oslo.policy

checker CLI does not enumerate all rules for glance

Bug #1797739 reported by Adam Young
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
oslo.policy
In Progress
Undecided
Stephen Finucane

Bug Description

Something about the glance.json policy file stops the CLI checker from enumerating all the rules;

sample input:

oslopolicy-checker --policy /opt/stack/glance/etc/policy.json --access /opt/stack/python-keystoneclient/examples/pki/cms/auth_v3_token_scoped.json

Return no output. However (with a doctored access file to add the Member or admin role) individual rules will pass

$ oslopolicy-checker --policy etc/glance/policy.json --access /opt/stack/python-keystoneclient/examples/pki/cms/auth_v3_token_scoped.json --rule modify_task
failed: modify_task

$ oslopolicy-checker --policy etc/glance/policy.json --access /opt/stack/python-keystoneclient/examples/pki/cms/auth_v3_token_scoped.json --rule reactivate
passed: reactivate

Adam Young (ayoung)
Changed in oslo.policy:
assignee: nobody → Adam Young (ayoung)
Revision history for this message
Adam Young (ayoung) wrote :

Turns out the checker looks for a : in the rules, as most of the other services are formatted like identity:create_user, but glance has no namespace.

OpenStack Infra (hudson-openstack)
Changed in oslo.policy:
status: New → In Progress
Revision history for this message
Adam Young (ayoung) wrote :

Going to add a flag to make it possible to override the : check. I don't want to remove that check completely, as that would break people's score cards by evaluating things like is_admin and other common checks that the : check was skipping.

OpenStack Infra (hudson-openstack)
Changed in oslo.policy:
assignee: Adam Young (ayoung) → Stephen Finucane (stephenfinucane)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Change abandoned on oslo.policy (master)

Change abandoned by ayoung (<email address hidden>) on branch: master
Review: https://review.opendev.org/610402

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.