flavor-rxtx policy not restrictive enough

Bug #1665739 reported by Samantha Blanco
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Compute (nova)
Triaged
Low
Unassigned

Bug Description

flavor-rxtx relies on flavor-manage, which is much more restrictive (flavor-rxtx is admin_or_owner whereas flavor-manage is admin_api). flavor-rxtx should be changed to admin_api

Changed in nova:
assignee: nobody → Samantha Blanco (sblanco1)
Revision history for this message
Matt Riedemann (mriedem) wrote :

I would compare to flavor extra specs policy:

https://github.com/openstack/nova/blob/15.0.0.0rc2/nova/policies/flavor_extra_specs.py

Where essentially only admins can perform create/update/delete operations on it but admin or owner can list/show flavor extra specs.

Changed in nova:
status: New → Triaged
importance: Undecided → Low
Revision history for this message
Samantha Blanco (sblanco1) wrote :

So then instead, in order to fix this bug, would the idea be to create policies associated with different operations (similar to what flavor extra specs has)?

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to nova (master)

Fix proposed to branch: master
Review: https://review.openstack.org/444036

Changed in nova:
status: Triaged → In Progress
Revision history for this message
John Garbutt (johngarbutt) wrote :

This extends an existing API that already has granular control though? I am not understanding why all these extra policy rules would be useful here.

Changed in nova:
assignee: Samantha Blanco (sblanco1) → Stephen Finucane (stephenfinucane)
Changed in nova:
assignee: Stephen Finucane (stephenfinucane) → Samantha Blanco (sblanco1)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Change abandoned on nova (master)

Change abandoned by Stephen Finucane (<email address hidden>) on branch: master
Review: https://review.openstack.org/444036

Changed in nova:
status: In Progress → Triaged
assignee: Samantha Blanco (sblanco1) → nobody
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.