yahoo-eng-team team mailing list archive

[OpenStack Infra <1611628@xxxxxxxxxxxxxxxxxx>]

Reviewed:  https://review.openstack.org/351077
Committed: https://git.openstack.org/cgit/openstack/nova/commit/?id=16a38564cb61031466bf60ac393363bfeaedbd93
Submitter: Jenkins
Branch:    master

commit 16a38564cb61031466bf60ac393363bfeaedbd93
Author: Takashi NATSUME <natsume.takashi@xxxxxxxxxxxxx>
Date:   Thu Aug 4 17:56:58 2016 +0900

    Fix server operations' policies to admin only
    
    Before the following policies were set to admin only operations
    by default.
    
    * detail:get_all_tenants
    * index:get_all_tenants
    * create:forced_host
    
    But currently they are not limited to admin users by default.
    They were changed unintentionally in
    I71b3d1233255125cb280a000b990329f5b03fdfd.
    So set them admin only again.
    And a unit test for policy is fixed.
    
    Change-Id: I1c0a4f1ff19d68152953dd6b265a7fb2e0f6271a
    Closes-Bug: #1609625
    Closes-Bug: #1609691
    Closes-Bug: #1611628


** Changed in: nova
       Status: In Progress => Fix Released

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Compute (nova).
https://bugs.launchpad.net/bugs/1611628

Title:
  test_admin_only_rules doesn't check an 'admin_or_owner' case correctly

Status in OpenStack Compute (nova):
  Fix Released

Bug description:
  The test_admin_only_rules method of RealRolePolicyTestCase class in
  nova/tests/unit/test_policy.py doesn't check an 'admin_or_owner' case
  correctly.

  ----------------------------------------------------------------------------
      def test_admin_only_rules(self):
          for rule in self.admin_only_rules:
              self.assertRaises(exception.PolicyNotAuthorized, policy.authorize,
                                self.non_admin_context, rule, self.target)
              policy.authorize(self.admin_context, rule, self.target)
  ----------------------------------------------------------------------------
  https://github.com/openstack/nova/blob/3d6e72689ee18a779d70405d11e09a69183cc853/nova/tests/unit/test_policy.py#L495

  If an admin only rule in source code is changed to 'admin_or_owner' rule by mistake,
  the assertRaises statement raises a PolicyNotAuthorized exception
  because it is not that the context is non admin user but the owner is defferent.
  So the target should be set to same project of non admin context.

To manage notifications about this bug go to:
https://bugs.launchpad.net/nova/+bug/1611628/+subscriptions