From 7896c006353426348c88938fc72ecf1df57d88e4 Mon Sep 17 00:00:00 2001 From: Jin Long Wang Date: Wed, 10 Sep 2014 11:16:13 +0800 Subject: [PATCH] Add logging when policies forbid an action There is currently no logging in images.py of glance API v1 or v2 and other files of glance API when policies forbid an action.This patch adds logging in these situations. Co-Authored-By: Ian Cordasco Co-Authored-By: Kamil Rykowski Closes-Bug: #1270229 Change-Id: I32afbfc98a3de6370b0396f39c2cf481f6fc47a9 --- glance/api/cached_images.py | 4 ++++ glance/api/middleware/cache.py | 1 + glance/api/v1/images.py | 1 + glance/api/v1/members.py | 4 +++- glance/api/v2/image_actions.py | 2 ++ glance/api/v2/image_data.py | 2 ++ glance/api/v2/images.py | 5 +++++ glance/api/v2/metadef_namespaces.py | 15 +++++++++++++++ glance/api/v2/metadef_objects.py | 10 ++++++++++ glance/api/v2/metadef_properties.py | 10 ++++++++++ glance/api/v2/metadef_resource_types.py | 9 +++++++++ glance/api/v2/metadef_tags.py | 12 ++++++++++++ 12 files changed, 74 insertions(+), 1 deletion(-) diff --git a/glance/api/cached_images.py b/glance/api/cached_images.py index 15d6b45a49..04d1c0ce40 100644 --- a/glance/api/cached_images.py +++ b/glance/api/cached_images.py @@ -17,6 +17,7 @@ Controller for Image Cache Management API """ +from oslo_log import log as logging import webob.exc from glance.api import policy @@ -25,6 +26,8 @@ from glance.common import exception from glance.common import wsgi from glance import image_cache +LOG = logging.getLogger(__name__) + class Controller(controller.BaseController): """ @@ -40,6 +43,7 @@ class Controller(controller.BaseController): try: self.policy.enforce(req.context, 'manage_image_cache', {}) except exception.Forbidden: + LOG.debug("User not permitted to manage the image cache") raise webob.exc.HTTPForbidden() def get_cached_images(self, req): diff --git a/glance/api/middleware/cache.py b/glance/api/middleware/cache.py index 10a90e39ab..279f88feb7 100644 --- a/glance/api/middleware/cache.py +++ b/glance/api/middleware/cache.py @@ -101,6 +101,7 @@ class CacheFilter(wsgi.Middleware): try: self.policy.enforce(req.context, action, target) except exception.Forbidden as e: + LOG.debug("User not permitted to perform '%s' action" % action) raise webob.exc.HTTPForbidden(explanation=e.msg, request=req) def _get_v1_image_metadata(self, request, image_id): diff --git a/glance/api/v1/images.py b/glance/api/v1/images.py index e33b91fbca..52006c3f13 100644 --- a/glance/api/v1/images.py +++ b/glance/api/v1/images.py @@ -152,6 +152,7 @@ class Controller(controller.BaseController): try: self.policy.enforce(req.context, action, target) except exception.Forbidden: + LOG.debug("User not permitted to perform '%s' action" % action) raise HTTPForbidden() def _enforce_image_property_quota(self, diff --git a/glance/api/v1/members.py b/glance/api/v1/members.py index 2727d555c5..ba0204c223 100644 --- a/glance/api/v1/members.py +++ b/glance/api/v1/members.py @@ -46,6 +46,7 @@ class Controller(controller.BaseController): try: self.policy.enforce(req.context, action, {}) except exception.Forbidden: + LOG.debug("User not permitted to perform '%s' action" % action) raise webob.exc.HTTPForbidden() def _raise_404_if_image_deleted(self, req, image_id): @@ -99,7 +100,8 @@ class Controller(controller.BaseController): LOG.debug(utils.exception_to_str(e)) raise webob.exc.HTTPNotFound(explanation=e.msg) except exception.Forbidden as e: - LOG.debug(utils.exception_to_str(e)) + LOG.debug("User not permitted to remove membership from image " + "'%s'" % image_id) raise webob.exc.HTTPNotFound(explanation=e.msg) return webob.exc.HTTPNoContent() diff --git a/glance/api/v2/image_actions.py b/glance/api/v2/image_actions.py index 37a66acc4d..34bde03942 100644 --- a/glance/api/v2/image_actions.py +++ b/glance/api/v2/image_actions.py @@ -52,6 +52,7 @@ class ImageActionsController(object): except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) except exception.Forbidden as e: + LOG.debug("User not permitted to deactivate image '%s'" % image_id) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.InvalidImageStatusTransition as e: raise webob.exc.HTTPBadRequest(explanation=e.msg) @@ -67,6 +68,7 @@ class ImageActionsController(object): except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) except exception.Forbidden as e: + LOG.debug("User not permitted to reactivate image '%s'" % image_id) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.InvalidImageStatusTransition as e: raise webob.exc.HTTPBadRequest(explanation=e.msg) diff --git a/glance/api/v2/image_data.py b/glance/api/v2/image_data.py index 4025eebde0..660bd20d74 100644 --- a/glance/api/v2/image_data.py +++ b/glance/api/v2/image_data.py @@ -180,6 +180,7 @@ class ImageDataController(object): except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) except exception.Forbidden as e: + LOG.debug("User not permitted to download image '%s'" % image_id) raise webob.exc.HTTPForbidden(explanation=e.msg) return image @@ -228,6 +229,7 @@ class ResponseSerializer(wsgi.JSONResponseSerializer): glance_store.StoreRandomGetNotSupported) as e: raise webob.exc.HTTPBadRequest(explanation=e.msg) except exception.Forbidden as e: + LOG.debug("User not permitted to download image '%s'" % image) raise webob.exc.HTTPForbidden(explanation=e.msg) # NOTE(saschpe): "response.app_iter = ..." currently resets Content-MD5 # (https://github.com/Pylons/webob/issues/86), so it should be set diff --git a/glance/api/v2/images.py b/glance/api/v2/images.py index 589b25ff81..934b840079 100644 --- a/glance/api/v2/images.py +++ b/glance/api/v2/images.py @@ -68,6 +68,7 @@ class ImagesController(object): except exception.Invalid as e: raise webob.exc.HTTPBadRequest(explanation=e.msg) except exception.Forbidden as e: + LOG.debug("User not permitted to create image") raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.InvalidParameterValue as e: raise webob.exc.HTTPBadRequest(explanation=e.msg) @@ -116,6 +117,7 @@ class ImagesController(object): exception.InvalidFilterRangeValue) as e: raise webob.exc.HTTPBadRequest(explanation=e.msg) except exception.Forbidden as e: + LOG.debug("User not permitted to retrieve images index") raise webob.exc.HTTPForbidden(explanation=e.msg) result['images'] = images return result @@ -125,6 +127,7 @@ class ImagesController(object): try: return image_repo.get(image_id) except exception.Forbidden as e: + LOG.debug("User not permitted to show image '%s'" % image_id) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -148,6 +151,7 @@ class ImagesController(object): except exception.Invalid as e: raise webob.exc.HTTPBadRequest(explanation=e.msg) except exception.Forbidden as e: + LOG.debug("User not permitted to update image '%s'" % image_id) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.InvalidParameterValue as e: raise webob.exc.HTTPBadRequest(explanation=e.msg) @@ -220,6 +224,7 @@ class ImagesController(object): image.delete() image_repo.remove(image) except exception.Forbidden as e: + LOG.debug("User not permitted to delete image '%s'" % image_id) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: msg = (_("Failed to find image %(image_id)s to delete") % diff --git a/glance/api/v2/metadef_namespaces.py b/glance/api/v2/metadef_namespaces.py index 1d00b5f7d8..ab55a24bb4 100644 --- a/glance/api/v2/metadef_namespaces.py +++ b/glance/api/v2/metadef_namespaces.py @@ -95,6 +95,8 @@ class NamespaceController(object): namespaces.next = namespace_list[-1].namespace except exception.Forbidden as e: + LOG.debug("User not permitted to retrieve metadata namespaces " + "index") raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -166,6 +168,7 @@ class NamespaceController(object): except exception.Forbidden as e: self._cleanup_namespace(ns_repo, namespace, namespace_created) + LOG.debug("User not permitted to create metadata namespace") raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: self._cleanup_namespace(ns_repo, namespace, namespace_created) @@ -259,6 +262,8 @@ class NamespaceController(object): namespace_detail.tags = tag_list except exception.Forbidden as e: + LOG.debug("User not permitted to show metadata namespace " + "'%s'" % namespace) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -285,6 +290,8 @@ class NamespaceController(object): wsme_utils._get_value(user_ns.owner) or req.context.owner) updated_namespace = namespace_repo.save(ns_obj) except exception.Forbidden as e: + LOG.debug("User not permitted to update metadata namespace " + "'%s'" % namespace) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -305,6 +312,8 @@ class NamespaceController(object): namespace_obj.delete() namespace_repo.remove(namespace_obj) except exception.Forbidden as e: + LOG.debug("User not permitted to delete metadata namespace " + "'%s'" % namespace) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -319,6 +328,8 @@ class NamespaceController(object): namespace_obj.delete() ns_repo.remove_objects(namespace_obj) except exception.Forbidden as e: + LOG.debug("User not permitted to delete metadata objects " + "within '%s' namespace" % namespace) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -333,6 +344,8 @@ class NamespaceController(object): namespace_obj.delete() ns_repo.remove_tags(namespace_obj) except exception.Forbidden as e: + LOG.debug("User not permitted to delete metadata tags " + "within '%s' namespace" % namespace) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -347,6 +360,8 @@ class NamespaceController(object): namespace_obj.delete() ns_repo.remove_properties(namespace_obj) except exception.Forbidden as e: + LOG.debug("User not permitted to delete metadata properties " + "within '%s' namespace" % namespace) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) diff --git a/glance/api/v2/metadef_objects.py b/glance/api/v2/metadef_objects.py index bad2c96e76..470220dd43 100644 --- a/glance/api/v2/metadef_objects.py +++ b/glance/api/v2/metadef_objects.py @@ -61,6 +61,8 @@ class MetadefObjectsController(object): object_repo.add(new_meta_object) except exception.Forbidden as e: + LOG.debug("User not permitted to create metadata object within " + "'%s' namespace" % namespace) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -90,6 +92,8 @@ class MetadefObjectsController(object): metadef_objects = MetadefObjects() metadef_objects.objects = object_list except exception.Forbidden as e: + LOG.debug("User not permitted to retrieve metadata objects within " + "'%s' namespace" % namespace) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -108,6 +112,8 @@ class MetadefObjectsController(object): get_object_href(namespace, metadef_object), self.obj_schema_link) except exception.Forbidden as e: + LOG.debug("User not permitted to show metadata object '%s' " + "within '%s' namespace" % (namespace, object_name)) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -130,6 +136,8 @@ class MetadefObjectsController(object): metadata_object.properties) updated_metadata_obj = meta_repo.save(metadef_object) except exception.Forbidden as e: + LOG.debug("User not permitted to update metadata object '%s' " + "within '%s' namespace " % (object_name, namespace)) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -150,6 +158,8 @@ class MetadefObjectsController(object): metadef_object.delete() meta_repo.remove(metadef_object) except exception.Forbidden as e: + LOG.debug("User not permitted to delete metadata object '%s' " + "within '%s' namespace" % (object_name, namespace)) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) diff --git a/glance/api/v2/metadef_properties.py b/glance/api/v2/metadef_properties.py index 0889e2cbec..a0ab9fa249 100644 --- a/glance/api/v2/metadef_properties.py +++ b/glance/api/v2/metadef_properties.py @@ -73,6 +73,8 @@ class NamespacePropertiesController(object): namespace_properties = PropertyTypes() namespace_properties.properties = property_list except exception.Forbidden as e: + LOG.debug("User not permitted to retrieve metadata properties " + "within '%s' namespace" % namespace) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -103,6 +105,8 @@ class NamespacePropertiesController(object): db_property = prop_repo.get(namespace, property_name) property = self._to_model(db_property) except exception.Forbidden as e: + LOG.debug("User not permitted to show metadata property '%s' " + "within '%s' namespace" % (property_name, namespace)) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -119,6 +123,8 @@ class NamespacePropertiesController(object): namespace=namespace, **self._to_dict(property_type)) prop_repo.add(new_property_type) except exception.Forbidden as e: + LOG.debug("User not permitted to create metadata property within " + "'%s' namespace" % namespace) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -138,6 +144,8 @@ class NamespacePropertiesController(object): db_property_type.schema = (self._to_dict(property_type))['schema'] updated_property_type = prop_repo.save(db_property_type) except exception.Forbidden as e: + LOG.debug("User not permitted to update metadata property '%s' " + "within '%s' namespace" % (property_name, namespace)) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -155,6 +163,8 @@ class NamespacePropertiesController(object): property_type.delete() prop_repo.remove(property_type) except exception.Forbidden as e: + LOG.debug("User not permitted to delete metadata property '%s' " + "within '%s' namespace" % (property_name, namespace)) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) diff --git a/glance/api/v2/metadef_resource_types.py b/glance/api/v2/metadef_resource_types.py index dd27004f3c..4fb9e90ff6 100644 --- a/glance/api/v2/metadef_resource_types.py +++ b/glance/api/v2/metadef_resource_types.py @@ -60,6 +60,8 @@ class ResourceTypeController(object): resource_types = ResourceTypes() resource_types.resource_types = resource_type_list except exception.Forbidden as e: + LOG.debug("User not permitted to retrieve metadata resource types " + "index") raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -80,6 +82,8 @@ class ResourceTypeController(object): resource_types = ResourceTypeAssociations() resource_types.resource_type_associations = resource_type_list except exception.Forbidden as e: + LOG.debug("User not permitted to retrieve metadata resource types " + "within '%s' namespace" % namespace) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -98,6 +102,8 @@ class ResourceTypeController(object): rs_type_repo.add(new_resource_type) except exception.Forbidden as e: + LOG.debug("User not permitted to create metadata resource type " + "within '%s' namespace" % namespace) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -123,6 +129,9 @@ class ResourceTypeController(object): if not found: raise exception.NotFound() except exception.Forbidden as e: + LOG.debug("User not permitted to delete metadata resource type " + "'%s' within '%s' namespace" % (resource_type, + namespace)) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: msg = (_("Failed to find resource type %(resourcetype)s to " diff --git a/glance/api/v2/metadef_tags.py b/glance/api/v2/metadef_tags.py index 74517dfc55..8c1252948f 100644 --- a/glance/api/v2/metadef_tags.py +++ b/glance/api/v2/metadef_tags.py @@ -60,6 +60,8 @@ class TagsController(object): **tag_name_as_dict) tag_repo.add(new_meta_tag) except exception.Forbidden as e: + LOG.debug("User not permitted to create metadata tag within " + "'%s' namespace" % namespace) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -85,6 +87,8 @@ class TagsController(object): metadef_tags = MetadefTags() metadef_tags.tags = tag_list_out except exception.Forbidden as e: + LOG.debug("User not permitted to create metadata tags within " + "'%s' namespace" % namespace) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -117,6 +121,8 @@ class TagsController(object): metadef_tags = MetadefTags() metadef_tags.tags = tag_list except exception.Forbidden as e: + LOG.debug("User not permitted to retrieve metadata tags " + "within '%s' namespace" % namespace) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -132,6 +138,8 @@ class TagsController(object): metadef_tag = meta_tag_repo.get(namespace, tag_name) return MetadefTag.to_wsme_model(metadef_tag) except exception.Forbidden as e: + LOG.debug("User not permitted to show metadata tag '%s' " + "within '%s' namespace" % (tag_name, namespace)) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -148,6 +156,8 @@ class TagsController(object): metadata_tag.name) updated_metadata_tag = meta_repo.save(metadef_tag) except exception.Forbidden as e: + LOG.debug("User not permitted to update metadata tag '%s' " + "within '%s' namespace" % (tag_name, namespace)) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -166,6 +176,8 @@ class TagsController(object): metadef_tag.delete() meta_repo.remove(metadef_tag) except exception.Forbidden as e: + LOG.debug("User not permitted to delete metadata tag '%s' " + "within '%s' namespace" % (tag_name, namespace)) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg)