** Changed in: neutron
Status: Fix Committed => Fix Released
** Changed in: neutron
Milestone: None => liberty-3
--
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to neutron.
https://bugs.launchpad.net/bugs/1485993
Title:
Tenants could potentially modify rules from not owned policies
Status in neutron:
Fix Released
Bug description:
In configurations where the policy creation is left open to the
tenants by policy.json modification, this is possible:
a) Admin creates policy A, attaches Rule X
b) tenant creates policy B, modifies rule X via API.
AS ADMIN:
[vagrant@devstack ~]$ source ~/devstack/accrc/admin/admin
[vagrant@devstack ~]$ neutron qos-policy-create A --description "policy A"
Created a new policy:
+-------------+--------------------------------------+
| Field | Value |
+-------------+--------------------------------------+
| description | policy A |
| id | 98134993-746f-409b-89b2-f3487187f730 |
| name | A |
| rules | |
| shared | False |
| tenant_id | 1556829297534c378cad15feb8196012 |
+-------------+--------------------------------------+
[vagrant@devstack ~]$ neutron qos-bandwidth-limit-rule-create A --max_kbps 100
Created a new bandwidth_limit_rule:
+----------------+--------------------------------------+
| Field | Value |
+----------------+--------------------------------------+
| id | 4a548459-c10f-4bf1-88fe-d20e277f2b50 |
| max_burst_kbps | 0 |
| max_kbps | 100 |
+----------------+--------------------------------------+
AS REGULAR TENANT:
[vagrant@devstack ~]$ source ~/devstack/accrc/demo/demo
[vagrant@devstack ~]$ neutron qos-policy-create B --description "policy B"
Created a new policy:
+-------------+--------------------------------------+
| Field | Value |
+-------------+--------------------------------------+
| description | policy B |
| id | 2ec2b6e2-8427-4ffd-8ab1-f4a5d577e49b |
| name | B |
| rules | |
| shared | False |
| tenant_id | c931dc21a7a241fa80eaba0ba0a738c6 |
+-------------+--------------------------------------+
[vagrant@devstack ~]$ neutron qos-bandwidth-limit-rule-update
4a548459-c10f-4bf1-88fe-d20e277f2b50 B --max_kbps 222
Updated bandwidth_limit_rule: 4a548459-c10f-4bf1-88fe-d20e277f2b50
[vagrant@devstack ~]$ neutron qos-bandwidth-limit-rule-show
4a548459-c10f-4bf1-88fe-d20e277f2b50 B
+----------------+--------------------------------------+
| Field | Value |
+----------------+--------------------------------------+
| id | 4a548459-c10f-4bf1-88fe-d20e277f2b50 |
| max_burst_kbps | 0 |
| max_kbps | 222 |
+----------------+--------------------------------------+
To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1485993/+subscriptions
--
Mailing list: https://launchpad.net/~yahoo-eng-team
Post to : yahoo-eng-team@lists.launchpad.net
Unsubscribe : https://launchpad.net/~yahoo-eng-team
More help : https://help.launchpad.net/ListHelp
