OpenStack Compute (nova)

'default' security group can be deleted

Bug #1131830 reported by Brent Eagles
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Compute (nova)
Fix Released
Undecided
Brent Eagles
OpenStack Compute (nova) 2013.1 "grizzly"
tempest
Fix Released
High
Unassigned
tempest havana-1

Bug Description

It is possible to delete the default security group. The problem is somewhat hidden by the fact that the group is automatically recreated at various points.

To reproduce:

mysql -e 'select deleted_at, id, deleted, name, user_id from nova.security_groups'
nova secgroup-delete default
mysql -e 'select deleted_at, id, deleted, name, user_id from nova.security_groups'
nova secgroup-list
mysql -e 'select deleted_at, id, deleted, name, user_id from nova.security_groups'

Brent Eagles (beagles)
Changed in nova:
assignee: nobody → Brent Eagles (beagles)
OpenStack Infra (hudson-openstack)
Changed in nova:
status: New → In Progress
Revision history for this message
Sean Dague (sdague) wrote :

Should have a tempest test to test this

Changed in tempest:
status: New → Confirmed
importance: Undecided → High
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to nova (master)

Reviewed: https://review.openstack.org/22713
Committed: http://github.com/openstack/nova/commit/b01923cb8d117476dc643e6c93e3ab1805b06f2d
Submitter: Jenkins
Branch: master

commit b01923cb8d117476dc643e6c93e3ab1805b06f2d
Author: Brent Eagles <email address hidden>
Date: Fri Feb 22 13:26:45 2013 -0330

    Prevent default security group deletion.

    This patch adds a check to confirm that a security group name
    is not among a list of 'special' group names before proceeding
    with security group deletion.

    Fixes: bug 1131830

    Change-Id: I5656e01b4ed3fd9c22abe6a731edaef7203d97c4

Changed in nova:
status: In Progress → Fix Committed
Thierry Carrez (ttx)
Changed in nova:
milestone: none → grizzly-rc1
status: Fix Committed → Fix Released
Revision history for this message
Christopher Yeoh (cyeoh-0) wrote :

Tempest test was added in commit f81a9d6cc03e96dc16d2e44afc07e1ba84216bfa

commit f81a9d6cc03e96dc16d2e44afc07e1ba84216bfa
Author: Rami Vaknin <email address hidden>
Date: Sun Mar 3 22:54:22 2013 +0200

    Adding test_delete_the_default_security_group negative test

    In addition fixing few pep8 wrong identations.

    Change-Id: Id645f3a8006639ba1e58b14856ac6720fc9b474d

Changed in tempest:
status: Confirmed → Fix Committed
Thierry Carrez (ttx)
Changed in nova:
milestone: grizzly-rc1 → 2013.1
Sean Dague (sdague)
Changed in tempest:
milestone: none → havana-1
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.