadef_resource_types",
33-
check_str="rule:default"),
42+
check_str="rule:metadef_default"),
3443
policy.RuleDefault(name="get_metadef_resource_type",
35-
check_str="rule:default"),
44+
check_str="rule:metadef_default"),
3645
policy.RuleDefault(name="add_metadef_resource_type_association",
37-
check_str="rule:default"),
46+
check_str="rule:metadef_admin"),
3847
policy.RuleDefault(name="remove_metadef_resource_type_association",
39-
check_str="rule:default"),
48+
check_str="rule:metadef_admin"),
4049

41-
policy.RuleDefault(name="get_metadef_property", check_str="rule:default"),
50+
policy.RuleDefault(name="get_metadef_property",
51+
check_str="rule:metadef_default"),
4252
policy.RuleDefault(name="get_metadef_properties",
43-
check_str="rule:default"),
53+
check_str="rule:metadef_default"),
4454
policy.RuleDefault(name="modify_metadef_property",
45-
check_str="rule:default"),
46-
policy.RuleDefault(name="add_metadef_property", check_str="rule:default"),
55+
check_str="rule:metadef_admin"),
56+
policy.RuleDefault(name="add_metadef_property",
57+
check_str="rule:metadef_admin"),
4758
policy.RuleDefault(name="remove_metadef_property",
48-
check_str="rule:default"),
49-
50-
policy.RuleDefault(name="get_metadef_tag", check_str="rule:default"),
51-
policy.RuleDefault(name="get_metadef_tags", check_str="rule:default"),
52-
policy.RuleDefault(name="modify_metadef_tag", check_str="rule:default"),
53-
policy.RuleDefault(name="add_metadef_tag", check_str="rule:default"),
54-
policy.RuleDefault(name="add_metadef_tags", check_str="rule:default"),
55-
policy.RuleDefault(name="delete_metadef_tag", check_str="rule:default"),
56-
policy.RuleDefault(name="delete_metadef_tags", check_str="rule:default"),
59+
check_str="rule:metadef_admin"),
60+
61+
policy.RuleDefault(name="get_metadef_tag",
62+
check_str="rule:metadef_default"),
63+
policy.RuleDefault(name="get_metadef_tags",
64+
check_str="rule:metadef_default"),
65+
policy.RuleDefault(name="modify_metadef_tag",
66+
check_str="rule:metadef_admin"),
67+
policy.RuleDefault(name="add_metadef_tag",
68+
check_str="rule:metadef_admin"),
69+
policy.RuleDefault(name="add_metadef_tags",
70+
check_str="rule:metadef_admin"),
71+
policy.RuleDefault(name="delete_metadef_tag",
72+
check_str="rule:metadef_admin"),
73+
policy.RuleDefault(name="delete_metadef_tags",
74+
check_str="rule:metadef_admin"),
5775
]
5876

5977

‎glance/tests/etc/policy.yaml‎

Lines changed: 19 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,9 @@
55
# Defines the rule for the is_admin:True check.
66
#"context_is_admin": "role:admin"
77

8+
# Default for admin-only metadef rules
9+
"metadef_admin": "role:admin"
10+
811
# add_image
912
"add_image": ""
1013

@@ -84,13 +87,13 @@
8487
"get_metadef_namespaces": ""
8588

8689
# modify_metadef_namespace
87-
"modify_metadef_namespace": ""
90+
"modify_metadef_namespace": "rule:metadef_admin"
8891

8992
# add_metadef_namespace
90-
"add_metadef_namespace": ""
93+
"add_metadef_namespace": "rule:metadef_admin"
9194

9295
# delete_metadef_namespace
93-
"delete_metadef_namespace": ""
96+
"delete_metadef_namespace": "rule:metadef_admin"
9497

9598
# get_metadef_object
9699
"get_metadef_object": ""
@@ -99,13 +102,13 @@
99102
"get_metadef_objects": ""
100103

101104
# modify_metadef_object
102-
"modify_metadef_object": ""
105+
"modify_metadef_object": "rule:metadef_admin"
103106

104107
# add_metadef_object
105-
"add_metadef_object": ""
108+
"add_metadef_object": "rule:metadef_admin"
106109

107110
# delete_metadef_object
108-
"delete_metadef_object": ""
111+
"delete_metadef_object": "rule:metadef_admin"
109112

110113
# list_metadef_resource_types
111114
"list_metadef_resource_types": ""
@@ -114,10 +117,10 @@
114117
"get_metadef_resource_type": ""
115118

116119
# add_metadef_resource_type_association
117-
"add_metadef_resource_type_association": ""
120+
"add_metadef_resource_type_association": "rule:metadef_admin"
118121

119122
# remove_metadef_resource_type_association
120-
"remove_metadef_resource_type_association": ""
123+
"remove_metadef_resource_type_association": "rule:metadef_admin"
121124

122125
# get_metadef_property
123126
"get_metadef_property": ""
@@ -126,13 +129,13 @@
126129
"get_metadef_properties": ""
127130

128131
# modify_metadef_property
129-
"modify_metadef_property": ""
132+
"modify_metadef_property": "rule:metadef_admin"
130133

131134
# add_metadef_property
132-
"add_metadef_property": ""
135+
"add_metadef_property": "rule:metadef_admin"
133136

134137
# remove_metadef_property
135-
"remove_metadef_property": ""
138+
"remove_metadef_property": "rule:metadef_admin"
136139

137140
# get_metadef_tag
138141
"get_metadef_tag": ""
@@ -141,19 +144,19 @@
141144
"get_metadef_tags": ""
142145

143146
# modify_metadef_tag
144-
"modify_metadef_tag": ""
147+
"modify_metadef_tag": "rule:metadef_admin"
145148

146149
# add_metadef_tag
147-
"add_metadef_tag": ""
150+
"add_metadef_tag": "rule:metadef_admin"
148151

149152
# add_metadef_tags
150-
"add_metadef_tags": ""
153+
"add_metadef_tags": "rule:metadef_admin"
151154

152155
# delete_metadef_tag
153-
"delete_metadef_tag": ""
156+
"delete_metadef_tag": "rule:metadef_admin"
154157

155158
# delete_metadef_tags
156-
"delete_metadef_tags": ""
159+
"delete_metadef_tags": "rule:metadef_admin"
157160

158161
# WARNING: Below rules are either deprecated rules
159162
# or extra rules in policy file, it is strongly

0 commit comments

Comments
 (0)