)]}'
{"id":"openstack%2Fcyborg~987693","triplet_id":"openstack%2Fcyborg~stable%2F2025.2~I56f04adcfe270f02dfd6511a1aea1074e3d2dedb","project":"openstack/cyborg","branch":"stable/2025.2","topic":"bug/2144056","attention_set":{},"removed_from_attention_set":{"11604":{"account":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"last_update":"2026-05-08 09:04:46.000000000","reason":"\u003cGERRIT_ACCOUNT_11604\u003e replied on the change","reason_account":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"}}},"hashtags":[],"change_id":"I56f04adcfe270f02dfd6511a1aea1074e3d2dedb","subject":"Fix rule:allow policy bypass on device/deployable/attribute APIs","status":"MERGED","created":"2026-05-07 15:05:42.000000000","updated":"2026-05-08 10:15:09.000000000","submitted":"2026-05-08 10:12:27.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":4,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"987693-bug/2144056","meta_rev_id":"c4bdb88b02057df0e94526b22ab7125998f70b35","_number":987693,"virtual_id_number":987693,"owner":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":34452,"name":"Joan Gilabert","display_name":"jgilaber","email":"jgilaber@redhat.com","username":"jgilaber"},{"value":0,"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-05-08 10:12:27.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"recommended":{"_account_id":34452,"name":"Joan Gilabert","display_name":"jgilaber","email":"jgilaber@redhat.com","username":"jgilaber"},"all":[{"value":1,"date":"2026-05-07 15:42:12.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":34452,"name":"Joan Gilabert","display_name":"jgilaber","email":"jgilaber@redhat.com","username":"jgilaber"},{"value":2,"date":"2026-05-07 18:53:23.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","value":1,"default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"all":[{"value":0,"_account_id":34452,"name":"Joan Gilabert","display_name":"jgilaber","email":"jgilaber@redhat.com","username":"jgilaber"},{"value":1,"date":"2026-05-08 07:52:14.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":34452,"name":"Joan Gilabert","display_name":"jgilaber","email":"jgilaber@redhat.com","username":"jgilaber"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-05-07 15:42:12.000000000","updated_by":{"_account_id":34452,"name":"Joan Gilabert","display_name":"jgilaber","email":"jgilaber@redhat.com","username":"jgilaber"},"reviewer":{"_account_id":34452,"name":"Joan Gilabert","display_name":"jgilaber","email":"jgilaber@redhat.com","username":"jgilaber"},"state":"REVIEWER"},{"updated":"2026-05-07 15:53:37.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"1577b4415fedb239c7910ee6f56a81374c1202d1","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"date":"2026-05-07 15:05:42.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"3c4eea7eab2ffae00f5f833f7eb7977a8138d309","author":{"_account_id":34452,"name":"Joan Gilabert","display_name":"jgilaber","email":"jgilaber@redhat.com","username":"jgilaber"},"date":"2026-05-07 15:42:12.000000000","message":"Patch Set 1: Code-Review+1\n\n(1 comment)","accounts_in_message":[],"_revision_number":1},{"id":"94002cf83e04cc809a93e16db185da17c6f1568d","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-07 15:53:37.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/97e1c517e5e548c096250e307e951520\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/04c4ba90f1bf4bbabb3e4ae0463b4570 : SUCCESS in 5m 13s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/f2d55422abb64544aa72dada227e05c6 : SUCCESS in 3m 10s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/b8c3757a203f4b8aba6a574a8333514d : SUCCESS in 9m 50s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/3d4021eeb96e4514b1cca6dbf91485fa : FAILURE in 3m 32s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/2203e536c1fe4b76812912e7a92b83fb : SUCCESS in 3m 53s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/d7e48f292b034488b44e50bfd008f82f : SUCCESS in 4m 22s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/e886a8f74f5b48c7b2bd2024d649fe22 : SUCCESS in 6m 20s (non-voting)\n- cyborg-tempest https://zuul.opendev.org/t/openstack/build/f2f3711986d849c2b50efc4530f4143c : SUCCESS in 27m 19s\n- cyborg-tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/df82acdd8225445ea06edd13b8269687 : SUCCESS in 29m 43s\n- cyborg-tox-bandit https://zuul.opendev.org/t/openstack/build/f9b0abef1d5746b2be92de259d244a2f : SUCCESS in 3m 45s","accounts_in_message":[],"_revision_number":1},{"id":"4c7e64f8178b19422316572257910f7c672c4fb4","author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"date":"2026-05-07 18:53:17.000000000","message":"Patch Set 1:\n\n(1 comment)","accounts_in_message":[],"_revision_number":1},{"id":"d362cfbf514cb1c99cf8d88f10d54e2d49eb31c6","author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"date":"2026-05-07 18:53:23.000000000","message":"Patch Set 1: Code-Review+2","accounts_in_message":[],"_revision_number":1},{"id":"481050dbbc596fb8ed586086cf4995516a2a3cf2","author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"date":"2026-05-08 07:52:14.000000000","message":"Patch Set 1: Workflow+1\n\n(1 comment)","accounts_in_message":[],"_revision_number":1},{"id":"ee77d1cf4a810f89250eb031e1ff97a639eb4d58","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-08 08:28:03.000000000","message":"Patch Set 1:\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/351225aee138433cbdb4a8a84de630b2\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/6b931df4091e4faeb4aacd44a434de9f : SUCCESS in 4m 24s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/39b42216c62647279cdd6136665b4a49 : SUCCESS in 2m 38s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/4af624e6edf849c2b832f4ffee457685 : SUCCESS in 6m 29s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/ffae107de55a4eb198f5e2f741e41733 : SUCCESS in 2m 11s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/7729aacf790c49a197cca679bc38277e : SUCCESS in 4m 06s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/0df934353efb4bc19544741ae24e3f62 : SUCCESS in 3m 30s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/a86a23a0c89046c4aaa246988db8f832 : SUCCESS in 7m 08s (non-voting)\n- cyborg-tempest https://zuul.opendev.org/t/openstack/build/25f867e3816b4077b21499835c8c9a40 : SUCCESS in 17m 31s\n- cyborg-tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/394bee6f654f48b8a5a2276bf52586d3 : POST_FAILURE in 30m 04s\n- cyborg-tox-bandit https://zuul.opendev.org/t/openstack/build/4509b5793044445f860a3fb0a1fad981 : SUCCESS in 3m 07s","accounts_in_message":[],"_revision_number":1},{"id":"2508bad9a0e5c63920a5cea20e1605ba96b73605","author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"date":"2026-05-08 09:04:46.000000000","message":"Patch Set 1:\n\n(1 comment)","accounts_in_message":[],"_revision_number":1},{"id":"04b766ea92819ec75e255a9266f9e90d9478e094","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-08 09:41:04.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/ab68378ddbb046d580e5a8dfd6af6844\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/064a17b48f644010b1fc0e26eb85f2cd : SUCCESS in 3m 20s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/93c0395db90b4a5e8c14af81f2d69784 : SUCCESS in 2m 39s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/b779712460784be28057efbcf5fa9423 : SUCCESS in 8m 06s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/c2aa8f2bd2ac4d4fb4c93b391e0223a3 : SUCCESS in 5m 35s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/0d1e11533d97445a8f0558a47836f6b9 : SUCCESS in 5m 13s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/a1f697d75f2e4a3fac91b869326c7151 : SUCCESS in 3m 53s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/bcbd184f38994e1c87b80c2d04e6d5a3 : SUCCESS in 6m 34s (non-voting)\n- cyborg-tempest https://zuul.opendev.org/t/openstack/build/b3ba43e4f0ce49a084ef161fc35639b1 : SUCCESS in 30m 27s\n- cyborg-tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/f94230e401c241c3b965812e8b96bc86 : SUCCESS in 30m 08s\n- cyborg-tox-bandit https://zuul.opendev.org/t/openstack/build/47ce0561b6b64234a41ac36d33665078 : SUCCESS in 3m 21s","accounts_in_message":[],"_revision_number":1},{"id":"2db6d2cf618e868d43eddd8099134cdae963ac60","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-08 09:41:45.000000000","message":"Patch Set 1: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":1},{"id":"3211444c1fcb837a05b9a937834a7c21ff3cdf85","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-08 10:12:27.000000000","message":"Patch Set 1: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/5ee47520addb4c40bcbe3bb42b1640c6\n\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/2401dace81284cd08ce728af3a1430cf : SUCCESS in 3m 37s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/45f5da508a8f41b48bc20d11bd6176eb : SUCCESS in 4m 18s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/f392a90500b045c38c38590f6aa64a64 : SUCCESS in 3m 48s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/a27a986352ef41299a68a437e3c62150 : SUCCESS in 7m 56s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/8d83f52335fa4b789b7c3f787b4f589b : SUCCESS in 3m 44s\n- cyborg-tempest https://zuul.opendev.org/t/openstack/build/9f15f232b7df41f4b1f560224a9fb9a5 : SUCCESS in 30m 37s","accounts_in_message":[],"_revision_number":1},{"id":"94e49eede70e99dc1c9269638a7c7a4fa06738bc","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-08 10:12:27.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":1},{"id":"c4bdb88b02057df0e94526b22ab7125998f70b35","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-08 10:15:09.000000000","message":"Patch Set 1:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/1a59a9680b814c72aa46217516d26114\n\n- promote-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/cf42eda77a804f11ba922cf9d80769dc : SUCCESS in 38s\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/07f9f48099144baab7b3677f06e2e257 : SUCCESS in 45s","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"b958c6bc75b51a1a644ef62c7c2a88ae1497ba54","revisions":{"b958c6bc75b51a1a644ef62c7c2a88ae1497ba54":{"kind":"REWORK","_number":1,"created":"2026-05-07 15:05:42.000000000","uploader":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"ref":"refs/changes/93/987693/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/cyborg","ref":"refs/changes/93/987693/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/cyborg refs/changes/93/987693/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/cyborg refs/changes/93/987693/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/cyborg refs/changes/93/987693/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/cyborg refs/changes/93/987693/1"}}},"commit":{"parents":[{"commit":"a1c95354747fed4c3d4d833f31053c164402bf69","subject":"Fix cyborg-status upgrade check tests","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/cyborg/commit/a1c95354747fed4c3d4d833f31053c164402bf69"}]}],"author":{"name":"Sean Mooney","email":"work@seanmooney.info","date":"2026-04-26 18:22:14.000000000","tz":0},"committer":{"name":"Sean Mooney","email":"work@seanmooney.info","date":"2026-04-26 18:22:14.000000000","tz":0},"subject":"Fix rule:allow policy bypass on device/deployable/attribute APIs","message":"Fix rule:allow policy bypass on device/deployable/attribute APIs\n\nTen API endpoints in cyborg/common/policy.py used check_str\u003d\u0027rule:allow\u0027\n(@), which unconditionally authorises any authenticated Keystone user\nregardless of role, project membership, or scope. This allowed any\ntenant to enumerate the full accelerator hardware topology and trigger\nprivileged operations including FPGA reprogramming and hardware metadata\nmutation.\n\nReplace the unconditional rule:allow with role-checked rules available\non all maintained stable branches:\n\n  cyborg:arq:create          rule:allow -\u003e rule:project_member_or_admin\n  cyborg:device:get_one      rule:allow -\u003e rule:admin_api\n  cyborg:device:get_all      rule:allow -\u003e rule:admin_api\n  cyborg:deployable:get_one  rule:allow -\u003e rule:admin_api\n  cyborg:deployable:get_all  rule:allow -\u003e rule:admin_api\n  cyborg:deployable:program  rule:allow -\u003e rule:admin_api\n  cyborg:attribute:get_one   rule:allow -\u003e rule:admin_api\n  cyborg:attribute:get_all   rule:allow -\u003e rule:admin_api\n  cyborg:attribute:create    rule:allow -\u003e rule:admin_api\n  cyborg:attribute:delete    rule:allow -\u003e rule:admin_api\n\narq:create receives project_member_or_admin rather than admin_api\nbecause Nova forwards the end-user token when creating ARQs; admin_api\nwould break all non-admin instance launches.\n\nAlso remove the dead fpga_policies group (cyborg:fpga:{get_one,\nget_all,update}) whose rules were registered but never evaluated at\nruntime as no /v2/fpgas endpoint exists.\n\nAdd unit tests in cyborg/tests/unit/policies/ covering authorised and\nunauthorised contexts for each affected endpoint group, following the\npattern established by test_device_profiles.py.\n\nCVE-2026-40213\n\nCloses-Bug: #2143263\nAssisted-By: claude-code sonnet 4.6\nChange-Id: I56f04adcfe270f02dfd6511a1aea1074e3d2dedb\nSigned-off-by: Sean Mooney \u003cwork@seanmooney.info\u003e\n(cherry picked from commit 9c313b007fd09301b487ba500089636a09a02609)\n(cherry picked from commit 8aad73b158c2c8210f38747686b03e1f1c5fbeb9)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/cyborg/commit/b958c6bc75b51a1a644ef62c7c2a88ae1497ba54"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/cyborg/commit/b958c6bc75b51a1a644ef62c7c2a88ae1497ba54"}]},"branch":"refs/heads/stable/2025.2"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":34452,"name":"Joan Gilabert","display_name":"jgilaber","email":"jgilaber@redhat.com","username":"jgilaber"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}