driver.create/remove_export() require elevated ctx

The volume manager should call driver.create_export()
and driver.remove_export() with an elevated context.

This is already done for remove_export() in some cases
but not in initialize_connection error paths, or for
terminate_connection.

This will at a minimum cause issues with the LVM LIO
driver as its create/remove_export methods uses database
queries requiring admin access (volume_get_iscsi_target_num,
iscsi_target_count_by_host).

Partial-Bug: #1300148
Closes-Bug: #1305197

Change-Id: I5c1091cf9720ebccefc328b64fbf2982b3aac397
(cherry picked from commit d09d12ab2ba72a9e7fe42852a7cf837231053590)

diff --git a/cinder/tests/zonemanager/test_volume_manager_fc.py b/cinder/tests/zonemanager/test_volume_manager_fc.py
index a4d3ce3a5d41429b55f51b6ba44b678d8ab5e9b7..5cc5a7078d67ccb8ed8f472fe14a7f4026a0b2b8 100644 (file)
--- a/cinder/tests/zonemanager/test_volume_manager_fc.py
+++ b/cinder/tests/zonemanager/test_volume_manager_fc.py
@@ -119,7 +119,7 @@ class TestVolumeManager(manager.VolumeManager, test.TestCase):
         with mock.patch.object(manager.VolumeManager,
                                '_add_or_delete_fc_connection')\
                 as add_del_conn_mock:
-            self.terminate_connection(None, None, None, False)
+            self.terminate_connection(self.context_mock, None, None, False)
             add_del_conn_mock.assert_called_once_with(conn_info, 0)
 
     @mock.patch.object(utils, 'require_driver_initialized')
@@ -131,7 +131,7 @@ class TestVolumeManager(manager.VolumeManager, test.TestCase):
                 as add_del_conn_mock:
             self.configuration.zoning_mode = 'none'
             self.zonemanager = None
-            self.terminate_connection(None, None, None, False)
+            self.terminate_connection(self.context_mock, None, None, False)
             assert not add_del_conn_mock.called
 
     @mock.patch.object(utils, 'require_driver_initialized')
@@ -142,7 +142,7 @@ class TestVolumeManager(manager.VolumeManager, test.TestCase):
         with mock.patch.object(manager.VolumeManager,
                                '_add_or_delete_fc_connection')\
                 as add_del_conn_mock:
-            self.terminate_connection(None, None, None, False)
+            self.terminate_connection(self.context_mock, None, None, False)
             assert not add_del_conn_mock.called
 
     @mock.patch.object(fc_zone_manager.ZoneManager, 'add_connection')

diff --git a/cinder/volume/manager.py b/cinder/volume/manager.py
index 5f29163ea70d45d059be25474310d23e19bf72ef..7bd7382b943075fe928e6e08efa02c65663354e6 100644 (file)
--- a/cinder/volume/manager.py
+++ b/cinder/volume/manager.py
@@ -779,7 +779,8 @@ class VolumeManager(manager.SchedulerDependentManager):
         model_update = None
         try:
             LOG.debug(_("Volume %s: creating export"), volume_id)
-            model_update = self.driver.create_export(context, volume)
+            model_update = self.driver.create_export(context.elevated(),
+                                                     volume)
             if model_update:
                 volume = self.db.volume_update(context,
                                                volume_id,
@@ -794,10 +795,10 @@ class VolumeManager(manager.SchedulerDependentManager):
         try:
             conn_info = self.driver.initialize_connection(volume, connector)
         except Exception as err:
-            self.driver.remove_export(context, volume)
             err_msg = (_('Unable to fetch connection information from '
                          'backend: %(err)s') % {'err': err})
             LOG.error(err_msg)
+            self.driver.remove_export(context.elevated(), volume)
             raise exception.VolumeBackendAPIException(data=err_msg)
 
         # Add qos_specs to connection info
@@ -865,7 +866,7 @@ class VolumeManager(manager.SchedulerDependentManager):
 
         try:
             LOG.debug(_("volume %s: removing export"), volume_id)
-            self.driver.remove_export(context, volume_ref)
+            self.driver.remove_export(context.elevated(), volume_ref)
         except Exception as ex:
             LOG.exception(_("Error detaching volume %(volume)s, "
                             "due to remove export failure."),