openstack/manila
Code Issues Proposed changes

Implement secure RBAC for share instance export location

Browse Source 
This commit updates the policies for share instance export locations to
understand scope checking and account for a read-only role. This is part of a
broader series of changes across OpenStack to provide a consistent RBAC
experience and improve security.

Change-Id: I0cf9beed3c60fd790045580afa0c993c21e71d49
This commit is contained in:
Lance Bragstad 2020-11-19 18:30:17 +00:00 committed by Tom Barron
parent 16232ce01a
commit b1dacdabf8
1 changed files with 29 additions and 4 deletions

33
manila/policies/share_instance_export_location.py

@ -13,6 +13,7 @@
# License for the specific language governing permissions and limitations
# under the License.
from oslo_log import versionutils
from oslo_policy import policy
from manila.policies import base
@ -20,11 +21,26 @@ from manila.policies import base
BASE_POLICY_NAME = 'share_instance_export_location:%s'
DEPRECATED_REASON = """
The share instance export location API now supports system scope and default
roles.
"""
deprecated_instance_export_location_index = policy.DeprecatedRule(
name=BASE_POLICY_NAME % 'index',
check_str=base.RULE_ADMIN_API
)
deprecated_instance_export_location_show = policy.DeprecatedRule(
name=BASE_POLICY_NAME % 'show',
check_str=base.RULE_ADMIN_API
)
share_export_location_policies = [
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'index',
check_str=base.RULE_ADMIN_API,
check_str=base.SYSTEM_READER,
scope_types=['system'],
description='Return data about the requested export location.',
operations=[
{
@ -32,10 +48,15 @@ share_export_location_policies = [
'path': ('/share_instances/{share_instance_id}/'
'export_locations'),
}
]),
],
deprecated_rule=deprecated_instance_export_location_index,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'show',
check_str=base.RULE_ADMIN_API,
check_str=base.SYSTEM_READER,
scope_types=['system'],
description='Return data about the requested export location.',
operations=[
{
@ -43,7 +64,11 @@ share_export_location_policies = [
'path': ('/share_instances/{share_instance_id}/'
'export_locations/{export_location_id}'),
}
]),
],
deprecated_rule=deprecated_instance_export_location_show,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
]