)]}'
{"specs/kilo/pass-targets-to-policy-enforcer.rst":[{"author":{"_account_id":6549,"name":"Zhi Yan Liu","email":"lzy.dev@gmail.com","username":"lzy-dev"},"change_message_id":"613a5e1410573c722a43b2665c4953cf13415d8f","unresolved":false,"context_lines":[{"line_number":132,"context_line":"Other deployer impact"},{"line_number":133,"context_line":"---------------------"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"None"},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"Developer impact"},{"line_number":138,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a930d6b_bb53b8e0","line":135,"updated":"2015-01-26 08:19:40.000000000","message":"Need to add new rules in policy.json to leverage this feature to do more functional restrictions. IMO, it\u0027d be better for operator to list some rule examples here as references.","commit_id":"3d2a98fe490ba8f20ed0b45f1819b2cdb2a66162"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"a187fce61c1524b870589b7e07cb49a9a23695a1","unresolved":false,"context_lines":[{"line_number":22,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Currently, Glance promises that permissions can be configured in the"},{"line_number":25,"context_line":"``policy.json`` file but this any rule other than a role check currently"},{"line_number":26,"context_line":"results in a ``403 Forbidden`` response. As this is a promised feature,"},{"line_number":27,"context_line":"implementing this specification is merely fixing the already promised"},{"line_number":28,"context_line":"behaviour."}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a80dd14_a15da84a","line":25,"updated":"2015-03-11 22:15:42.000000000","message":"remove the \u0027this\u0027?","commit_id":"67c8d3e1e7b339e211431522b38489f1879cdf77"},{"author":{"_account_id":12000,"name":"Ian Cordasco","email":"sigmavirus24@gmail.com","username":"sigmavirus24"},"change_message_id":"e23bca69d5ca17bdf3c90cb27547d1550be21e64","unresolved":false,"context_lines":[{"line_number":22,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Currently, Glance promises that permissions can be configured in the"},{"line_number":25,"context_line":"``policy.json`` file but this any rule other than a role check currently"},{"line_number":26,"context_line":"results in a ``403 Forbidden`` response. As this is a promised feature,"},{"line_number":27,"context_line":"implementing this specification is merely fixing the already promised"},{"line_number":28,"context_line":"behaviour."}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a80dd14_07184474","line":25,"in_reply_to":"9a80dd14_a15da84a","updated":"2015-03-11 22:30:17.000000000","message":"Done","commit_id":"67c8d3e1e7b339e211431522b38489f1879cdf77"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"a187fce61c1524b870589b7e07cb49a9a23695a1","unresolved":false,"context_lines":[{"line_number":73,"context_line":"The solution for image-based resources is simple. We have the ``image`` on the"},{"line_number":74,"context_line":"policy proxies that relate to images. We simply pass that to"},{"line_number":75,"context_line":"``glance.api.policy.ImageTarget`` and pass the resulting instance to the"},{"line_number":76,"context_line":"policy enforce so it can be accessed like a dictionary when interpolated."},{"line_number":77,"context_line":"For members and tasks, there is no target class that we can use. These are"},{"line_number":78,"context_line":"very thin classes that could easily be written."},{"line_number":79,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a80dd14_a43936da","line":76,"updated":"2015-03-11 22:15:42.000000000","message":"should be \u0027enforcer\u0027 ?","commit_id":"67c8d3e1e7b339e211431522b38489f1879cdf77"},{"author":{"_account_id":12000,"name":"Ian Cordasco","email":"sigmavirus24@gmail.com","username":"sigmavirus24"},"change_message_id":"e23bca69d5ca17bdf3c90cb27547d1550be21e64","unresolved":false,"context_lines":[{"line_number":73,"context_line":"The solution for image-based resources is simple. We have the ``image`` on the"},{"line_number":74,"context_line":"policy proxies that relate to images. We simply pass that to"},{"line_number":75,"context_line":"``glance.api.policy.ImageTarget`` and pass the resulting instance to the"},{"line_number":76,"context_line":"policy enforce so it can be accessed like a dictionary when interpolated."},{"line_number":77,"context_line":"For members and tasks, there is no target class that we can use. These are"},{"line_number":78,"context_line":"very thin classes that could easily be written."},{"line_number":79,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a80dd14_6720209c","line":76,"in_reply_to":"9a80dd14_a43936da","updated":"2015-03-11 22:30:17.000000000","message":"Done","commit_id":"67c8d3e1e7b339e211431522b38489f1879cdf77"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"a187fce61c1524b870589b7e07cb49a9a23695a1","unresolved":false,"context_lines":[{"line_number":75,"context_line":"``glance.api.policy.ImageTarget`` and pass the resulting instance to the"},{"line_number":76,"context_line":"policy enforce so it can be accessed like a dictionary when interpolated."},{"line_number":77,"context_line":"For members and tasks, there is no target class that we can use. These are"},{"line_number":78,"context_line":"very thin classes that could easily be written."},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"Once we have the appropriately defined target classes, we would then update"},{"line_number":81,"context_line":"the places where the policy is enforced to use instances of those target"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a80dd14_244d4673","line":78,"updated":"2015-03-11 22:15:42.000000000","message":"You read my mind!","commit_id":"67c8d3e1e7b339e211431522b38489f1879cdf77"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"a187fce61c1524b870589b7e07cb49a9a23695a1","unresolved":false,"context_lines":[{"line_number":121,"context_line":"---------------------"},{"line_number":122,"context_line":""},{"line_number":123,"context_line":"Currently, several actions that are destructive can be performed by any user."},{"line_number":124,"context_line":"For example, currently the ``delete_image`` action defaults to check that"},{"line_number":125,"context_line":"always evaluates to true. If a user can see an image they can also delete it,"},{"line_number":126,"context_line":"regardless of whether they are an administrator or are a member of the tenant"},{"line_number":127,"context_line":"that controls the image. Once this specification is implemented, if the"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a80dd14_647c9e73","line":124,"updated":"2015-03-11 22:15:42.000000000","message":"defaults to *a* check?","commit_id":"67c8d3e1e7b339e211431522b38489f1879cdf77"},{"author":{"_account_id":12000,"name":"Ian Cordasco","email":"sigmavirus24@gmail.com","username":"sigmavirus24"},"change_message_id":"e23bca69d5ca17bdf3c90cb27547d1550be21e64","unresolved":false,"context_lines":[{"line_number":121,"context_line":"---------------------"},{"line_number":122,"context_line":""},{"line_number":123,"context_line":"Currently, several actions that are destructive can be performed by any user."},{"line_number":124,"context_line":"For example, currently the ``delete_image`` action defaults to check that"},{"line_number":125,"context_line":"always evaluates to true. If a user can see an image they can also delete it,"},{"line_number":126,"context_line":"regardless of whether they are an administrator or are a member of the tenant"},{"line_number":127,"context_line":"that controls the image. Once this specification is implemented, if the"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a80dd14_e76170d4","line":124,"in_reply_to":"9a80dd14_647c9e73","updated":"2015-03-11 22:30:17.000000000","message":"Done","commit_id":"67c8d3e1e7b339e211431522b38489f1879cdf77"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"a187fce61c1524b870589b7e07cb49a9a23695a1","unresolved":false,"context_lines":[{"line_number":124,"context_line":"For example, currently the ``delete_image`` action defaults to check that"},{"line_number":125,"context_line":"always evaluates to true. If a user can see an image they can also delete it,"},{"line_number":126,"context_line":"regardless of whether they are an administrator or are a member of the tenant"},{"line_number":127,"context_line":"that controls the image. Once this specification is implemented, if the"},{"line_number":128,"context_line":"operator decides to restrict image deletion based on tenant identifier, users"},{"line_number":129,"context_line":"not belonging to that tenant will be unable to arbitrarily delete images. The"},{"line_number":130,"context_line":"same will apply to other possible action targets."}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a80dd14_a4713679","line":127,"updated":"2015-03-11 22:15:42.000000000","message":"Can you clarify this? I guess you mean that any user can perform the delete_image action (and then the code that does the delete does some checks that should have been handled by the policy engine)?  I\u0027m pretty sure that I can\u0027t delete other people\u0027s images right now ... you are scaring me!","commit_id":"67c8d3e1e7b339e211431522b38489f1879cdf77"},{"author":{"_account_id":12000,"name":"Ian Cordasco","email":"sigmavirus24@gmail.com","username":"sigmavirus24"},"change_message_id":"e23bca69d5ca17bdf3c90cb27547d1550be21e64","unresolved":false,"context_lines":[{"line_number":124,"context_line":"For example, currently the ``delete_image`` action defaults to check that"},{"line_number":125,"context_line":"always evaluates to true. If a user can see an image they can also delete it,"},{"line_number":126,"context_line":"regardless of whether they are an administrator or are a member of the tenant"},{"line_number":127,"context_line":"that controls the image. Once this specification is implemented, if the"},{"line_number":128,"context_line":"operator decides to restrict image deletion based on tenant identifier, users"},{"line_number":129,"context_line":"not belonging to that tenant will be unable to arbitrarily delete images. The"},{"line_number":130,"context_line":"same will apply to other possible action targets."}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a80dd14_4785dc57","line":127,"in_reply_to":"9a80dd14_a4713679","updated":"2015-03-11 22:30:17.000000000","message":"Sorry. I wrote this way too long ago for it to have been accurate. The code that protects us from being able to delete *any* other person\u0027s image is deep within Glance\u0027s controllers. (It\u0027s nested so many levels deep that I\u0027ve already forgotten where it lives.) I\u0027ve clarified this.","commit_id":"67c8d3e1e7b339e211431522b38489f1879cdf77"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"a187fce61c1524b870589b7e07cb49a9a23695a1","unresolved":false,"context_lines":[{"line_number":173,"context_line":""},{"line_number":174,"context_line":"- ``owner``"},{"line_number":175,"context_line":"- ``protected``"},{"line_number":176,"context_line":"- ``is_public``"},{"line_number":177,"context_line":""},{"line_number":178,"context_line":"An operator, therefore, could construct a set of rules like the following::"},{"line_number":179,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a80dd14_a4a21698","line":176,"updated":"2015-03-11 22:15:42.000000000","message":"\u0027is_public\u0027 is only exposed in v1, it\u0027s replaced by \u0027visibility\u0027 in v2.  I\u0027m not exactly sure how that affects things, though.","commit_id":"67c8d3e1e7b339e211431522b38489f1879cdf77"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"5b6c313348f517568ca9ac28d5dd3649c57f75ee","unresolved":false,"context_lines":[{"line_number":173,"context_line":""},{"line_number":174,"context_line":"- ``owner``"},{"line_number":175,"context_line":"- ``protected``"},{"line_number":176,"context_line":"- ``is_public``"},{"line_number":177,"context_line":""},{"line_number":178,"context_line":"An operator, therefore, could construct a set of rules like the following::"},{"line_number":179,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a80dd14_7e0ecc33","line":176,"in_reply_to":"9a80dd14_04012206","updated":"2015-03-12 12:55:49.000000000","message":"OK.  I wonder whether with a nod to future development, \u0027is_public\u0027 should be replaced with \u0027visibility\u0027.   I\u0027m thinking of \"community\" images here, https://review.openstack.org/#/c/124050/ , which are targeted for L.  They\u0027ll change visibility from being 2-valued to 4-valued.  Or, we can cross that bridge when we come to it.  If so, it might be worth putting a comment on the community images spec that some work will need to be done on the policy enforcer.","commit_id":"67c8d3e1e7b339e211431522b38489f1879cdf77"},{"author":{"_account_id":12000,"name":"Ian Cordasco","email":"sigmavirus24@gmail.com","username":"sigmavirus24"},"change_message_id":"273c2b27c268f9e82ca2a663e12cb998461c90b9","unresolved":false,"context_lines":[{"line_number":173,"context_line":""},{"line_number":174,"context_line":"- ``owner``"},{"line_number":175,"context_line":"- ``protected``"},{"line_number":176,"context_line":"- ``is_public``"},{"line_number":177,"context_line":""},{"line_number":178,"context_line":"An operator, therefore, could construct a set of rules like the following::"},{"line_number":179,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a80dd14_fd0f21df","line":176,"in_reply_to":"9a80dd14_7e0ecc33","updated":"2015-03-12 13:51:00.000000000","message":"So we can add a key transform to Id914c478ca7c4dfde3f08028d8b70c623f26b6e9 so that is_public will be treated as \u0027visibility\u0027 but then that logic will be in two places and need to be updated in two places. Thoughts?","commit_id":"67c8d3e1e7b339e211431522b38489f1879cdf77"},{"author":{"_account_id":12000,"name":"Ian Cordasco","email":"sigmavirus24@gmail.com","username":"sigmavirus24"},"change_message_id":"e23bca69d5ca17bdf3c90cb27547d1550be21e64","unresolved":false,"context_lines":[{"line_number":173,"context_line":""},{"line_number":174,"context_line":"- ``owner``"},{"line_number":175,"context_line":"- ``protected``"},{"line_number":176,"context_line":"- ``is_public``"},{"line_number":177,"context_line":""},{"line_number":178,"context_line":"An operator, therefore, could construct a set of rules like the following::"},{"line_number":179,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a80dd14_04012206","line":176,"in_reply_to":"9a80dd14_a4a21698","updated":"2015-03-11 22:30:17.000000000","message":"So looking at how we pass things to the enforcer, the only attribute we\u0027d present is the boolean ``is_public`` as it exists on the model. (To be clear, we\u0027re passing the ImageProxy target directly to the enforcer.)","commit_id":"67c8d3e1e7b339e211431522b38489f1879cdf77"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"ad633a17eb8f1a2ab5bccace2806c5d0b1a6f589","unresolved":false,"context_lines":[{"line_number":173,"context_line":""},{"line_number":174,"context_line":"- ``owner``"},{"line_number":175,"context_line":"- ``protected``"},{"line_number":176,"context_line":"- ``is_public``"},{"line_number":177,"context_line":""},{"line_number":178,"context_line":"An operator, therefore, could construct a set of rules like the following::"},{"line_number":179,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a80dd14_b0dd9572","line":176,"in_reply_to":"9a80dd14_fd0f21df","updated":"2015-03-13 14:10:39.000000000","message":"Since my concern is based on a spec that won\u0027t be approved until at least L, my concern is purely speculative at this point.  I think the thing to do is just note here that we\u0027re using the v1 \u0027is_public\u0027 instead of the v2 \u0027visibility\u0027 (which are both 2-valued at this point, and easily mapped) and leave it at that.","commit_id":"67c8d3e1e7b339e211431522b38489f1879cdf77"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"2c595a98a4816585232329165aa49277f1a69f37","unresolved":false,"context_lines":[{"line_number":126,"context_line":"any user would be able to delete any image. Once this specification is"},{"line_number":127,"context_line":"implemented, if the operator decides to restrict image deletion based on"},{"line_number":128,"context_line":"tenant identifier, users not belonging to that tenant will be unable to"},{"line_number":129,"context_line":"arbitrarily delete images. The same will apply to other possible action"},{"line_number":130,"context_line":"targets."},{"line_number":131,"context_line":""},{"line_number":132,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a80dd14_b054b554","line":129,"updated":"2015-03-13 14:19:15.000000000","message":"This is still a bit confusing.  What I mean is, your spec will make it possible for the checks in the code to be removed and specific capabilities to be governed at the policy level.  But removing those checks isn\u0027t part of this spec, so if, for example, some operator *does* want to allow any user to delete any image and sets the policy accordingly, no user will have that ability because the checks in the code will enforce admin-or-owner deletion only.","commit_id":"66cd50ffa4700fecb27512934bc2c803b5b82d95"},{"author":{"_account_id":12000,"name":"Ian Cordasco","email":"sigmavirus24@gmail.com","username":"sigmavirus24"},"change_message_id":"ba4a17f7fbd712ecaec6a44bdba39b422a3d4555","unresolved":false,"context_lines":[{"line_number":126,"context_line":"any user would be able to delete any image. Once this specification is"},{"line_number":127,"context_line":"implemented, if the operator decides to restrict image deletion based on"},{"line_number":128,"context_line":"tenant identifier, users not belonging to that tenant will be unable to"},{"line_number":129,"context_line":"arbitrarily delete images. The same will apply to other possible action"},{"line_number":130,"context_line":"targets."},{"line_number":131,"context_line":""},{"line_number":132,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a80dd14_b44f246a","line":129,"in_reply_to":"9a80dd14_b054b554","updated":"2015-03-14 18:14:27.000000000","message":"Correct. This needs one more revision then, clearly.","commit_id":"66cd50ffa4700fecb27512934bc2c803b5b82d95"},{"author":{"_account_id":12000,"name":"Ian Cordasco","email":"sigmavirus24@gmail.com","username":"sigmavirus24"},"change_message_id":"f1dacd48b41ce124fb72285ce3ad07295ce21244","unresolved":false,"context_lines":[{"line_number":126,"context_line":"any user would be able to delete any image. Once this specification is"},{"line_number":127,"context_line":"implemented, if the operator decides to restrict image deletion based on"},{"line_number":128,"context_line":"tenant identifier, users not belonging to that tenant will be unable to"},{"line_number":129,"context_line":"arbitrarily delete images. The same will apply to other possible action"},{"line_number":130,"context_line":"targets."},{"line_number":131,"context_line":""},{"line_number":132,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a80dd14_2ec39d58","line":129,"in_reply_to":"9a80dd14_b054b554","updated":"2015-03-17 02:47:21.000000000","message":"So really this whole paragraph is just wrong. And there isn\u0027t much end user impact in reality, so I just removed this.","commit_id":"66cd50ffa4700fecb27512934bc2c803b5b82d95"},{"author":{"_account_id":8158,"name":"Hemanth Makkapati","email":"makstacker+osgerrit@gmail.com","username":"hemanth.makkapati"},"change_message_id":"f03123896db11b25ac2f5372856ae6a627ad89a0","unresolved":false,"context_lines":[{"line_number":36,"context_line":""},{"line_number":37,"context_line":"If we define a rule similar to the following::"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"   \"tenant_is_owner\": \"tenant%(owner)s\""},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"And we apply it to an action, e.g.,"},{"line_number":42,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"9a80dd14_d21efa0c","line":39,"updated":"2015-03-19 15:48:08.000000000","message":"Is there a missing colon here?","commit_id":"a9fde2dee6fae620b2c816c4f3c8da0a762c5c71"}]}