)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":20146,"name":"yuyafei","email":"yu.yafei@foxmail.com","username":"yuyafei"},"change_message_id":"3f1040a7239d282d511fbc76e295e741e2fc1598","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     He Jie Xu \u003chejie.xu@intel.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2016-05-25 11:17:03 +0800"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Remove all the policy check points from ComputeAPI and SecurityGroupAPI"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"As legacy v2 API removed and v2.1 API check policy at API layer, those"},{"line_number":10,"context_line":"policy checks under API layer are useless. This patch cleanup them."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"bab6814e_ba172753","line":7,"range":{"start_line":7,"start_character":0,"end_line":7,"end_character":71},"updated":"2016-05-25 04:56:24.000000000","message":"The first line should be limited to 50 characters","commit_id":"9176f26674a28b9b6889a000c7a05ca801c918ae"}],"nova/compute/api.py":[{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"eccb9a093f8e0ff5353a906444947e574533837a","unresolved":false,"context_lines":[{"line_number":177,"context_line":""},{"line_number":178,"context_line":"def check_policy(context, action, target, scope\u003d\u0027compute\u0027):"},{"line_number":179,"context_line":"    _action \u003d \u0027%s:%s\u0027 % (scope, action)"},{"line_number":180,"context_line":"    nova.policy.enforce(context, _action, target)"},{"line_number":181,"context_line":""},{"line_number":182,"context_line":""},{"line_number":183,"context_line":"def check_instance_cell(fn):"}],"source_content_type":"text/x-python","patch_set":1,"id":"bab6814e_9ae7b83f","side":"PARENT","line":180,"range":{"start_line":180,"start_character":42,"end_line":180,"end_character":48},"updated":"2016-05-25 09:28:34.000000000","message":"so I think this is more important than you would hope, because of the target.\n\nWe are currently missing the target in most of the policy checks in the API :(\nhttps://github.com/openstack/nova/blob/master/nova/api/openstack/compute/servers.py#L1098\n\nThe only real protection we are getting on the instance.tenant is in the DB layer, where it seems largely still hard coded :(\nhttps://github.com/openstack/nova/blob/master/nova/db/sqlalchemy/api.py#L313\n\nI think we should start passing the instance (or other such object) as the target in all the API policy checks, before we remove the policy checks down here.\n\nNow I totally want to see these policy checks die, but we need to ensure we have a good replacement for them first.","commit_id":"6713c728feb9c01a8affacc87afa3d3e1b788412"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"0d29b5d233d67678b692ff944504f53d4e59fcb7","unresolved":false,"context_lines":[{"line_number":170,"context_line":"        return wrapped"},{"line_number":171,"context_line":"    return outer"},{"line_number":172,"context_line":""},{"line_number":173,"context_line":"wrap_check_policy \u003d policy_decorator(scope\u003d\u0027compute\u0027)"},{"line_number":174,"context_line":"wrap_check_security_groups_policy \u003d policy_decorator("},{"line_number":175,"context_line":"                                    scope\u003d\u0027compute:security_groups\u0027)"},{"line_number":176,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"7aa08908_98de933d","side":"PARENT","line":173,"range":{"start_line":173,"start_character":44,"end_line":173,"end_character":51},"updated":"2016-06-07 11:37:40.000000000","message":"do we need to remove \n\"compute:get\": \"rule:admin_or_owner\",\n \nthis kind of definition in policy file?","commit_id":"545d8d8666389f33601b0b003dec844004694919"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"ac7e1d8707936602354a8498c7ad70da37d9e07d","unresolved":false,"context_lines":[{"line_number":170,"context_line":"        return wrapped"},{"line_number":171,"context_line":"    return outer"},{"line_number":172,"context_line":""},{"line_number":173,"context_line":"wrap_check_policy \u003d policy_decorator(scope\u003d\u0027compute\u0027)"},{"line_number":174,"context_line":"wrap_check_security_groups_policy \u003d policy_decorator("},{"line_number":175,"context_line":"                                    scope\u003d\u0027compute:security_groups\u0027)"},{"line_number":176,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"7aa08908_bfb1ae91","side":"PARENT","line":173,"range":{"start_line":173,"start_character":44,"end_line":173,"end_character":51},"in_reply_to":"7aa08908_98de933d","updated":"2016-06-07 13:32:41.000000000","message":"Yes, these rules should be cleaned out from the policy sample file and fake policy file.\n\nThe effort to register policy options in code and generate those files will take care of that as well.","commit_id":"545d8d8666389f33601b0b003dec844004694919"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"8c87322d908075dc24ef210bee734b564a25842e","unresolved":false,"context_lines":[{"line_number":170,"context_line":"        return wrapped"},{"line_number":171,"context_line":"    return outer"},{"line_number":172,"context_line":""},{"line_number":173,"context_line":"wrap_check_policy \u003d policy_decorator(scope\u003d\u0027compute\u0027)"},{"line_number":174,"context_line":"wrap_check_security_groups_policy \u003d policy_decorator("},{"line_number":175,"context_line":"                                    scope\u003d\u0027compute:security_groups\u0027)"},{"line_number":176,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"7aa08908_22e121d1","side":"PARENT","line":173,"range":{"start_line":173,"start_character":44,"end_line":173,"end_character":51},"in_reply_to":"7aa08908_bfb1ae91","updated":"2016-06-07 13:36:22.000000000","message":"yea, those will be removed in later patch","commit_id":"545d8d8666389f33601b0b003dec844004694919"}]}