Relax policy so owner can access encryption info

The admin only policy is too restrictive to allow Nova to access a
volume's encryption metadata using the owner's request context. Hence,
this commit relaxes the policy for the volume encryption metadata
API extension so the metadata is accessible to the volume's owner.

Implements: blueprint encrypt-cinder-volumes
Change-Id: Ia946850b79f7f717ab7528caf7cac2905e650917
SecurityImpact

diff --git a/cinder/api/contrib/volume_type_encryption.py b/cinder/api/contrib/volume_type_encryption.py
index aede70f9f169256ef9fd04315148019e3c0113dd..6c9684f434d1c0b44697da0b946ed2cd827d398d 100644 (file)
--- a/cinder/api/contrib/volume_type_encryption.py
+++ b/cinder/api/contrib/volume_type_encryption.py
@@ -40,7 +40,7 @@ class VolumeTypeEncryptionTemplate(xmlutil.TemplateBuilder):
 
 
 class VolumeTypeEncryptionController(wsgi.Controller):
-    """The volume type encryption API controller for the OpenStack API """
+    """The volume type encryption API controller for the OpenStack API."""
 
     def _get_volume_type_encryption(self, context, type_id):
         encryption_ref = db.volume_type_encryption_get(context, type_id)

diff --git a/cinder/db/sqlalchemy/api.py b/cinder/db/sqlalchemy/api.py
index 265f7cb19658a2e99a5eb796dfc2843e3766e2d4..307a895fa1beae33b9b570bc270aa789e41acbe5 100644 (file)
--- a/cinder/db/sqlalchemy/api.py
+++ b/cinder/db/sqlalchemy/api.py
@@ -1817,7 +1817,6 @@ def volume_type_encryption_delete(context, volume_type_id):
                            'updated_at': literal_column('updated_at')})
 
 
-# TODO(joel-coffman): split into two functions -- update and create
 @require_admin_context
 def volume_type_encryption_update_or_create(context, volume_type_id,
                                             values):
@@ -1847,7 +1846,7 @@ def volume_type_encryption_volume_get(context, volume_type_id, session=None):
 ####################
 
 
-@require_admin_context
+@require_context
 def volume_encryption_metadata_get(context, volume_id, session=None):
     """Return the encryption key id for a given volume."""
 

diff --git a/cinder/tests/api/contrib/test_volume_encryption_metadata.py b/cinder/tests/api/contrib/test_volume_encryption_metadata.py
index a14a2b3ac39a7f3b3f04f3b0a640b8b21a88ca31..8a2ed0616fda0719a83bae3aa1039fc33fad6dd2 100644 (file)
--- a/cinder/tests/api/contrib/test_volume_encryption_metadata.py
+++ b/cinder/tests/api/contrib/test_volume_encryption_metadata.py
@@ -74,11 +74,11 @@ class VolumeEncryptionMetadataTest(test.TestCase):
         self.stubs.Set(db.sqlalchemy.api, 'volume_type_encryption_get',
                        return_volume_type_encryption_metadata)
 
-        self.ctxt = context.RequestContext('fake', 'fake', is_admin=True)
+        self.ctxt = context.RequestContext('fake', 'fake')
         self.volume_id = self._create_volume(self.ctxt)
 
     def tearDown(self):
-        db.volume_destroy(self.ctxt, self.volume_id)
+        db.volume_destroy(self.ctxt.elevated(), self.volume_id)
         super(VolumeEncryptionMetadataTest, self).tearDown()
 
     def test_index(self):
@@ -189,26 +189,17 @@ class VolumeEncryptionMetadataTest(test.TestCase):
                                                 % bad_volume_id}}
         self.assertEqual(expected, res_dict)
 
-    def test_retrieve_key_not_admin(self):
+    def test_retrieve_key_admin(self):
         self.stubs.Set(volume_types, 'is_encrypted', lambda *a, **kw: True)
 
-        ctxt = self.ctxt.deepcopy()
-        ctxt.is_admin = False
+        ctxt = context.RequestContext('fake', 'fake', is_admin=True)
 
         req = webob.Request.blank('/v2/fake/volumes/%s/encryption/'
                                   'encryption_key_id' % self.volume_id)
         res = req.get_response(fakes.wsgi_app(fake_auth_context=ctxt))
-        self.assertEqual(403, res.status_code)
-        res_dict = json.loads(res.body)
+        self.assertEqual(200, res.status_code)
 
-        expected = {
-            'forbidden': {
-                'code': 403,
-                'message': ("Policy doesn't allow volume_extension:"
-                            "volume_encryption_metadata to be performed.")
-            }
-        }
-        self.assertEqual(expected, res_dict)
+        self.assertEqual('fake_key', res.body)
 
     def test_show_volume_not_encrypted_type(self):
         self.stubs.Set(volume_types, 'is_encrypted', lambda *a, **kw: False)

diff --git a/cinder/tests/policy.json b/cinder/tests/policy.json
index ab48d86d4f958dc175098eb24730376dc19131fb..98f126f847429123b00a95b9bb46e9cb3cf621f1 100644 (file)
--- a/cinder/tests/policy.json
+++ b/cinder/tests/policy.json
@@ -1,6 +1,7 @@
 {
     "context_is_admin": [["role:admin"]],
     "admin_api": [["is_admin:True"]],
+    "admin_or_owner":  [["is_admin:True"], ["project_id:%(project_id)s"]],
 
     "volume:create": [],
     "volume:get": [],
@@ -37,7 +38,7 @@
     "volume_extension:types_manage": [],
     "volume_extension:types_extra_specs": [],
     "volume_extension:volume_type_encryption": [["rule:admin_api"]],
-    "volume_extension:volume_encryption_metadata": [["rule:admin_api"]],
+    "volume_extension:volume_encryption_metadata": [["rule:admin_or_owner"]],
     "volume_extension:extended_snapshot_attributes": [],
     "volume_extension:volume_image_metadata": [],
     "volume_extension:volume_host_attribute": [["rule:admin_api"]],

diff --git a/etc/cinder/policy.json b/etc/cinder/policy.json
index f311bba845a79ec8f3ce4a99ea3518dbacb29c64..c8aaaa9605b9d88485d8695ffa879ad4b1e10a62 100644 (file)
--- a/etc/cinder/policy.json
+++ b/etc/cinder/policy.json
@@ -15,7 +15,7 @@
     "volume_extension:types_manage": [["rule:admin_api"]],
     "volume_extension:types_extra_specs": [["rule:admin_api"]],
     "volume_extension:volume_type_encryption": [["rule:admin_api"]],
-    "volume_extension:volume_encryption_metadata": [["rule:admin_api"]],
+    "volume_extension:volume_encryption_metadata": [["rule:admin_or_owner"]],
     "volume_extension:extended_snapshot_attributes": [],
     "volume_extension:volume_image_metadata": [],