)]}'
{"specs/ocata/approved/glance/glance-purge-keep-deleted-ids.rst":[{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"9dde61b24053974c0d1a9c2b076cbc82d8042795","unresolved":false,"context_lines":[{"line_number":50,"context_line":"require use of the --insecure option which will purge the system as normal."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Another alternative to modifying purge is to use a retired IDs table. This"},{"line_number":53,"context_line":"table would be dynamically updated with image IDs which have been publicized or shared. Purging the Glance database will not modify this table. When creating"},{"line_number":54,"context_line":"an image in Glance, if the retired IDs table contains the ID of the new image"},{"line_number":55,"context_line":"to create then it will fail. This will prevent publicized/shared image IDs"},{"line_number":56,"context_line":"being reassigned."}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a8ec9b2_1a7c4ab4","line":53,"updated":"2016-09-21 14:01:29.000000000","message":"Please wrap this line.","commit_id":"af75ae00b5849b1ee6612f071dad4fc26079e903"},{"author":{"_account_id":8158,"name":"Hemanth Makkapati","email":"makstacker+osgerrit@gmail.com","username":"hemanth.makkapati"},"change_message_id":"b5c9a1e17933e993ebe3542fcff3c63eb12045ea","unresolved":false,"context_lines":[{"line_number":38,"context_line":"associated with deleted Glance images will be removed excluding its ID. This"},{"line_number":39,"context_line":"will prevent the image ID being reassigned."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"This change will also include the option to forcefully purge image IDs by"},{"line_number":42,"context_line":"specifying the --insecure option (\u0027glance-manage --insecure db purge\u0027). Using"},{"line_number":43,"context_line":"this option will allow for backwards compatibility were needed."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"Alternatives"},{"line_number":46,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a8ec9b2_b659aa37","line":43,"range":{"start_line":41,"start_character":0,"end_line":43,"end_character":63},"updated":"2016-09-21 14:47:01.000000000","message":"I don\u0027t know if we should retain this behavior. Knowing this presents a security issue, why provide backwards compatibility? This really isn\u0027t breaking anything. If an operator is so determined to wipe out the deleted IDs, let\u0027s make it even more difficult for him/her by not providing absolutely any way to do it. Well, if they truly understand what they are doing and want to do it nonetheless, they can script it themselves.","commit_id":"5abd7a56fa5699b21b2ff9b3ccf8a372e7b1d6aa"},{"author":{"_account_id":5202,"name":"Erno Kuvaja","email":"jokke@usr.fi","username":"jokke"},"change_message_id":"ea62566a40661a3b8e4c8fbc4767cb583c4c9df4","unresolved":false,"context_lines":[{"line_number":38,"context_line":"associated with deleted Glance images will be removed excluding its ID. This"},{"line_number":39,"context_line":"will prevent the image ID being reassigned."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"This change will also include the option to forcefully purge image IDs by"},{"line_number":42,"context_line":"specifying the --insecure option (\u0027glance-manage --insecure db purge\u0027). Using"},{"line_number":43,"context_line":"this option will allow for backwards compatibility were needed."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"Alternatives"},{"line_number":46,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a95cdbc_153fad24","line":43,"range":{"start_line":41,"start_character":0,"end_line":43,"end_character":63},"in_reply_to":"5a8bc5a2_18972b91","updated":"2016-10-07 10:59:21.000000000","message":"Stuart++\n\nJust like we allow connecting to our API with \"insecure\" client connections for the cases where the security risk might not be valid or concern.\n\nWe cannot prevent people breaking the security or our promises, but at least we can make them think twice before doing so with our supported and provided tools.","commit_id":"5abd7a56fa5699b21b2ff9b3ccf8a372e7b1d6aa"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"9e46d00f9acc0d82fd6bc8d40d4b7fca8f731db0","unresolved":false,"context_lines":[{"line_number":38,"context_line":"associated with deleted Glance images will be removed excluding its ID. This"},{"line_number":39,"context_line":"will prevent the image ID being reassigned."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"This change will also include the option to forcefully purge image IDs by"},{"line_number":42,"context_line":"specifying the --insecure option (\u0027glance-manage --insecure db purge\u0027). Using"},{"line_number":43,"context_line":"this option will allow for backwards compatibility were needed."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"Alternatives"},{"line_number":46,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a8bc5a2_18972b91","line":43,"range":{"start_line":41,"start_character":0,"end_line":43,"end_character":63},"in_reply_to":"7a8ec9b2_b659aa37","updated":"2016-09-23 12:12:16.000000000","message":"\u003e Knowing this presents a security issue, why provide backwards compatibility?\n\nIt presents a security issue in some, but not all, cases.\n\nFor example, if you disable both the publicize image policy and the image sharing policy then purging everything is ok from a security point of view (I think).","commit_id":"5abd7a56fa5699b21b2ff9b3ccf8a372e7b1d6aa"},{"author":{"_account_id":5202,"name":"Erno Kuvaja","email":"jokke@usr.fi","username":"jokke"},"change_message_id":"fcee9e01efeaab42cb3f6bbf51ca01a7d9cc5810","unresolved":false,"context_lines":[{"line_number":24,"context_line":"marked as deleted. These records may be removed using \u0027glance-manage db purge\u0027"},{"line_number":25,"context_line":"or manually by an administrator."},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"If these records are removed, a malicious user may intentionally upload a new"},{"line_number":28,"context_line":"image using the same ID (Glance allows an image creator to optionally specify"},{"line_number":29,"context_line":"the image ID). This would cause any victim using an image with the ID to use"},{"line_number":30,"context_line":"an attacker supplied image."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a95cdbc_f5fb21bf","line":30,"range":{"start_line":27,"start_character":0,"end_line":30,"end_character":27},"updated":"2016-10-07 10:53:05.000000000","message":"This attack vector will grow with the community images as the driving factor for them is to give looser option for public images that would not spam every tenants image list. So with community images one could use former public image\u0027s ID and make it community image, thus being available for everyone without needing to know whom to share it with.","commit_id":"ca7e4f3a319ca8f06a9e5423f2973b8bc97c0b78"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"553de565cf10a8fe1445e0eda3c755c705b51548","unresolved":false,"context_lines":[{"line_number":24,"context_line":"marked as deleted. These records may be removed using \u0027glance-manage db purge\u0027"},{"line_number":25,"context_line":"or manually by an administrator."},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"If these records are removed, a malicious user may intentionally upload a new"},{"line_number":28,"context_line":"image using the same ID (Glance allows an image creator to optionally specify"},{"line_number":29,"context_line":"the image ID). This would cause any victim using an image with the ID to use"},{"line_number":30,"context_line":"an attacker supplied image."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a95cdbc_b29b4665","line":30,"range":{"start_line":27,"start_character":0,"end_line":30,"end_character":27},"in_reply_to":"1a95cdbc_f5fb21bf","updated":"2016-10-08 15:11:00.000000000","message":"That\u0027s a really good point.  We need to have this fixed before community images become available.","commit_id":"ca7e4f3a319ca8f06a9e5423f2973b8bc97c0b78"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"553de565cf10a8fe1445e0eda3c755c705b51548","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"This change will also include the option to forcefully purge image IDs by"},{"line_number":42,"context_line":"specifying the --insecure option (\u0027glance-manage --insecure db purge\u0027). Using"},{"line_number":43,"context_line":"this option will allow for backwards compatibility were needed."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"Alternatives"},{"line_number":46,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a95cdbc_328e56d0","line":43,"updated":"2016-10-08 15:11:00.000000000","message":"I really don\u0027t like this.  It\u0027s not like --insecure in the client, when you\u0027re just going insecure for one request.  Once community images hits, as Erno points out below, this could be a Big Problem that extends well beyond one transaction.  I\u0027m open to more discussion, but I\u0027m with Hemanth\u0027s comment on an earlier patch, if an operator really wants to do this, they can script it themselves.\n\nWe can restore the purge option once the \"retired IDs\" (the \"luxury version\", as Stuart puts it), has been implemented.  I think the purge should be removed and if someone invokes the option, a message with a reference to OSSN-0075 is displayed.","commit_id":"ca7e4f3a319ca8f06a9e5423f2973b8bc97c0b78"},{"author":{"_account_id":5202,"name":"Erno Kuvaja","email":"jokke@usr.fi","username":"jokke"},"change_message_id":"fcee9e01efeaab42cb3f6bbf51ca01a7d9cc5810","unresolved":false,"context_lines":[{"line_number":49,"context_line":"display a warning for using the purge command. Bypassing this message would"},{"line_number":50,"context_line":"require use of the --insecure option which will purge the system as normal."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Another alternative to modifying purge is to use a retired IDs table. This"},{"line_number":53,"context_line":"table would be dynamically updated with image IDs which have been publicized"},{"line_number":54,"context_line":"or shared. Purging the Glance database will not modify this table. When creating"},{"line_number":55,"context_line":"an image in Glance, if the retired IDs table contains the ID of the new image"},{"line_number":56,"context_line":"to create then it will fail. This will prevent publicized/shared image IDs"},{"line_number":57,"context_line":"being reassigned."},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"Another alternative to modifying purge is to add a new policy corresponding"},{"line_number":60,"context_line":"to creating images with specific instance UUIDs. This would restrict whether"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a95cdbc_3a057613","line":57,"range":{"start_line":52,"start_character":0,"end_line":57,"end_character":17},"updated":"2016-10-07 10:53:05.000000000","message":"I do like this approach! Common ground between securing shared \u0026 publicized (would need addition of the community images) former images and not growing hugely because of all the snapshots etc.","commit_id":"ca7e4f3a319ca8f06a9e5423f2973b8bc97c0b78"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"553de565cf10a8fe1445e0eda3c755c705b51548","unresolved":false,"context_lines":[{"line_number":49,"context_line":"display a warning for using the purge command. Bypassing this message would"},{"line_number":50,"context_line":"require use of the --insecure option which will purge the system as normal."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Another alternative to modifying purge is to use a retired IDs table. This"},{"line_number":53,"context_line":"table would be dynamically updated with image IDs which have been publicized"},{"line_number":54,"context_line":"or shared. Purging the Glance database will not modify this table. When creating"},{"line_number":55,"context_line":"an image in Glance, if the retired IDs table contains the ID of the new image"},{"line_number":56,"context_line":"to create then it will fail. This will prevent publicized/shared image IDs"},{"line_number":57,"context_line":"being reassigned."},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"Another alternative to modifying purge is to add a new policy corresponding"},{"line_number":60,"context_line":"to creating images with specific instance UUIDs. This would restrict whether"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a95cdbc_72661e52","line":57,"range":{"start_line":52,"start_character":0,"end_line":57,"end_character":17},"in_reply_to":"1a95cdbc_3a057613","updated":"2016-10-08 15:11:00.000000000","message":"I see two problems with this, though.\n\n(1) To make the backward compat with v1 work, we may be changing the default visibility to \u0027shared\u0027 (though there\u0027s a workaround, we\u0027ll just have to keep the visibility changes associated with community images in mind).\n\n(2) This would still allow a \"disgruntled employee\" scenario, in which a private image is replaced by one with a backdoor added, with the aim of attacking only that particular tenant.  (I know, if the disgruntled employee is the person in charge of creating images, a bad image could be created even without this reused-UUID-exploit.  But since we claim immutability, I think we need to close the reused-UUID-exploit.)\n\nI guess (2) is my primary concern.  Do we have access to any database experts who can address the implications of maintaining a retired_id table containing *all* the UUIDs that have ever been assigned?","commit_id":"ca7e4f3a319ca8f06a9e5423f2973b8bc97c0b78"},{"author":{"_account_id":5202,"name":"Erno Kuvaja","email":"jokke@usr.fi","username":"jokke"},"change_message_id":"fcee9e01efeaab42cb3f6bbf51ca01a7d9cc5810","unresolved":false,"context_lines":[{"line_number":56,"context_line":"to create then it will fail. This will prevent publicized/shared image IDs"},{"line_number":57,"context_line":"being reassigned."},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"Another alternative to modifying purge is to add a new policy corresponding"},{"line_number":60,"context_line":"to creating images with specific instance UUIDs. This would restrict whether"},{"line_number":61,"context_line":"a user is allowed to specify a UUID when using image-create."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"Data model impact"},{"line_number":64,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a95cdbc_b56c39d1","line":61,"range":{"start_line":59,"start_character":0,"end_line":61,"end_character":60},"updated":"2016-10-07 10:53:05.000000000","message":"Is DefCore testing the specifying image ID functionality? I\u0027m not too much against this approach but we need to investigate and document the consequences really well if we want to implement \u0026 expose this.","commit_id":"ca7e4f3a319ca8f06a9e5423f2973b8bc97c0b78"},{"author":{"_account_id":6754,"name":"Mark T. Voelker","email":"markvoelker@gmail.com","username":"mvoelker"},"change_message_id":"6f4e88d572dfb9a2dba08be983713c6ad2dfdd96","unresolved":false,"context_lines":[{"line_number":56,"context_line":"to create then it will fail. This will prevent publicized/shared image IDs"},{"line_number":57,"context_line":"being reassigned."},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"Another alternative to modifying purge is to add a new policy corresponding"},{"line_number":60,"context_line":"to creating images with specific instance UUIDs. This would restrict whether"},{"line_number":61,"context_line":"a user is allowed to specify a UUID when using image-create."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"Data model impact"},{"line_number":64,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a95cdbc_c4b38b4b","line":61,"range":{"start_line":59,"start_character":0,"end_line":61,"end_character":60},"in_reply_to":"1a95cdbc_3271f644","updated":"2016-10-10 14:23:26.000000000","message":"/me dons DefCore co-chair hat\n\n\nI don\u0027t think any of the tests in the existing Guidelines use the create-an-image-with-a-specified-UUID capability, so you\u0027re probably ok here (thanks for bringing that up Erno, it\u0027s great to see projects considering interop when making decisions like this).  That said: *typically* when we look at interoperability, we’re looking at what unprivileged users can do on a cloud.  Basically, imagine you’re Joe-with-a-credit card signing up for Rackspace/OVH/VexxHost/whoever’s public cloud, or Susan-with-an-employee-ID jumping on to a corporate IT-administered private cloud built with RedHat/Mirantis/VMware/whoever’s distro.  The things you can do are the things that are most likely to be interoperable and are likely to appear in Guidelines.  The things you can’t do aren’t as likely to be interoperable (common examples here are stuff that’s typically reserved for admins, like creating users or provider networks).  Those things are much less likely to appear in Guidelines.  There’s obviously an awful lot that can be restricted by whoever has the ability to change policy.json.  We tend to use default policy settings as a guide, but ultimately if we found that most of the clouds out there were changing default policy to allow a capability to be used by unprivileged users, we’d probably still be ok with it (I don’t think we’ve yet found such a case though…changes to default policy tend to be the exception rather than the rule for things we’ve looked at so far).\n\n\nIt’s important to note though: DefCore is a trailing indicator here.  If a project deems a setting to be insecure and wants to change it’s default policy settings (and cloud products follow suit), we’re ultimately going to see that the capability is no longer interoperable and drop it from our Guidelines.  Security issues are also one of the acceptable rationale for flagging tests in Board-approved Guidelines (and we’ve had tests flagged and ultimately dropped in the past because of security concerns).  It’s great when a project consults the Guidelines to see if they’re going to make a change that breaks something a lot of people may be depending on being enabled (if it’s in the Guidelines, the chances of that are higher), but ultimately the project still owns it’s technical decisions.","commit_id":"ca7e4f3a319ca8f06a9e5423f2973b8bc97c0b78"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"553de565cf10a8fe1445e0eda3c755c705b51548","unresolved":false,"context_lines":[{"line_number":56,"context_line":"to create then it will fail. This will prevent publicized/shared image IDs"},{"line_number":57,"context_line":"being reassigned."},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"Another alternative to modifying purge is to add a new policy corresponding"},{"line_number":60,"context_line":"to creating images with specific instance UUIDs. This would restrict whether"},{"line_number":61,"context_line":"a user is allowed to specify a UUID when using image-create."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"Data model impact"},{"line_number":64,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a95cdbc_3271f644","line":61,"range":{"start_line":59,"start_character":0,"end_line":61,"end_character":60},"in_reply_to":"1a95cdbc_b56c39d1","updated":"2016-10-08 15:11:00.000000000","message":"Erno, thanks for bringing this up.  I don\u0027t think they\u0027re using the ability to specify an image\u0027s UUID in any current tests.  Additionally, they\u0027ve loosened up the restriction that *any* user should be able to run and pass the DefCore suite in any openstack cloud; it\u0027s acceptable for a cloud not to expose all capabilities to all end users, as long as it\u0027s possible for an end user to request the functionality to be made available.  I don\u0027t know how restrictive the controls can be around granting access, though for this kind of thing, that\u0027s related to a security problem, I\u0027d imagine it could be pretty strict.\n\nI\u0027ll email Mark and Chris at DefCore and ask them to verify what I just said.","commit_id":"ca7e4f3a319ca8f06a9e5423f2973b8bc97c0b78"},{"author":{"_account_id":5202,"name":"Erno Kuvaja","email":"jokke@usr.fi","username":"jokke"},"change_message_id":"fcee9e01efeaab42cb3f6bbf51ca01a7d9cc5810","unresolved":false,"context_lines":[{"line_number":118,"context_line":"---------"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"Core reviewer(s):"},{"line_number":121,"context_line":"    None"},{"line_number":122,"context_line":""},{"line_number":123,"context_line":"Other reviewer(s):"},{"line_number":124,"context_line":"    None"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a95cdbc_95a2ddfb","line":121,"updated":"2016-10-07 10:53:05.000000000","message":"Feel free to add me here.","commit_id":"ca7e4f3a319ca8f06a9e5423f2973b8bc97c0b78"},{"author":{"_account_id":5202,"name":"Erno Kuvaja","email":"jokke@usr.fi","username":"jokke"},"change_message_id":"fcee9e01efeaab42cb3f6bbf51ca01a7d9cc5810","unresolved":false,"context_lines":[{"line_number":130,"context_line":"- Add new purge functionaility (without --insecure) which will not"},{"line_number":131,"context_line":"  delete image IDs."},{"line_number":132,"context_line":"- Test purge in DevStack."},{"line_number":133,"context_line":""},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"Dependencies"},{"line_number":136,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a95cdbc_f5b16148","line":133,"updated":"2016-10-07 10:53:05.000000000","message":"Documenting the changes and their consequences.","commit_id":"ca7e4f3a319ca8f06a9e5423f2973b8bc97c0b78"}]}