)]}'
{"zun/api/controllers/v1/containers.py":[{"author":{"_account_id":11536,"name":"hongbin","email":"hongbin034@gmail.com","username":"hongbin"},"change_message_id":"7ccfb4366cd5aab72369756a3367c34d60771301","unresolved":false,"context_lines":[{"line_number":363,"context_line":""},{"line_number":364,"context_line":"        privileged \u003d container_dict.pop(\u0027privileged\u0027, None)"},{"line_number":365,"context_line":"        if privileged is not None:"},{"line_number":366,"context_line":"            api_utils.version_check(\u0027privileged\u0027, \u00271.21\u0027)"},{"line_number":367,"context_line":"            try:"},{"line_number":368,"context_line":"                container_dict[\u0027privileged\u0027] \u003d strutils.bool_from_string("},{"line_number":369,"context_line":"                    privileged, strict\u003dTrue)"}],"source_content_type":"text/x-python","patch_set":10,"id":"5f7c97a3_e741b363","line":366,"updated":"2018-08-01 03:08:34.000000000","message":"Since this parameter has security implication, we would like to introduce a policy for cloud provider to disallow this parameter. This can be achieve by introducing a policy rule for \u0027create:privileged\u0027 in https://github.com/openstack/zun/blob/master/zun/common/policies/container.py . The default rule should disallow this parameter (cloud providers who want to use this parameter needs to explicitly modify the policy. This is for aligning with the principle of \"security by default\").\n\nIn here, we need a check (like line #344) to enforce the privileged rule.","commit_id":"d664ea7b65cc6f93cea4d10e627c23238827dda7"}],"zun/common/policies/container.py":[{"author":{"_account_id":11536,"name":"hongbin","email":"hongbin034@gmail.com","username":"hongbin"},"change_message_id":"fdaf273da03193ebc4bee694269c97e9d33ae22f","unresolved":false,"context_lines":[{"line_number":41,"context_line":"    ),"},{"line_number":42,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":43,"context_line":"        name\u003dCONTAINER % \u0027create:privileged\u0027,"},{"line_number":44,"context_line":"        check_str\u003dbase.RULE_ADMIN_API,"},{"line_number":45,"context_line":"        description\u003d\u0027Create a new container with privileged.\u0027,"},{"line_number":46,"context_line":"        operations\u003d["},{"line_number":47,"context_line":"            {"}],"source_content_type":"text/x-python","patch_set":11,"id":"3f79a3b5_2f73d2e9","line":44,"range":{"start_line":44,"start_character":23,"end_line":44,"end_character":37},"updated":"2018-08-04 20:25:08.000000000","message":"Due to the big security implication of privileged container, we really want to have it disabled by default (cloud admins who want to use this feature needs to explicitly enables this feature). To do that, we need a stronger rule in here.\n\nConsider using the rule \"deny_everybody\" in here. Here is an example: https://github.com/openstack/heat/blob/master/heat/policies/base.py#L36 . Here is the documentation [1] of this rule:\n\n  the policy check “!” will always reject an access.\n\n[1] https://docs.openstack.org/oslo.policy/latest/reference/api/oslo_policy.policy.html","commit_id":"d02b15b4555d1e03180dfa86c29dbdcdc8a74944"},{"author":{"_account_id":11536,"name":"hongbin","email":"hongbin034@gmail.com","username":"hongbin"},"change_message_id":"fdaf273da03193ebc4bee694269c97e9d33ae22f","unresolved":false,"context_lines":[{"line_number":42,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":43,"context_line":"        name\u003dCONTAINER % \u0027create:privileged\u0027,"},{"line_number":44,"context_line":"        check_str\u003dbase.RULE_ADMIN_API,"},{"line_number":45,"context_line":"        description\u003d\u0027Create a new container with privileged.\u0027,"},{"line_number":46,"context_line":"        operations\u003d["},{"line_number":47,"context_line":"            {"},{"line_number":48,"context_line":"                \u0027path\u0027: \u0027/v1/containers\u0027,"}],"source_content_type":"text/x-python","patch_set":11,"id":"3f79a3b5_af504234","line":45,"range":{"start_line":45,"start_character":28,"end_line":45,"end_character":59},"updated":"2018-08-04 20:25:08.000000000","message":"First, a nit. Consider rephrasing to \u0027Create a new privileged container.\u0027\n\nSecond, I would suggest to give a warning here. For example: \"Warning: allow privileged container incurs a big security risk so be caution if you want to enable this feature\"","commit_id":"d02b15b4555d1e03180dfa86c29dbdcdc8a74944"}],"zun/tests/unit/db/utils.py":[{"author":{"_account_id":11536,"name":"hongbin","email":"hongbin034@gmail.com","username":"hongbin"},"change_message_id":"fdaf273da03193ebc4bee694269c97e9d33ae22f","unresolved":false,"context_lines":[{"line_number":102,"context_line":"        \u0027auto_heal\u0027: kwargs.get(\u0027auto_heal\u0027, False),"},{"line_number":103,"context_line":"        \u0027capsule_id\u0027: kwargs.get(\u0027capsule_id\u0027, 42),"},{"line_number":104,"context_line":"        \u0027started_at\u0027: kwargs.get(\u0027started_at\u0027),"},{"line_number":105,"context_line":"        \u0027privileged\u0027: kwargs.get(\u0027privileged\u0027, True),"},{"line_number":106,"context_line":"    }"},{"line_number":107,"context_line":""},{"line_number":108,"context_line":""}],"source_content_type":"text/x-python","patch_set":11,"id":"3f79a3b5_8fbd466a","line":105,"range":{"start_line":105,"start_character":47,"end_line":105,"end_character":51},"updated":"2018-08-04 20:25:08.000000000","message":"Nit: we really want to make it default to False even if it is in test.","commit_id":"d02b15b4555d1e03180dfa86c29dbdcdc8a74944"}]}