openstack/neutron
Code Issues Proposed changes

[SGL] Use admin context to retrieve log objs

Browse Source 
Previously we tried to search which log objects existed based on the
context of the user who is creating a change on a security group rule.
This is not correct as only admin can fetch log objects.

Closes-Bug: #2107446
Change-Id: Ia65e06c83ced9cde7618d4d7f3c7b0b3ae48c3fa
Signed-off-by: Elvira Garcia <egarciar@redhat.com>
This commit is contained in:
Elvira Garcia
2025-07-29 17:42:36 +02:00
parent 758dbfa135
commit 6e70cd450c
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
neutron/services/logapi/common/sg_callback.py
View File

@@ -13,6 +13,7 @@
# License for the specific language governing permissions and limitations # License for the specific language governing permissions and limitations
# under the License. # under the License.
from neutron_lib import context as n_context
from neutron_lib.services.logapi import constants as log_const from neutron_lib.services.logapi import constants as log_const
from neutron.services.logapi.common import db_api from neutron.services.logapi.common import db_api
@@ -23,14 +24,16 @@ class SecurityGroupRuleCallBack(manager.ResourceCallBackBase):
def handle_event(self, resource, event, trigger, payload): def handle_event(self, resource, event, trigger, payload):
context = payload.context context = payload.context
admin_context = n_context.get_admin_context()
sg_rule = payload.latest_state sg_rule = payload.latest_state
if sg_rule: if sg_rule:
sg_id = sg_rule.get('security_group_id') sg_id = sg_rule.get('security_group_id')
else: else:
sg_id = payload.resource_id sg_id = payload.resource_id
# Log resources can only be fetched from admin context.
log_resources = db_api.get_logs_bound_sg( log_resources = db_api.get_logs_bound_sg(
context, sg_id=sg_id, project_id=context.project_id) admin_context, sg_id=sg_id, project_id=context.project_id)
if log_resources: if log_resources:
self.resource_push_api( self.resource_push_api(
log_const.RESOURCE_UPDATE, context, log_resources) log_const.RESOURCE_UPDATE, context, log_resources)