Flavor Extra Specs should require admin privileges by default

Reviewed: https://review.openstack.org/18713
Committed: http://github.com/openstack/nova/commit/aee1253ce21fdb8bffac8c68e933910f1bf39dc7
Submitter: Jenkins
Branch: master

commit aee1253ce21fdb8bffac8c68e933910f1bf39dc7
Author: Jay Pipes <email address hidden>
Date: Fri Dec 28 06:25:19 2012 -0500

    CRUD on flavor extra spec extension should be admin-only

    Changes the default policy.json file to make the flavor extra
    spec create/update/delete operations admin-only, since the
    flavormanage extension is admin-only.

    fixes: lp bug #1094142

    Change-Id: Ic464b17130e76565a7c475e59064e3e3e8861327

The bug is still open, not released.
A user who does not have admin privileges is *not* allowed to perform "flavor manage". But he is still able to set "flavor extra spec".

> stack@new-vm:/opt/stack/devstack$ nova flavor-create test-1 123 512 1 1
> ERROR: Policy doesn't allow compute_extension:flavormanage to be performed. (HTTP 403) (Request-ID: req-e8236e5b-f51e-4f37-a2f8-0c875583e180)
> stack@new-vm:/opt/stack/devstack$ nova flavor-key 1 set spec2=spec2
> stack@new-vm:/opt/stack/devstack$

policy.json that my Devstack is using has the following code added:

 "compute_extension:flavorextraspecs:index": "",
 "compute_extension:flavorextraspecs:show": "",
 "compute_extension:flavorextraspecs:create": "rule:admin_api",
 "compute_extension:flavorextraspecs:update": "rule:admin_api",
 "compute_extension:flavorextraspecs:delete": "rule:admin_api",

Refer the pastebin :
http://pastebin.ubuntu.com/1540305/

Sequence of activities that I have performed in my Devstack machine:

root@new-vm:/opt/stack/nova/etc/nova# env | grep OS
OS_PASSWORD=Openstack1
OS_AUTH_URL=http://127.0.0.1:5000/v2.0
OS_USERNAME=admin
OS_TENANT_NAME=admin
OS_CACERT=/opt/stack/data/CA/int-ca/ca-chain.pem
OS_NO_CACHE=1
LESSCLOSE=/usr/bin/lesspipe %s %s
root@new-vm:/opt/stack/nova/etc/nova# nova flavor-create test-flavor 123 512 1 1
+-----+-------------+-----------+------+-----------+------+-------+-------------+-----------+-------------+
| ID | Name | Memory_MB | Disk | Ephemeral | Swap | VCPUs | RXTX_Factor | Is_Public | extra_specs |
+-----+-------------+-----------+------+-----------+------+-------+-------------+-----------+-------------+
| 123 | test-flavor | 512 | 1 | 0 | | 1 | 1.0 | True | {} |
+-----+-------------+-----------+------+-----------+------+-------+-------------+-----------+-------------+
root@new-vm:/opt/stack/nova/etc/nova# nova flavor-key 123 set key1=value1
root@new-vm:/opt/stack/nova/etc/nova# nova flavor-show 123
+----------------------------+----------------------+
| Property | Value |
+----------------------------+----------------------+
| OS-FLV-DISABLED:disabled | False |
| OS-FLV-EXT-DATA:ephemeral | 0 |
| disk | 1 |
| extra_specs | {u'key1': u'value1'} |
| id | 123 |
| name | test-flavor |
| os-flavor-access:is_public | True |
| ram | 512 |
| rxtx_factor | 1.0 |
| swap | |
| vcpus | 1 |
+----------------------------+----------------------+
root@new-vm:/opt/stack/nova/etc/nova# export OS_USERNAME=demo
root@new-vm:/opt/stack/nova/etc/nova# export OS_TENANT_NAME=demo
root@new-vm:/opt/stack/nova/etc/nova# nova flavor-create test-flavor2 333 512 1 1
ERROR: Policy doesn't allow compute_extension:flavormanage to be performed. (HTTP 403) (Request-ID: req-27ffd9b1-28a9-437b-b87b-bb2545a752a4)
root@new-vm:/opt/stack/nova/etc/nova# nova flav...

Fix proposed to branch: master
Review: https://review.openstack.org/20662

Could user access to those "flavor extra specs" be leveraged into some form of attack ? I'm trying to see if we should issue an after-the-fact security advisory for this thing.

Reviewed: https://review.openstack.org/20662
Committed: http://github.com/openstack/nova/commit/7ba533f069aa95c73524f7f0a398a216dfbcdbb3
Submitter: Jenkins
Branch: master

commit 7ba533f069aa95c73524f7f0a398a216dfbcdbb3
Author: Li Chen <email address hidden>
Date: Fri Feb 1 17:32:26 2013 +0800

    Flavor Extra Specs should require admin privileges

    The previous fix added admin check in policy.json,
    but code still can't recorginize the detailed actions.

    This fix edited "authorize" function for flavor_extra_specs,
    to make sure it will check the admin privileges in policy.json.

    Also, together with the code, this fix edit old test case with admin privileges,
    and added new non-admin privileges test case.

    Fixes bug 1094142

    Change-Id: Ia286aedb4846383ad51bd54b0984dd1feddfbf81