openstack/manila
Code Issues Proposed changes

Implement secure RBAC for share snapshot instance export locations

Browse Source 
This commit updates the policies for share snapshot instance export locations
to understand scope checking and account for a read-only role. This is part of
a broader series of changes across OpenStack to provide a consistent RBAC
experience and improve security.

Change-Id: I493f4e3bdca141b08ed8a6fbeb8b9d461e3d8118
This commit is contained in:
Lance Bragstad 2020-11-19 20:23:17 +00:00 committed by Tom Barron
parent 16232ce01a
commit 0bb780e8b1
1 changed files with 29 additions and 4 deletions

33
manila/policies/share_snapshot_instance_export_location.py

@ -10,6 +10,7 @@
# License for the specific language governing permissions and limitations
# under the License.
from oslo_log import versionutils
from oslo_policy import policy
from manila.policies import base
@ -17,11 +18,26 @@ from manila.policies import base
BASE_POLICY_NAME = 'share_snapshot_instance_export_location:%s'
DEPRECATED_REASON = """
The share snapshot instance export location API now supports system scope and
default roles.
"""
deprecated_snapshot_instance_index = policy.DeprecatedRule(
name=BASE_POLICY_NAME % 'index',
check_str=base.RULE_ADMIN_API
)
deprecated_snapshot_instance_show = policy.DeprecatedRule(
name=BASE_POLICY_NAME % 'show',
check_str=base.RULE_ADMIN_API
)
share_snapshot_instance_export_location_policies = [
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'index',
check_str=base.RULE_ADMIN_API,
check_str=base.SYSTEM_READER,
scope_types=['system'],
description="List export locations of a share snapshot instance.",
operations=[
{
@ -29,10 +45,15 @@ share_snapshot_instance_export_location_policies = [
'path': ('/snapshot-instances/{snapshot_instance_id}/'
'export-locations'),
}
]),
],
deprecated_rule=deprecated_snapshot_instance_index,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'show',
check_str=base.RULE_ADMIN_API,
check_str=base.SYSTEM_READER,
scope_types=['system'],
description="Show details of a specified export location of a share "
"snapshot instance.",
operations=[
@ -41,7 +62,11 @@ share_snapshot_instance_export_location_policies = [
'path': ('/snapshot-instances/{snapshot_instance_id}/'
'export-locations/{export_location_id}'),
}
]),
],
deprecated_rule=deprecated_snapshot_instance_show,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
]