Add logging when policies forbid an action

There is currently no logging in images.py of glance API v1 or v2
and other files of glance API when policies forbid an action.This
patch adds logging in these situations.

Co-Authored-By: Ian Cordasco <ian.cordasco@rackspace.com>
Co-Authored-By: Kamil Rykowski <kamil.rykowski@intel.com>

Closes-Bug: #1270229
Change-Id: I32afbfc98a3de6370b0396f39c2cf481f6fc47a9

glance/api/cached_images.py

@@ -17,6 +17,7 @@
 Controller for Image Cache Management API
 """
 
+from oslo_log import log as logging
 import webob.exc
 
 from glance.api import policy
@@ -25,6 +26,8 @@ from glance.common import exception
 from glance.common import wsgi
 from glance import image_cache
 
+LOG = logging.getLogger(__name__)
+
 
 class Controller(controller.BaseController):
     """
@@ -40,6 +43,7 @@ class Controller(controller.BaseController):
         try:
             self.policy.enforce(req.context, 'manage_image_cache', {})
         except exception.Forbidden:
+            LOG.debug("User not permitted to manage the image cache")
             raise webob.exc.HTTPForbidden()
 
     def get_cached_images(self, req):

glance/api/middleware/cache.py

@@ -101,6 +101,7 @@ class CacheFilter(wsgi.Middleware):
         try:
             self.policy.enforce(req.context, action, target)
         except exception.Forbidden as e:
+            LOG.debug("User not permitted to perform '%s' action" % action)
             raise webob.exc.HTTPForbidden(explanation=e.msg, request=req)
 
     def _get_v1_image_metadata(self, request, image_id):

glance/api/v1/images.py

@@ -152,6 +152,7 @@ class Controller(controller.BaseController):
         try:
             self.policy.enforce(req.context, action, target)
         except exception.Forbidden:
+            LOG.debug("User not permitted to perform '%s' action" % action)
             raise HTTPForbidden()
 
     def _enforce_image_property_quota(self,

glance/api/v1/members.py

@@ -46,6 +46,7 @@ class Controller(controller.BaseController):
         try:
             self.policy.enforce(req.context, action, {})
         except exception.Forbidden:
+            LOG.debug("User not permitted to perform '%s' action" % action)
             raise webob.exc.HTTPForbidden()
 
     def _raise_404_if_image_deleted(self, req, image_id):
@@ -99,7 +100,8 @@ class Controller(controller.BaseController):
             LOG.debug(utils.exception_to_str(e))
             raise webob.exc.HTTPNotFound(explanation=e.msg)
         except exception.Forbidden as e:
-            LOG.debug(utils.exception_to_str(e))
+            LOG.debug("User not permitted to remove membership from image "
+                      "'%s'" % image_id)
             raise webob.exc.HTTPNotFound(explanation=e.msg)
 
         return webob.exc.HTTPNoContent()

glance/api/v2/image_actions.py

@@ -52,6 +52,7 @@ class ImageActionsController(object):
         except exception.NotFound as e:
             raise webob.exc.HTTPNotFound(explanation=e.msg)
         except exception.Forbidden as e:
+            LOG.debug("User not permitted to deactivate image '%s'" % image_id)
             raise webob.exc.HTTPForbidden(explanation=e.msg)
         except exception.InvalidImageStatusTransition as e:
             raise webob.exc.HTTPBadRequest(explanation=e.msg)
@@ -67,6 +68,7 @@ class ImageActionsController(object):
         except exception.NotFound as e:
             raise webob.exc.HTTPNotFound(explanation=e.msg)
         except exception.Forbidden as e:
+            LOG.debug("User not permitted to reactivate image '%s'" % image_id)
             raise webob.exc.HTTPForbidden(explanation=e.msg)
         except exception.InvalidImageStatusTransition as e:
             raise webob.exc.HTTPBadRequest(explanation=e.msg)

glance/api/v2/image_data.py

@@ -180,6 +180,7 @@ class ImageDataController(object):
         except exception.NotFound as e:
             raise webob.exc.HTTPNotFound(explanation=e.msg)
         except exception.Forbidden as e:
+            LOG.debug("User not permitted to download image '%s'" % image_id)
             raise webob.exc.HTTPForbidden(explanation=e.msg)
 
         return image
@@ -228,6 +229,7 @@ class ResponseSerializer(wsgi.JSONResponseSerializer):
                 glance_store.StoreRandomGetNotSupported) as e:
             raise webob.exc.HTTPBadRequest(explanation=e.msg)
         except exception.Forbidden as e:
+            LOG.debug("User not permitted to download image '%s'" % image)
             raise webob.exc.HTTPForbidden(explanation=e.msg)
         # NOTE(saschpe): "response.app_iter = ..." currently resets Content-MD5
         # (https://github.com/Pylons/webob/issues/86), so it should be set

glance/api/v2/images.py

@@ -68,6 +68,7 @@ class ImagesController(object):
         except exception.Invalid as e:
             raise webob.exc.HTTPBadRequest(explanation=e.msg)
         except exception.Forbidden as e:
+            LOG.debug("User not permitted to create image")
             raise webob.exc.HTTPForbidden(explanation=e.msg)
         except exception.InvalidParameterValue as e:
             raise webob.exc.HTTPBadRequest(explanation=e.msg)
@@ -116,6 +117,7 @@ class ImagesController(object):
                 exception.InvalidFilterRangeValue) as e:
             raise webob.exc.HTTPBadRequest(explanation=e.msg)
         except exception.Forbidden as e:
+            LOG.debug("User not permitted to retrieve images index")
             raise webob.exc.HTTPForbidden(explanation=e.msg)
         result['images'] = images
         return result
@@ -125,6 +127,7 @@ class ImagesController(object):
         try:
             return image_repo.get(image_id)
         except exception.Forbidden as e:
+            LOG.debug("User not permitted to show image '%s'" % image_id)
             raise webob.exc.HTTPForbidden(explanation=e.msg)
         except exception.NotFound as e:
             raise webob.exc.HTTPNotFound(explanation=e.msg)
@@ -148,6 +151,7 @@ class ImagesController(object):
         except exception.Invalid as e:
             raise webob.exc.HTTPBadRequest(explanation=e.msg)
         except exception.Forbidden as e:
+            LOG.debug("User not permitted to update image '%s'" % image_id)
             raise webob.exc.HTTPForbidden(explanation=e.msg)
         except exception.InvalidParameterValue as e:
             raise webob.exc.HTTPBadRequest(explanation=e.msg)
@@ -220,6 +224,7 @@ class ImagesController(object):
             image.delete()
             image_repo.remove(image)
         except exception.Forbidden as e:
+            LOG.debug("User not permitted to delete image '%s'" % image_id)
             raise webob.exc.HTTPForbidden(explanation=e.msg)
         except exception.NotFound as e:
             msg = (_("Failed to find image %(image_id)s to delete") %

glance/api/v2/metadef_namespaces.py

@@ -95,6 +95,8 @@ class NamespaceController(object):
                 namespaces.next = namespace_list[-1].namespace
 
         except exception.Forbidden as e:
+            LOG.debug("User not permitted to retrieve metadata namespaces "
+                      "index")
             raise webob.exc.HTTPForbidden(explanation=e.msg)
         except exception.NotFound as e:
             raise webob.exc.HTTPNotFound(explanation=e.msg)
@@ -166,6 +168,7 @@ class NamespaceController(object):
 
         except exception.Forbidden as e:
             self._cleanup_namespace(ns_repo, namespace, namespace_created)
+            LOG.debug("User not permitted to create metadata namespace")
             raise webob.exc.HTTPForbidden(explanation=e.msg)
         except exception.NotFound as e:
             self._cleanup_namespace(ns_repo, namespace, namespace_created)
@@ -259,6 +262,8 @@ class NamespaceController(object):
                 namespace_detail.tags = tag_list
 
         except exception.Forbidden as e:
+            LOG.debug("User not permitted to show metadata namespace "
+                      "'%s'" % namespace)
             raise webob.exc.HTTPForbidden(explanation=e.msg)
         except exception.NotFound as e:
             raise webob.exc.HTTPNotFound(explanation=e.msg)
@@ -285,6 +290,8 @@ class NamespaceController(object):
                 wsme_utils._get_value(user_ns.owner) or req.context.owner)
             updated_namespace = namespace_repo.save(ns_obj)
         except exception.Forbidden as e:
+            LOG.debug("User not permitted to update metadata namespace "
+                      "'%s'" % namespace)
             raise webob.exc.HTTPForbidden(explanation=e.msg)
         except exception.NotFound as e:
             raise webob.exc.HTTPNotFound(explanation=e.msg)
@@ -305,6 +312,8 @@ class NamespaceController(object):
             namespace_obj.delete()
             namespace_repo.remove(namespace_obj)
         except exception.Forbidden as e:
+            LOG.debug("User not permitted to delete metadata namespace "
+                      "'%s'" % namespace)
             raise webob.exc.HTTPForbidden(explanation=e.msg)
         except exception.NotFound as e:
             raise webob.exc.HTTPNotFound(explanation=e.msg)
@@ -319,6 +328,8 @@ class NamespaceController(object):
             namespace_obj.delete()
             ns_repo.remove_objects(namespace_obj)
         except exception.Forbidden as e:
+            LOG.debug("User not permitted to delete metadata objects "
+                      "within '%s' namespace" % namespace)
             raise webob.exc.HTTPForbidden(explanation=e.msg)
         except exception.NotFound as e:
             raise webob.exc.HTTPNotFound(explanation=e.msg)
@@ -333,6 +344,8 @@ class NamespaceController(object):
             namespace_obj.delete()
             ns_repo.remove_tags(namespace_obj)
         except exception.Forbidden as e:
+            LOG.debug("User not permitted to delete metadata tags "
+                      "within '%s' namespace" % namespace)
             raise webob.exc.HTTPForbidden(explanation=e.msg)
         except exception.NotFound as e:
             raise webob.exc.HTTPNotFound(explanation=e.msg)
@@ -347,6 +360,8 @@ class NamespaceController(object):
             namespace_obj.delete()
             ns_repo.remove_properties(namespace_obj)
         except exception.Forbidden as e:
+            LOG.debug("User not permitted to delete metadata properties "
+                      "within '%s' namespace" % namespace)
             raise webob.exc.HTTPForbidden(explanation=e.msg)
         except exception.NotFound as e:
             raise webob.exc.HTTPNotFound(explanation=e.msg)

glance/api/v2/metadef_objects.py

@@ -61,6 +61,8 @@ class MetadefObjectsController(object):
             object_repo.add(new_meta_object)
 
         except exception.Forbidden as e:
+            LOG.debug("User not permitted to create metadata object within "
+                      "'%s' namespace" % namespace)
             raise webob.exc.HTTPForbidden(explanation=e.msg)
         except exception.NotFound as e:
             raise webob.exc.HTTPNotFound(explanation=e.msg)
@@ -90,6 +92,8 @@ class MetadefObjectsController(object):
             metadef_objects = MetadefObjects()
             metadef_objects.objects = object_list
         except exception.Forbidden as e:
+            LOG.debug("User not permitted to retrieve metadata objects within "
+                      "'%s' namespace" % namespace)
             raise webob.exc.HTTPForbidden(explanation=e.msg)
         except exception.NotFound as e:
             raise webob.exc.HTTPNotFound(explanation=e.msg)
@@ -108,6 +112,8 @@ class MetadefObjectsController(object):
                 get_object_href(namespace, metadef_object),
                 self.obj_schema_link)
         except exception.Forbidden as e:
+            LOG.debug("User not permitted to show metadata object '%s' "
+                      "within '%s' namespace" % (namespace, object_name))
             raise webob.exc.HTTPForbidden(explanation=e.msg)
         except exception.NotFound as e:
             raise webob.exc.HTTPNotFound(explanation=e.msg)
@@ -130,6 +136,8 @@ class MetadefObjectsController(object):
                 metadata_object.properties)
             updated_metadata_obj = meta_repo.save(metadef_object)
         except exception.Forbidden as e:
+            LOG.debug("User not permitted to update metadata object '%s' "
+                      "within '%s' namespace " % (object_name, namespace))
             raise webob.exc.HTTPForbidden(explanation=e.msg)
         except exception.NotFound as e:
             raise webob.exc.HTTPNotFound(explanation=e.msg)
@@ -150,6 +158,8 @@ class MetadefObjectsController(object):
             metadef_object.delete()
             meta_repo.remove(metadef_object)
         except exception.Forbidden as e:
+            LOG.debug("User not permitted to delete metadata object '%s' "
+                      "within '%s' namespace" % (object_name, namespace))
             raise webob.exc.HTTPForbidden(explanation=e.msg)
         except exception.NotFound as e:
             raise webob.exc.HTTPNotFound(explanation=e.msg)

glance/api/v2/metadef_properties.py

@@ -73,6 +73,8 @@ class NamespacePropertiesController(object):
             namespace_properties = PropertyTypes()
             namespace_properties.properties = property_list
         except exception.Forbidden as e:
+            LOG.debug("User not permitted to retrieve metadata properties "
+                      "within '%s' namespace" % namespace)
             raise webob.exc.HTTPForbidden(explanation=e.msg)
         except exception.NotFound as e:
             raise webob.exc.HTTPNotFound(explanation=e.msg)
@@ -103,6 +105,8 @@ class NamespacePropertiesController(object):
             db_property = prop_repo.get(namespace, property_name)
             property = self._to_model(db_property)
         except exception.Forbidden as e:
+            LOG.debug("User not permitted to show metadata property '%s' "
+                      "within '%s' namespace" % (property_name, namespace))
             raise webob.exc.HTTPForbidden(explanation=e.msg)
         except exception.NotFound as e:
             raise webob.exc.HTTPNotFound(explanation=e.msg)
@@ -119,6 +123,8 @@ class NamespacePropertiesController(object):
                 namespace=namespace, **self._to_dict(property_type))
             prop_repo.add(new_property_type)
         except exception.Forbidden as e:
+            LOG.debug("User not permitted to create metadata property within "
+                      "'%s' namespace" % namespace)
             raise webob.exc.HTTPForbidden(explanation=e.msg)
         except exception.NotFound as e:
             raise webob.exc.HTTPNotFound(explanation=e.msg)
@@ -138,6 +144,8 @@ class NamespacePropertiesController(object):
             db_property_type.schema = (self._to_dict(property_type))['schema']
             updated_property_type = prop_repo.save(db_property_type)
         except exception.Forbidden as e:
+            LOG.debug("User not permitted to update metadata property '%s' "
+                      "within '%s' namespace" % (property_name, namespace))
             raise webob.exc.HTTPForbidden(explanation=e.msg)
         except exception.NotFound as e:
             raise webob.exc.HTTPNotFound(explanation=e.msg)
@@ -155,6 +163,8 @@ class NamespacePropertiesController(object):
             property_type.delete()
             prop_repo.remove(property_type)
         except exception.Forbidden as e:
+            LOG.debug("User not permitted to delete metadata property '%s' "
+                      "within '%s' namespace" % (property_name, namespace))
             raise webob.exc.HTTPForbidden(explanation=e.msg)
         except exception.NotFound as e:
             raise webob.exc.HTTPNotFound(explanation=e.msg)

glance/api/v2/metadef_resource_types.py

@@ -60,6 +60,8 @@ class ResourceTypeController(object):
             resource_types = ResourceTypes()
             resource_types.resource_types = resource_type_list
         except exception.Forbidden as e:
+            LOG.debug("User not permitted to retrieve metadata resource types "
+                      "index")
             raise webob.exc.HTTPForbidden(explanation=e.msg)
         except exception.NotFound as e:
             raise webob.exc.HTTPNotFound(explanation=e.msg)
@@ -80,6 +82,8 @@ class ResourceTypeController(object):
             resource_types = ResourceTypeAssociations()
             resource_types.resource_type_associations = resource_type_list
         except exception.Forbidden as e:
+            LOG.debug("User not permitted to retrieve metadata resource types "
+                      "within '%s' namespace" % namespace)
             raise webob.exc.HTTPForbidden(explanation=e.msg)
         except exception.NotFound as e:
             raise webob.exc.HTTPNotFound(explanation=e.msg)
@@ -98,6 +102,8 @@ class ResourceTypeController(object):
             rs_type_repo.add(new_resource_type)
 
         except exception.Forbidden as e:
+            LOG.debug("User not permitted to create metadata resource type "
+                      "within '%s' namespace" % namespace)
             raise webob.exc.HTTPForbidden(explanation=e.msg)
         except exception.NotFound as e:
             raise webob.exc.HTTPNotFound(explanation=e.msg)
@@ -123,6 +129,9 @@ class ResourceTypeController(object):
             if not found:
                 raise exception.NotFound()
         except exception.Forbidden as e:
+            LOG.debug("User not permitted to delete metadata resource type "
+                      "'%s' within '%s' namespace" % (resource_type,
+                                                      namespace))
             raise webob.exc.HTTPForbidden(explanation=e.msg)
         except exception.NotFound as e:
             msg = (_("Failed to find resource type %(resourcetype)s to "

glance/api/v2/metadef_tags.py

@@ -60,6 +60,8 @@ class TagsController(object):
                 **tag_name_as_dict)
             tag_repo.add(new_meta_tag)
         except exception.Forbidden as e:
+            LOG.debug("User not permitted to create metadata tag within "
+                      "'%s' namespace" % namespace)
             raise webob.exc.HTTPForbidden(explanation=e.msg)
         except exception.NotFound as e:
             raise webob.exc.HTTPNotFound(explanation=e.msg)
@@ -85,6 +87,8 @@ class TagsController(object):
             metadef_tags = MetadefTags()
             metadef_tags.tags = tag_list_out
         except exception.Forbidden as e:
+            LOG.debug("User not permitted to create metadata tags within "
+                      "'%s' namespace" % namespace)
             raise webob.exc.HTTPForbidden(explanation=e.msg)
         except exception.NotFound as e:
             raise webob.exc.HTTPNotFound(explanation=e.msg)
@@ -117,6 +121,8 @@ class TagsController(object):
             metadef_tags = MetadefTags()
             metadef_tags.tags = tag_list
         except exception.Forbidden as e:
+            LOG.debug("User not permitted to retrieve metadata tags "
+                      "within '%s' namespace" % namespace)
             raise webob.exc.HTTPForbidden(explanation=e.msg)
         except exception.NotFound as e:
             raise webob.exc.HTTPNotFound(explanation=e.msg)
@@ -132,6 +138,8 @@ class TagsController(object):
             metadef_tag = meta_tag_repo.get(namespace, tag_name)
             return MetadefTag.to_wsme_model(metadef_tag)
         except exception.Forbidden as e:
+            LOG.debug("User not permitted to show metadata tag '%s' "
+                      "within '%s' namespace" % (tag_name, namespace))
             raise webob.exc.HTTPForbidden(explanation=e.msg)
         except exception.NotFound as e:
             raise webob.exc.HTTPNotFound(explanation=e.msg)
@@ -148,6 +156,8 @@ class TagsController(object):
                 metadata_tag.name)
             updated_metadata_tag = meta_repo.save(metadef_tag)
         except exception.Forbidden as e:
+            LOG.debug("User not permitted to update metadata tag '%s' "
+                      "within '%s' namespace" % (tag_name, namespace))
             raise webob.exc.HTTPForbidden(explanation=e.msg)
         except exception.NotFound as e:
             raise webob.exc.HTTPNotFound(explanation=e.msg)
@@ -166,6 +176,8 @@ class TagsController(object):
             metadef_tag.delete()
             meta_repo.remove(metadef_tag)
         except exception.Forbidden as e:
+            LOG.debug("User not permitted to delete metadata tag '%s' "
+                      "within '%s' namespace" % (tag_name, namespace))
             raise webob.exc.HTTPForbidden(explanation=e.msg)
         except exception.NotFound as e:
             raise webob.exc.HTTPNotFound(explanation=e.msg)