)]}'
{"specs/other/rbac-testing-multiple-policies.rst":[{"author":{"_account_id":23185,"name":"Samantha Blanco","email":"samantha.blanco@att.com","username":"sblanco"},"change_message_id":"154ed5a433118279034df34b32d43c8cd3d252fb","unresolved":false,"context_lines":[{"line_number":137,"context_line":""},{"line_number":138,"context_line":"Primary assignee:"},{"line_number":139,"context_line":"  Felipe Monteiro (felipemonteiro)"},{"line_number":140,"context_line":"  Samantha Blanco (sblanco1)"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"Other contributors:"},{"line_number":143,"context_line":"  Rick Bartra (rb560u)"}],"source_content_type":"text/x-rst","patch_set":4,"id":"5ff73747_d36fcf28","line":140,"range":{"start_line":140,"start_character":19,"end_line":140,"end_character":27},"updated":"2017-04-28 20:27:34.000000000","message":"I think this is supposed to be Launchpad ID (sblanco) or IRC nick (blancos)","commit_id":"0783a0b33c77b2ff45121f8b783f1c2344694e5d"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"e8ef2c5cea7f6dec62bff4618b3c7878cfc01ef1","unresolved":false,"context_lines":[{"line_number":137,"context_line":""},{"line_number":138,"context_line":"Primary assignee:"},{"line_number":139,"context_line":"  Felipe Monteiro (felipemonteiro)"},{"line_number":140,"context_line":"  Samantha Blanco (sblanco1)"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"Other contributors:"},{"line_number":143,"context_line":"  Rick Bartra (rb560u)"}],"source_content_type":"text/x-rst","patch_set":4,"id":"ff0f0b1f_adda4714","line":140,"range":{"start_line":140,"start_character":19,"end_line":140,"end_character":27},"in_reply_to":"5ff73747_d36fcf28","updated":"2017-05-18 16:29:21.000000000","message":"Done","commit_id":"0783a0b33c77b2ff45121f8b783f1c2344694e5d"}],"specs/patrole/rbac-testing-multiple-policies.rst":[{"author":{"_account_id":1921,"name":"Andrea Frittoli","email":"andrea.frittoli@gmail.com","username":"andrea-frittoli"},"change_message_id":"acb33abe64a9686d0848ede168e71c5ae504ea6b","unresolved":false,"context_lines":[{"line_number":69,"context_line":"    @rbac_rule_validation.action("},{"line_number":70,"context_line":"        service\u003d\"nova\","},{"line_number":71,"context_line":"        rules\u003d[\"os_compute_api:os-lock-server:unlock\","},{"line_number":72,"context_line":"               \"os_compute_api:os-lock-server:unlock:unlock_override\"])"},{"line_number":73,"context_line":"    def test_unlock_server_override(self):"},{"line_number":74,"context_line":"        server \u003d self.create_test_server(wait_until\u003d\u0027ACTIVE\u0027)"},{"line_number":75,"context_line":"        self.os_admin.servers_client.lock_server(server[\u0027id\u0027])"}],"source_content_type":"text/x-rst","patch_set":11,"id":"7f287b81_c3e2ea01","line":72,"updated":"2017-09-03 17:26:45.000000000","message":"The extra rule here is the only difference right? The test otherwise stays the same.","commit_id":"345fa8fcd9632ca13eb5391616e38a4426a95322"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"6b9809bf019563d3583090bc708f18f7649061b3","unresolved":false,"context_lines":[{"line_number":68,"context_line":""},{"line_number":69,"context_line":"    @rbac_rule_validation.action("},{"line_number":70,"context_line":"        service\u003d\"nova\","},{"line_number":71,"context_line":"        rules\u003d[\"os_compute_api:os-lock-server:unlock\","},{"line_number":72,"context_line":"               \"os_compute_api:os-lock-server:unlock:unlock_override\"])"},{"line_number":73,"context_line":"    def test_unlock_server_override(self):"},{"line_number":74,"context_line":"        server \u003d self.create_test_server(wait_until\u003d\u0027ACTIVE\u0027)"},{"line_number":75,"context_line":"        self.os_admin.servers_client.lock_server(server[\u0027id\u0027])"}],"source_content_type":"text/x-rst","patch_set":11,"id":"5f2577a7_9822f4a3","line":72,"range":{"start_line":71,"start_character":0,"end_line":72,"end_character":71},"updated":"2017-09-12 22:20:39.000000000","message":"yea you selected the nasty policy :)","commit_id":"345fa8fcd9632ca13eb5391616e38a4426a95322"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"83219f704c3668019b4fe7ad516cb3562a7c4d4f","unresolved":false,"context_lines":[{"line_number":69,"context_line":"    @rbac_rule_validation.action("},{"line_number":70,"context_line":"        service\u003d\"nova\","},{"line_number":71,"context_line":"        rules\u003d[\"os_compute_api:os-lock-server:unlock\","},{"line_number":72,"context_line":"               \"os_compute_api:os-lock-server:unlock:unlock_override\"])"},{"line_number":73,"context_line":"    def test_unlock_server_override(self):"},{"line_number":74,"context_line":"        server \u003d self.create_test_server(wait_until\u003d\u0027ACTIVE\u0027)"},{"line_number":75,"context_line":"        self.os_admin.servers_client.lock_server(server[\u0027id\u0027])"}],"source_content_type":"text/x-rst","patch_set":11,"id":"5f2577a7_bc56a45b","line":72,"in_reply_to":"5f2577a7_3cd4f41f","updated":"2017-09-13 19:46:13.000000000","message":"nice point. Also i can be some behavior change along with adding/removing the response attribute.\n\nSo those things has to be handled by case to case. I doubt we will have lot of soft policy things.","commit_id":"345fa8fcd9632ca13eb5391616e38a4426a95322"},{"author":{"_account_id":25100,"name":"Sean Pryor","email":"spryor@redhat.com","username":"Xaenalt"},"change_message_id":"5be0997a10b9bf23a2409b9a254fc8c0601e5e39","unresolved":false,"context_lines":[{"line_number":69,"context_line":"    @rbac_rule_validation.action("},{"line_number":70,"context_line":"        service\u003d\"nova\","},{"line_number":71,"context_line":"        rules\u003d[\"os_compute_api:os-lock-server:unlock\","},{"line_number":72,"context_line":"               \"os_compute_api:os-lock-server:unlock:unlock_override\"])"},{"line_number":73,"context_line":"    def test_unlock_server_override(self):"},{"line_number":74,"context_line":"        server \u003d self.create_test_server(wait_until\u003d\u0027ACTIVE\u0027)"},{"line_number":75,"context_line":"        self.os_admin.servers_client.lock_server(server[\u0027id\u0027])"}],"source_content_type":"text/x-rst","patch_set":11,"id":"5f2577a7_49eb64db","line":72,"in_reply_to":"5f2577a7_4616b3f3","updated":"2017-09-14 17:24:41.000000000","message":"That sounds like a perfect way to handle the soft dependencies. We could catch that exception and give a relevant message in the per-test log like \"Partial Success\" or something to tell the user it worked, but won\u0027t have the data they want\n\nFor depends_on, yeah, I\u0027m super in favor of the cleaner way to show the preconditions needed for a call to succeed. With the exception of cross-project dependencies, that should result in pretty much full coverage in terms of policy\n\nIt would be cool if at some point with the new policy in code stuff oslo was able to give us some information like that automatically, but for a concrete implementation, it\u0027s looking good so far.\n\nI guess the only other question I have is for cross-project rules, would the current implementation we have be able to just be fed a rule and not have to worry about which project it comes from? If so, it seems like the majority of the work in rbac_rule_validation would just be to feed in the dependency lists to _is_authorized (i\u0027d imagine a list parameter for depends_on). Then we just play whack a mole with the dependencies","commit_id":"345fa8fcd9632ca13eb5391616e38a4426a95322"},{"author":{"_account_id":25100,"name":"Sean Pryor","email":"spryor@redhat.com","username":"Xaenalt"},"change_message_id":"2d282a43c67132c2d9d13d3b89da481475019374","unresolved":false,"context_lines":[{"line_number":69,"context_line":"    @rbac_rule_validation.action("},{"line_number":70,"context_line":"        service\u003d\"nova\","},{"line_number":71,"context_line":"        rules\u003d[\"os_compute_api:os-lock-server:unlock\","},{"line_number":72,"context_line":"               \"os_compute_api:os-lock-server:unlock:unlock_override\"])"},{"line_number":73,"context_line":"    def test_unlock_server_override(self):"},{"line_number":74,"context_line":"        server \u003d self.create_test_server(wait_until\u003d\u0027ACTIVE\u0027)"},{"line_number":75,"context_line":"        self.os_admin.servers_client.lock_server(server[\u0027id\u0027])"}],"source_content_type":"text/x-rst","patch_set":11,"id":"5f2577a7_3cd4f41f","line":72,"in_reply_to":"5f2577a7_9822f4a3","updated":"2017-09-13 19:30:37.000000000","message":"So this might be adding another layer of complexity, but for policies that have a \"soft\" dependency, would it be better to split the dependencies into like two additional values, such that there\u0027s like a depends_on parameter, containing a list of rules that are hard dependencies, and will cause the test to fail and a soft_depends_on parameter that notes dependencies that won\u0027t fail the test outright but instead alter the behavior. For an example: the CLI command nova show will hide or show values in the output depending on which permissions a user has","commit_id":"345fa8fcd9632ca13eb5391616e38a4426a95322"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"08192ce8aa15182f7e5adc0464a439d185f1c1ce","unresolved":false,"context_lines":[{"line_number":69,"context_line":"    @rbac_rule_validation.action("},{"line_number":70,"context_line":"        service\u003d\"nova\","},{"line_number":71,"context_line":"        rules\u003d[\"os_compute_api:os-lock-server:unlock\","},{"line_number":72,"context_line":"               \"os_compute_api:os-lock-server:unlock:unlock_override\"])"},{"line_number":73,"context_line":"    def test_unlock_server_override(self):"},{"line_number":74,"context_line":"        server \u003d self.create_test_server(wait_until\u003d\u0027ACTIVE\u0027)"},{"line_number":75,"context_line":"        self.os_admin.servers_client.lock_server(server[\u0027id\u0027])"}],"source_content_type":"text/x-rst","patch_set":11,"id":"5f2577a7_4616b3f3","line":72,"in_reply_to":"5f2577a7_bc56a45b","updated":"2017-09-14 17:05:03.000000000","message":"The \"soft policy\" dependency is what I think of as non-fatal policy enforcement (if you look at Nova\u0027s authorize() call I believe they have a fatal kwarg there). But anyway, that is detected by Patrole looking at the response body for the expected attribute that is added only if this \"soft policy\" enforcement passes; if the expected attribute is not present, we raise an `RbacMalformedException` which, for all intents and purposes, is treated as a failure.\n\nRegarding a depends_on param, I see value in that because it adds additional documentation and understanding to what the test is doing -- as well as its preconditions for behaving correctly. It\u0027ll help with debugging. It might even be meaningful to think about something like `DocumentedRuleDefault` from `oslo.policy` in the longterm. However, I think that that is for the longterm; right now we need a straightforward implementation IMO.","commit_id":"345fa8fcd9632ca13eb5391616e38a4426a95322"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"45924ff9fb4fdd98b333d6b1fcb54551145f0a4b","unresolved":false,"context_lines":[{"line_number":69,"context_line":"    @rbac_rule_validation.action("},{"line_number":70,"context_line":"        service\u003d\"nova\","},{"line_number":71,"context_line":"        rules\u003d[\"os_compute_api:os-lock-server:unlock\","},{"line_number":72,"context_line":"               \"os_compute_api:os-lock-server:unlock:unlock_override\"])"},{"line_number":73,"context_line":"    def test_unlock_server_override(self):"},{"line_number":74,"context_line":"        server \u003d self.create_test_server(wait_until\u003d\u0027ACTIVE\u0027)"},{"line_number":75,"context_line":"        self.os_admin.servers_client.lock_server(server[\u0027id\u0027])"}],"source_content_type":"text/x-rst","patch_set":11,"id":"7f287b81_d40ce243","line":72,"in_reply_to":"7f287b81_c3e2ea01","updated":"2017-09-04 01:57:44.000000000","message":"Yes.","commit_id":"345fa8fcd9632ca13eb5391616e38a4426a95322"},{"author":{"_account_id":1921,"name":"Andrea Frittoli","email":"andrea.frittoli@gmail.com","username":"andrea-frittoli"},"change_message_id":"acb33abe64a9686d0848ede168e71c5ae504ea6b","unresolved":false,"context_lines":[{"line_number":78,"context_line":"        self.rbac_utils.switch_role(self, toggle_rbac_role\u003dTrue)"},{"line_number":79,"context_line":"        self.servers_client.unlock_server(server[\u0027id\u0027])"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"According to the Nova documentation for locking a server, the \"unlock_override\""},{"line_number":82,"context_line":"policy is \"performed only after the check os_compute_api:os-lock-server:unlock"},{"line_number":83,"context_line":"passes\". With this change, Patrole will generate its \"expected\" result based on"},{"line_number":84,"context_line":"whether the test role can perform *all* the policies passed to ``rules``;"},{"line_number":85,"context_line":"otherwise, if the test role cannot perform at least one policy, the expected"},{"line_number":86,"context_line":"result will be ``False``. Afterward, the API action will be called with the test"}],"source_content_type":"text/x-rst","patch_set":11,"id":"7f287b81_43c03a51","line":83,"range":{"start_line":81,"start_character":0,"end_line":83,"end_character":7},"updated":"2017-09-03 17:26:45.000000000","message":"This bit sounds a bit scary to me. We test the same thing as we do before but we tag the test as \"two policies checked\" based on nova docs.\n\nNova could decide that checking the override policy first is better and then our test would not be triggering both policies anymore, and we\u0027d have no way to discover about it.\n\nI think it would be ideal to design tests so that we are sure that all tagged policies are actually triggered.","commit_id":"345fa8fcd9632ca13eb5391616e38a4426a95322"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"45924ff9fb4fdd98b333d6b1fcb54551145f0a4b","unresolved":false,"context_lines":[{"line_number":78,"context_line":"        self.rbac_utils.switch_role(self, toggle_rbac_role\u003dTrue)"},{"line_number":79,"context_line":"        self.servers_client.unlock_server(server[\u0027id\u0027])"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"According to the Nova documentation for locking a server, the \"unlock_override\""},{"line_number":82,"context_line":"policy is \"performed only after the check os_compute_api:os-lock-server:unlock"},{"line_number":83,"context_line":"passes\". With this change, Patrole will generate its \"expected\" result based on"},{"line_number":84,"context_line":"whether the test role can perform *all* the policies passed to ``rules``;"},{"line_number":85,"context_line":"otherwise, if the test role cannot perform at least one policy, the expected"},{"line_number":86,"context_line":"result will be ``False``. Afterward, the API action will be called with the test"}],"source_content_type":"text/x-rst","patch_set":11,"id":"7f287b81_b4ccb661","line":83,"range":{"start_line":81,"start_character":0,"end_line":83,"end_character":7},"in_reply_to":"7f287b81_43c03a51","updated":"2017-09-04 01:57:44.000000000","message":"I agree with everything you wrote.\n\nHowever, without a magical API that we can call, I\u0027m not sure how we are able to verify -- absolutely -- that *any* tagged policies are actually triggered.\n\nThis is a greater problem with Patrole itself: unless oslo.policy provides a function or something that Patrole can call to verify whether the policy was enforced within the scope of an API call, then there\u0027s no way to know for sure.\n\nThus, I\u0027m suggesting the issue you\u0027ve pointed out requires changes to oslo.policy itself -- because, currently, in OpenStack, I don\u0027t know of any way to validate whether policy enforcement actually happened (other than checking logs, reading in code policy documentation, writing tests, etc.).\n\nMany tests -- even in Tempest -- make assumptions about policies and their rules. For example, Tempest requires admin credentials for performing API calls that require elevated admin permissions. But what happens if -- all of a sudden -- a policy is changed from rule:admin_api to rule:admin_or_owner? Of course, that is more of a rhetorical question, because most likely someone would make the change quickly in Tempest.","commit_id":"345fa8fcd9632ca13eb5391616e38a4426a95322"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"6b9809bf019563d3583090bc708f18f7649061b3","unresolved":false,"context_lines":[{"line_number":78,"context_line":"        self.rbac_utils.switch_role(self, toggle_rbac_role\u003dTrue)"},{"line_number":79,"context_line":"        self.servers_client.unlock_server(server[\u0027id\u0027])"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"According to the Nova documentation for locking a server, the \"unlock_override\""},{"line_number":82,"context_line":"policy is \"performed only after the check os_compute_api:os-lock-server:unlock"},{"line_number":83,"context_line":"passes\". With this change, Patrole will generate its \"expected\" result based on"},{"line_number":84,"context_line":"whether the test role can perform *all* the policies passed to ``rules``;"},{"line_number":85,"context_line":"otherwise, if the test role cannot perform at least one policy, the expected"},{"line_number":86,"context_line":"result will be ``False``. Afterward, the API action will be called with the test"}],"source_content_type":"text/x-rst","patch_set":11,"id":"5f2577a7_7614f8a0","line":83,"range":{"start_line":81,"start_character":0,"end_line":83,"end_character":7},"in_reply_to":"7f287b81_b4ccb661","updated":"2017-09-12 22:20:39.000000000","message":"There are 2 points\n1. Can projects change order of policy enforcement?\n2. How to verify policy is being called.\n\nFor first one, project cannot change that. It will be breaking the upgrade cloud. Which is main goal of Patrole to detect such things and fail tests if anyone do the same.\nFor unlock override example, unlock override policy is checked after unlock policy for case when owner want to unlock the instance which is locked by admin or vice versa. \nIf nova change the order then it break the feature.\n\nFor second point, yea there is no way to check policy trigger. Policy trigger is more operator things and kind of hidden from users. If we have any public way to detect the policy trigger by any API, it will violet the rule of hiding the policy things to users.\nI think as long as tests knows and enforce what all policy xyz API checks, test results will make sure the policy trigger. \n\nFor example, if nova remove policy enforcement from lock API then patrole tests checking 403 will fail.","commit_id":"345fa8fcd9632ca13eb5391616e38a4426a95322"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"6b9809bf019563d3583090bc708f18f7649061b3","unresolved":false,"context_lines":[{"line_number":183,"context_line":"Work Items"},{"line_number":184,"context_line":"----------"},{"line_number":185,"context_line":""},{"line_number":186,"context_line":"* Enhance the ``rbac_rule_validation`` decorator with the ``actions`` parameter"},{"line_number":187,"context_line":"  and deprecate the ``rule`` parameter."},{"line_number":188,"context_line":"* Write a helper function in ``rbac_rule_validation`` to iteratively call"},{"line_number":189,"context_line":"  ``rbac_policy_parser.RbacPolicyParser.allowed`` for each policy action"}],"source_content_type":"text/x-rst","patch_set":11,"id":"5f2577a7_f927b911","line":186,"range":{"start_line":186,"start_character":0,"end_line":186,"end_character":79},"updated":"2017-09-12 22:20:39.000000000","message":"can we get the list of APIs having multiple policy ? It will not be more.\n\nActually i am going to discuss the removing of multiple policy things for API extensions case for example. Server GET have their extensions policy check like Extended AZ policy.\nIt would not remove all multiple policy things like unlock policy will stay.","commit_id":"345fa8fcd9632ca13eb5391616e38a4426a95322"},{"author":{"_account_id":1921,"name":"Andrea Frittoli","email":"andrea.frittoli@gmail.com","username":"andrea-frittoli"},"change_message_id":"df800012b4c2d23ee62fb1d98cecd83f7871959e","unresolved":false,"context_lines":[{"line_number":183,"context_line":"Work Items"},{"line_number":184,"context_line":"----------"},{"line_number":185,"context_line":""},{"line_number":186,"context_line":"* Enhance the ``rbac_rule_validation`` decorator with the ``actions`` parameter"},{"line_number":187,"context_line":"  and deprecate the ``rule`` parameter."},{"line_number":188,"context_line":"* Write a helper function in ``rbac_rule_validation`` to iteratively call"},{"line_number":189,"context_line":"  ``rbac_policy_parser.RbacPolicyParser.allowed`` for each policy action"}],"source_content_type":"text/x-rst","patch_set":11,"id":"5f2577a7_558c177e","line":186,"range":{"start_line":186,"start_character":0,"end_line":186,"end_character":79},"in_reply_to":"5f2577a7_f927b911","updated":"2017-09-14 19:39:43.000000000","message":"Yeah it would be nice to have an ether pad to track this.\nYou can add it later to the spec if you want.","commit_id":"345fa8fcd9632ca13eb5391616e38a4426a95322"}]}