Skip to content

Commit 20a07ee

Browse files
author
Ghanshyam Mann
committed
Server actions APIs scoped to project scope
As per the RBAC new direction, we will allow project resources operation to be performed by the project scoped token only and system user will be allowed to perform system level operation only not project resources specific. Details about new direction can be found in community-wide goal - https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html This commit modify the server action APIs to be scoped to project scope. Fix the shelve-offload policy to pass the instance project id as target. Also modifying and adding tests for four cases: 1. enforce_scope=False + legacy rule (current default policies) 2. enforce_scope=False + No legacy rule 3. enforce_scope=True + legacy rule 4. enforce_scope=True + no legacy rule (end goal of new RBAC) Partial implement blueprint policy-defaults-refresh-2 Change-Id: I5293e9aa9cb3b48f97a5a2cf272939ada1aea2db
1 parent d7be635 commit 20a07ee

21 files changed

+508
-499
lines changed

‎nova/api/openstack/compute/shelve.py‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -64,9 +64,11 @@ def _shelve(self, req, id, body):
6464
def _shelve_offload(self, req, id, body):
6565
"""Force removal of a shelved instance from the compute node."""
6666
context = req.environ["nova.context"]
67-
context.can(shelve_policies.POLICY_ROOT % 'shelve_offload')
68-
6967
instance = common.get_instance(self.compute_api, context, id)
68+
context.can(shelve_policies.POLICY_ROOT % 'shelve_offload',
69+
target={'user_id': instance.user_id,
70+
'project_id': instance.project_id})
71+
7072
try:
7173
self.compute_api.shelve_offload(context, instance)
7274
except exception.InstanceIsLocked as e:

‎nova/policies/admin_actions.py‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,26 +24,26 @@
2424
admin_actions_policies = [
2525
policy.DocumentedRuleDefault(
2626
name=POLICY_ROOT % 'reset_state',
27-
check_str=base.SYSTEM_ADMIN,
27+
check_str=base.PROJECT_ADMIN,
2828
description="Reset the state of a given server",
2929
operations=[
3030
{
3131
'method': 'POST',
3232
'path': '/servers/{server_id}/action (os-resetState)'
3333
}
3434
],
35-
scope_types=['system', 'project']),
35+
scope_types=['project']),
3636
policy.DocumentedRuleDefault(
3737
name=POLICY_ROOT % 'inject_network_info',
38-
check_str=base.SYSTEM_ADMIN,
38+
check_str=base.PROJECT_ADMIN,
3939
description="Inject network information into the server",
4040
operations=[
4141
{
4242
'method': 'POST',
4343
'path': '/servers/{server_id}/action (injectNetworkInfo)'
4444
}
4545
],
46-
scope_types=['system', 'project']),
46+
scope_types=['project']),
4747
]
4848

4949

‎nova/policies/admin_password.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,15 +24,15 @@
2424
admin_password_policies = [
2525
policy.DocumentedRuleDefault(
2626
name=BASE_POLICY_NAME,
27-
check_str=base.PROJECT_MEMBER_OR_SYSTEM_ADMIN,
27+
check_str=base.PROJECT_MEMBER,
2828
description="Change the administrative password for a server",
2929
operations=[
3030
{
3131
'path': '/servers/{server_id}/action (changePassword)',
3232
'method': 'POST'
3333
}
3434
],
35-
scope_types=['system', 'project'])
35+
scope_types=['project'])
3636
]
3737

3838

‎nova/policies/evacuate.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,15 +24,15 @@
2424
evacuate_policies = [
2525
policy.DocumentedRuleDefault(
2626
name=BASE_POLICY_NAME,
27-
check_str=base.SYSTEM_ADMIN,
27+
check_str=base.PROJECT_ADMIN,
2828
description="Evacuate a server from a failed host to a new host",
2929
operations=[
3030
{
3131
'path': '/servers/{server_id}/action (evacuate)',
3232
'method': 'POST'
3333
}
3434
],
35-
scope_types=['system', 'project']),
35+
scope_types=['project']),
3636
]
3737

3838

‎nova/policies/lock_server.py‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -24,31 +24,31 @@
2424
lock_server_policies = [
2525
policy.DocumentedRuleDefault(
2626
name=POLICY_ROOT % 'lock',
27-
check_str=base.PROJECT_MEMBER_OR_SYSTEM_ADMIN,
27+
check_str=base.PROJECT_MEMBER,
2828
description="Lock a server",
2929
operations=[
3030
{
3131
'path': '/servers/{server_id}/action (lock)',
3232
'method': 'POST'
3333
}
3434
],
35-
scope_types=['system', 'project']
35+
scope_types=['project']
3636
),
3737
policy.DocumentedRuleDefault(
3838
name=POLICY_ROOT % 'unlock',
39-
check_str=base.PROJECT_MEMBER_OR_SYSTEM_ADMIN,
39+
check_str=base.PROJECT_MEMBER,
4040
description="Unlock a server",
4141
operations=[
4242
{
4343
'path': '/servers/{server_id}/action (unlock)',
4444
'method': 'POST'
4545
}
4646
],
47-
scope_types=['system', 'project']
47+
scope_types=['project']
4848
),
4949
policy.DocumentedRuleDefault(
5050
name=POLICY_ROOT % 'unlock:unlock_override',
51-
check_str=base.SYSTEM_ADMIN,
51+
check_str=base.PROJECT_ADMIN,
5252
description="""Unlock a server, regardless who locked the server.
5353
5454
This check is performed only after the check
@@ -59,7 +59,7 @@
5959
'method': 'POST'
6060
}
6161
],
62-
scope_types=['system', 'project']
62+
scope_types=['project']
6363
),
6464
]
6565

‎nova/policies/multinic.py‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@
3838
multinic_policies = [
3939
policy.DocumentedRuleDefault(
4040
name=BASE_POLICY_NAME % 'add',
41-
check_str=base.PROJECT_MEMBER_OR_SYSTEM_ADMIN,
41+
check_str=base.PROJECT_MEMBER,
4242
description="""Add a fixed IP address to a server.
4343
4444
This API is proxy calls to the Network service. This is
@@ -49,11 +49,11 @@
4949
'path': '/servers/{server_id}/action (addFixedIp)'
5050
}
5151
],
52-
scope_types=['system', 'project'],
52+
scope_types=['project'],
5353
deprecated_rule=DEPRECATED_POLICY),
5454
policy.DocumentedRuleDefault(
5555
name=BASE_POLICY_NAME % 'remove',
56-
check_str=base.PROJECT_MEMBER_OR_SYSTEM_ADMIN,
56+
check_str=base.PROJECT_MEMBER,
5757
description="""Remove a fixed IP address from a server.
5858
5959
This API is proxy calls to the Network service. This is
@@ -64,7 +64,7 @@
6464
'path': '/servers/{server_id}/action (removeFixedIp)'
6565
}
6666
],
67-
scope_types=['system', 'project'],
67+
scope_types=['project'],
6868
deprecated_rule=DEPRECATED_POLICY),
6969
]
7070

‎nova/policies/pause_server.py‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,27 +24,27 @@
2424
pause_server_policies = [
2525
policy.DocumentedRuleDefault(
2626
name=POLICY_ROOT % 'pause',
27-
check_str=base.PROJECT_MEMBER_OR_SYSTEM_ADMIN,
27+
check_str=base.PROJECT_MEMBER,
2828
description="Pause a server",
2929
operations=[
3030
{
3131
'path': '/servers/{server_id}/action (pause)',
3232
'method': 'POST'
3333
}
3434
],
35-
scope_types=['system', 'project']
35+
scope_types=['project']
3636
),
3737
policy.DocumentedRuleDefault(
3838
name=POLICY_ROOT % 'unpause',
39-
check_str=base.PROJECT_MEMBER_OR_SYSTEM_ADMIN,
39+
check_str=base.PROJECT_MEMBER,
4040
description="Unpause a paused server",
4141
operations=[
4242
{
4343
'path': '/servers/{server_id}/action (unpause)',
4444
'method': 'POST'
4545
}
4646
],
47-
scope_types=['system', 'project']
47+
scope_types=['project']
4848
),
4949
]
5050

‎nova/policies/remote_consoles.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
remote_consoles_policies = [
2525
policy.DocumentedRuleDefault(
2626
name=BASE_POLICY_NAME,
27-
check_str=base.PROJECT_MEMBER_OR_SYSTEM_ADMIN,
27+
check_str=base.PROJECT_MEMBER,
2828
description="""Generate a URL to access remove server console.
2929
3030
This policy is for ``POST /remote-consoles`` API and below Server actions APIs
@@ -56,7 +56,7 @@
5656
'path': '/servers/{server_id}/remote-consoles'
5757
},
5858
],
59-
scope_types=['system', 'project']),
59+
scope_types=['project']),
6060
]
6161

6262

‎nova/policies/rescue.py‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -37,26 +37,26 @@
3737
rescue_policies = [
3838
policy.DocumentedRuleDefault(
3939
name=BASE_POLICY_NAME,
40-
check_str=base.PROJECT_MEMBER_OR_SYSTEM_ADMIN,
40+
check_str=base.PROJECT_MEMBER,
4141
description="Rescue a server",
4242
operations=[
4343
{
4444
'path': '/servers/{server_id}/action (rescue)',
4545
'method': 'POST'
4646
},
4747
],
48-
scope_types=['system', 'project']),
48+
scope_types=['project']),
4949
policy.DocumentedRuleDefault(
5050
name=UNRESCUE_POLICY_NAME,
51-
check_str=base.PROJECT_MEMBER_OR_SYSTEM_ADMIN,
51+
check_str=base.PROJECT_MEMBER,
5252
description="Unrescue a server",
5353
operations=[
5454
{
5555
'path': '/servers/{server_id}/action (unrescue)',
5656
'method': 'POST'
5757
}
5858
],
59-
scope_types=['system', 'project'],
59+
scope_types=['project'],
6060
deprecated_rule=DEPRECATED_POLICY
6161
),
6262
]

‎nova/policies/shelve.py‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -24,37 +24,37 @@
2424
shelve_policies = [
2525
policy.DocumentedRuleDefault(
2626
name=POLICY_ROOT % 'shelve',
27-
check_str=base.PROJECT_MEMBER_OR_SYSTEM_ADMIN,
27+
check_str=base.PROJECT_MEMBER,
2828
description="Shelve server",
2929
operations=[
3030
{
3131
'method': 'POST',
3232
'path': '/servers/{server_id}/action (shelve)'
3333
}
3434
],
35-
scope_types=['system', 'project']),
35+
scope_types=['project']),
3636
policy.DocumentedRuleDefault(
3737
name=POLICY_ROOT % 'unshelve',
38-
check_str=base.PROJECT_MEMBER_OR_SYSTEM_ADMIN,
38+
check_str=base.PROJECT_MEMBER,
3939
description="Unshelve (restore) shelved server",
4040
operations=[
4141
{
4242
'method': 'POST',
4343
'path': '/servers/{server_id}/action (unshelve)'
4444
}
4545
],
46-
scope_types=['system', 'project']),
46+
scope_types=['project']),
4747
policy.DocumentedRuleDefault(
4848
name=POLICY_ROOT % 'shelve_offload',
49-
check_str=base.SYSTEM_ADMIN,
49+
check_str=base.PROJECT_ADMIN,
5050
description="Shelf-offload (remove) server",
5151
operations=[
5252
{
5353
'method': 'POST',
5454
'path': '/servers/{server_id}/action (shelveOffload)'
5555
}
5656
],
57-
scope_types=['system', 'project']),
57+
scope_types=['project']),
5858
]
5959

6060

0 commit comments

Comments
 (0)