openstack/glance
Code Issues Proposed changes
OpenStack Image Management (Glance)
3,706 Commits 11 Branches 55 Tags 129 MiB
Python 99.9%
0656386e99
Go to file
Abhishek Kekane 0656386e99 Restrict users from downloading protected image 
Added new rule in policy.json and applied that rule to
'download_image' policy.

For example,
"restricted": "not ('test_key':(test_key)s and role:_member_)"
"download_image": "role:admin or rule:restricted"

So if 'download_image' policy is enforced then in above case only admin or
user who satisfies rule 'restricted' will able to download image. Other users
will not be able to download the image and will get 403 Forbidden response.

In addition, delete property access should be restricted for other users
so that they will not be able to delete the property of the image.

[test_key]
create = admin,member
read = admin,member,_member_
update = admin,member
delete = admin,member

Added new method to create dictionary-like mashup of image core and custom
properties.
Modified v1 and v2 api to add download restriction.
Modified logic of caching to restrict download for v1 and v2 api.

DocImpact:
Need to add new rule in policy.json
"restricted": "not ('test_key':%(test_key)s and role:_member_)"

blueprint: restrict-downloading-images-protected-properties

Change-Id: I05bad0441952150bd15b831ac1b1a0bb9ae79c74
2014-08-28 13:58:32 +00:00
doc/source Integrate OSprofiler and Glance 2014-08-07 21:05:16 +08:00
etc Improve Glance profiling 2014-08-24 03:58:03 +04:00
glance Restrict users from downloading protected image 2014-08-28 13:58:32 +00:00
rally-scenarios Fix rally performance job in glance 2014-08-08 02:57:58 +04:00
tools Merge "colorizer: use staticmethod rather than classmethod" 2014-06-19 18:06:40 +00:00
.coveragerc Update .coveragerc 2013-02-06 16:47:06 +02:00
.gitignore Switch to testrepository for running tests 2014-01-29 08:30:55 +08:00
.gitreview Add .gitreview config file for gerrit. 2011-10-24 11:02:16 -04:00
.mailmap Add a mailmap entry for myself 2014-02-11 12:00:44 +08:00
.testr.conf Switch to testrepository for running tests 2014-01-29 08:30:55 +08:00
babel.cfg Added first step of babel-based translations. 2012-02-28 02:00:37 -08:00
CONTRIBUTING.rst Add CONTRIBUTING.rst 2014-07-01 09:32:54 +08:00
HACKING.rst Add hacking checks 2014-06-10 02:06:56 +00:00
LICENSE Add a LICENSE file. 2012-01-03 10:14:01 -05:00
MANIFEST.in Update version code from oslo. 2013-01-13 14:27:48 -08:00
openstack-common.conf Move to oslo.db 2014-07-21 12:31:10 +03:00
pylintrc Packaging fixups 2010-10-21 15:51:44 -04:00
README.rst Replace README with links to better docs 2012-09-20 09:33:40 -07:00
requirements.txt Bump osprofiler requirement to 0.3.0 2014-08-09 00:23:19 +09:00
run_tests.sh Fix Jenkins translation jobs 2014-04-03 20:13:12 +02:00
setup.cfg Open Juno development 2014-04-01 09:16:36 -07:00
setup.py Updated from global requirements 2014-06-19 13:54:45 -04:00
test-requirements.txt Updated from global requirements 2014-06-19 13:54:45 -04:00
tox.ini Enable F821 check: undefined name 'name' 2014-07-23 16:28:24 +04:00

README.rst

Glance

Glance is a project that defines services for discovering, registering, retrieving and storing virtual machine images. Use the following resources to learn more: