)]}'
{"patrole_tempest_plugin/tests/api/network/test_security_groups_rbac.py":[{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"f34b6a0556906db7d032201fda9095d3cb04db07","unresolved":false,"context_lines":[{"line_number":123,"context_line":"                list_security_groups()"},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"        # Neutron may return an empty list if access is denied."},{"line_number":126,"context_line":"        if not security_groups[\u0027security_groups\u0027]:"},{"line_number":127,"context_line":"            raise rbac_exceptions.RbacMalformedResponse(empty\u003dTrue)"},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"    @rbac_rule_validation.action(service\u003d\"neutron\","}],"source_content_type":"text/x-python","patch_set":3,"id":"5f7c97a3_970e848a","line":126,"updated":"2018-06-18 21:56:18.000000000","message":"This isn\u0027t always going to be true, as a role without permissions may be able to see a few security groups that belong to the user\u0027s tenant.\n\nOne way to make this foolproof is to 1) create a security group using os_admin credentials; 2) list the security group using os_admin credentials; 3) override role and list the security groups using os_primary credentials; 4) compare outputs. E.g.:\n\n    self.os_admin.security_groups_client.create_security_group(...)\n    adm_sec_groups \u003d self.os_admin.security_groups_client.list_security_groups()\n    with self.rbac_utils.override_role():\n        sec_groups \u003d self.security_groups_client.list_security_groups()\n    if sorted(sec_groups, key\u003dlambda x: x[\u0027id\u0027]) !\u003d sorted(adm_sec_groups, key\u003dlambda x: x[\u0027id\u0027])\n        raise rbac malformed exc","commit_id":"9e89142355e1c08eb0b9fe7a0b22857ddd0e3ef7"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"781b3fa50a1290dff787718f5009d0dddb0cd2c7","unresolved":false,"context_lines":[{"line_number":123,"context_line":"                list_security_groups()"},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"        # Neutron may return an empty list if access is denied."},{"line_number":126,"context_line":"        if not security_groups[\u0027security_groups\u0027]:"},{"line_number":127,"context_line":"            raise rbac_exceptions.RbacMalformedResponse(empty\u003dTrue)"},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"    @rbac_rule_validation.action(service\u003d\"neutron\","}],"source_content_type":"text/x-python","patch_set":3,"id":"5f7c97a3_76070a83","line":126,"in_reply_to":"5f7c97a3_7bc85320","updated":"2018-06-20 01:45:46.000000000","message":"Right, this was my observation too and it\u0027s nice to know that I wasn\u0027t going crazy when I observed that myself.\n\nThis is why I\u0027ve been trying to polish up documents like this: \n\n\"* Patrole should validate all policy in code defaults. For testing, Patrole\n  uses the API-to-policy mapping contained in each project\u0027s `policy in code`_\n  documentation where applicable.\"\n\nhttps://review.openstack.org/#/c/574094/5/doc/source/overview.rst\n\nBecause trying to validate existing behavior (which might be bugged, etc.) leads to constant tech debt not only from a validation perspective (Patrole) but also operator perspective (configuring RBAC).\n\nThat being said, I think this is fine for now. I was talking to Rick and he conveyed to me there are gaps with list tests across Glance and Cinder and so on because list typically exposes shared/tenant resources to which a user has access, despite his/her role. An elevated role simply returns more stuff in the list. Not sure if this is the case in Neutron as well. Very difficult to say without canonical policy documentation, of which Neutron has none.","commit_id":"9e89142355e1c08eb0b9fe7a0b22857ddd0e3ef7"},{"author":{"_account_id":22636,"name":"Cliff Parsons","email":"cliffhparsons@aol.com","username":"cliffparsons"},"change_message_id":"c52a42974931167f7e02d61a6c567e2d11893d48","unresolved":false,"context_lines":[{"line_number":123,"context_line":"                list_security_groups()"},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"        # Neutron may return an empty list if access is denied."},{"line_number":126,"context_line":"        if not security_groups[\u0027security_groups\u0027]:"},{"line_number":127,"context_line":"            raise rbac_exceptions.RbacMalformedResponse(empty\u003dTrue)"},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"    @rbac_rule_validation.action(service\u003d\"neutron\","}],"source_content_type":"text/x-python","patch_set":3,"id":"5f7c97a3_7bc85320","line":126,"in_reply_to":"5f7c97a3_970e848a","updated":"2018-06-20 00:48:56.000000000","message":"I\u0027m glad you posted this comment. I went back and checked, and it looks like Neutron isn\u0027t really checking \"get_security_groups\".  I saw no difference when I set the \"get_security_groups\" rule to \"!\" (I still got the same security group list). If I change the test case to \"get_security_group\", then I see the behavior that I was previously expecting: when the action is not allowed, an empty list is always returned from Neutron.  It won\u0027t have any security groups from the user\u0027s tenant even - tested that too.","commit_id":"9e89142355e1c08eb0b9fe7a0b22857ddd0e3ef7"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"f34b6a0556906db7d032201fda9095d3cb04db07","unresolved":false,"context_lines":[{"line_number":163,"context_line":""},{"line_number":164,"context_line":"        with self.rbac_utils.override_role(self):"},{"line_number":165,"context_line":"            security_rules \u003d self.security_group_rules_client.\\"},{"line_number":166,"context_line":"                list_security_group_rules()"},{"line_number":167,"context_line":""},{"line_number":168,"context_line":"        # Neutron may return an empty list if access is denied."},{"line_number":169,"context_line":"        if not security_rules[\u0027security_group_rules\u0027]:"}],"source_content_type":"text/x-python","patch_set":3,"id":"5f7c97a3_d7063c86","line":166,"range":{"start_line":166,"start_character":16,"end_line":166,"end_character":41},"updated":"2018-06-18 21:56:18.000000000","message":"If we do this (perhaps):\n\n    sec_group \u003d (\n            self.os_admin.security_groups_client.create_security_group(name\u003dname))[\u0027security_group\u0027]\n   self.addCleanup(...)\n\n   with self.rbac_utils.override_role(self):\n       security_rules \u003d self.security_group_rules_client.\\\n           list_security_group_rules(security_group_id\u003dsec_group[\u0027id\u0027])\n\nThen this should guarantee that the list is empty, though I haven\u0027t tried.","commit_id":"9e89142355e1c08eb0b9fe7a0b22857ddd0e3ef7"},{"author":{"_account_id":22636,"name":"Cliff Parsons","email":"cliffhparsons@aol.com","username":"cliffparsons"},"change_message_id":"c52a42974931167f7e02d61a6c567e2d11893d48","unresolved":false,"context_lines":[{"line_number":163,"context_line":""},{"line_number":164,"context_line":"        with self.rbac_utils.override_role(self):"},{"line_number":165,"context_line":"            security_rules \u003d self.security_group_rules_client.\\"},{"line_number":166,"context_line":"                list_security_group_rules()"},{"line_number":167,"context_line":""},{"line_number":168,"context_line":"        # Neutron may return an empty list if access is denied."},{"line_number":169,"context_line":"        if not security_rules[\u0027security_group_rules\u0027]:"}],"source_content_type":"text/x-python","patch_set":3,"id":"5f7c97a3_5beeb78b","line":166,"range":{"start_line":166,"start_character":16,"end_line":166,"end_character":41},"in_reply_to":"5f7c97a3_d7063c86","updated":"2018-06-20 00:48:56.000000000","message":"Same thing with this test case, too. Neutron isn\u0027t checking \"get_security_group_rules\" it\u0027s checking \"get_security_group_rule\". And when the action is disallowed, it returns only an empty list.","commit_id":"9e89142355e1c08eb0b9fe7a0b22857ddd0e3ef7"}],"patrole_tempest_plugin/tests/api/network/test_subnets_rbac.py":[{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"f34b6a0556906db7d032201fda9095d3cb04db07","unresolved":false,"context_lines":[{"line_number":67,"context_line":""},{"line_number":68,"context_line":"        RBAC test for the neutron \"get_subnet\" policy"},{"line_number":69,"context_line":"        \"\"\""},{"line_number":70,"context_line":"        with self.rbac_utils.override_role(self):"},{"line_number":71,"context_line":"            subnets \u003d self.subnets_client.list_subnets()"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"        # Neutron may return an empty list if access is denied."}],"source_content_type":"text/x-python","patch_set":3,"id":"5f7c97a3_f71ed8b9","line":70,"updated":"2018-06-18 21:56:18.000000000","message":"See previous comments","commit_id":"9e89142355e1c08eb0b9fe7a0b22857ddd0e3ef7"},{"author":{"_account_id":22636,"name":"Cliff Parsons","email":"cliffhparsons@aol.com","username":"cliffparsons"},"change_message_id":"c52a42974931167f7e02d61a6c567e2d11893d48","unresolved":false,"context_lines":[{"line_number":67,"context_line":""},{"line_number":68,"context_line":"        RBAC test for the neutron \"get_subnet\" policy"},{"line_number":69,"context_line":"        \"\"\""},{"line_number":70,"context_line":"        with self.rbac_utils.override_role(self):"},{"line_number":71,"context_line":"            subnets \u003d self.subnets_client.list_subnets()"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"        # Neutron may return an empty list if access is denied."}],"source_content_type":"text/x-python","patch_set":3,"id":"5f7c97a3_bbf6eb5c","line":70,"in_reply_to":"5f7c97a3_f71ed8b9","updated":"2018-06-20 00:48:56.000000000","message":"This API also returns only an empty ist when get_subnet is disallowed. Tested that even the subnets belonging to the same tenant are not returned.","commit_id":"9e89142355e1c08eb0b9fe7a0b22857ddd0e3ef7"}]}