yahoo-eng-team team mailing list archive

[Vincent Hou <sbhou@xxxxxxxxxx>]

Hi Sandeep. Thank you for asking.
This is a bug no longer valid. I was using service as the tenant/projecet, service is actually a tenant, in which any user can access the resource. 
If we create different users and tenants, it should behave normally.

** Changed in: cinder
       Status: Incomplete => Invalid

** Changed in: nova
       Status: Triaged => Invalid

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Compute (nova).
https://bugs.launchpad.net/bugs/1157042

Title:
  VMs and volumes can be accessed in a different tenant by a different
  user

Status in Cinder:
  Invalid
Status in OpenStack Compute (Nova):
  Invalid

Bug description:
  1. Set username=admin and tenant=admin, create a volume and a VM. Run "cinder list" and "nova list". Remember the volume-id and vm-id.
  2. Switch to another user and tenant, run "cinder list" and "nova list". There is no volume or VM listed.
  3. Since we have already known the volume-id and vm-id. It is possible to try all the commands which applies to volumes and VMs, like delete, attach, start, stop, reboot... Theoretically under a different user and tenant, we are not supposed to access the volume or the VM. However, we can do any operation we want, as long as we know the volume-id and VM-id.

  Related blueprint: https://blueprints.launchpad.net/cinder/+spec
  /volume-acl

To manage notifications about this bug go to:
https://bugs.launchpad.net/cinder/+bug/1157042/+subscriptions