Sean Mooney
9c313b007f
Ten API endpoints in cyborg/common/policy.py used check_str='rule:allow'
(@), which unconditionally authorises any authenticated Keystone user
regardless of role, project membership, or scope. This allowed any
tenant to enumerate the full accelerator hardware topology and trigger
privileged operations including FPGA reprogramming and hardware metadata
mutation.
Replace the unconditional rule:allow with role-checked rules available
on all maintained stable branches:
cyborg:arq:create rule:allow -> rule:project_member_or_admin
cyborg:device:get_one rule:allow -> rule:admin_api
cyborg:device:get_all rule:allow -> rule:admin_api
cyborg:deployable:get_one rule:allow -> rule:admin_api
cyborg:deployable:get_all rule:allow -> rule:admin_api
cyborg:deployable:program rule:allow -> rule:admin_api
cyborg:attribute:get_one rule:allow -> rule:admin_api
cyborg:attribute:get_all rule:allow -> rule:admin_api
cyborg:attribute:create rule:allow -> rule:admin_api
cyborg:attribute:delete rule:allow -> rule:admin_api
arq:create receives project_member_or_admin rather than admin_api
because Nova forwards the end-user token when creating ARQs; admin_api
would break all non-admin instance launches.
Also remove the dead fpga_policies group (cyborg:fpga:{get_one,
get_all,update}) whose rules were registered but never evaluated at
runtime as no /v2/fpgas endpoint exists.
Add unit tests in cyborg/tests/unit/policies/ covering authorised and
unauthorised contexts for each affected endpoint group, following the
pattern established by test_device_profiles.py.
CVE-2026-40213
Closes-Bug: #2143263
Assisted-By: claude-code sonnet 4.6
Change-Id: I56f04adcfe270f02dfd6511a1aea1074e3d2dedb
Signed-off-by: Sean Mooney <work@seanmooney.info>
Cyborg
OpenStack Acceleration as a Service
Cyborg provides a general management framework for accelerators such as FPGA, GPU, SoCs, NVMe SSDs, CCIX caches, DPDK/SPDK, pmem and so forth.
- Free software: Apache license
- Wiki: https://wiki.openstack.org/wiki/Cyborg
- Source: https://opendev.org/openstack/cyborg
- Blueprints: https://blueprints.launchpad.net/openstack-cyborg
- Bugs: https://bugs.launchpad.net/openstack-cyborg
- Documentation: https://docs.openstack.org/cyborg/latest/
- Release notes: https://docs.openstack.org/releasenotes/cyborg/
- Design specifications: https://specs.openstack.org/openstack/cyborg-specs/
Features
- REST API for basic accelerator life cycle management
- Generic driver for common accelerator support