openstack/heat
Code Issues Proposed changes

Implement secure RBAC

Browse Source 
This commit updates default policies to account for system scope
and default roles. This is part of a broader change to provide a
consistent and secure authorization experience across OpenStack
projects.

- Introduces basic/reusable check strings in base.py
- Implements secure RBAC for build info API
- Implements secure RBAC for the action API
- Implements secure RBAC for cloud formations
- Implements secure RBAC for events
- Implements secure RBAC for the resource API
- Implements secure RBAC for the service API
- Implements secure RBAC for software configs
- Implements secure RBAC for software deployments
- Implements secure RBAC for stacks
- Adds unit tests for legacy and new secure-rbac policies.

Change-Id: Iff1e39481ea3b1f00bd89dba4a00aed30334ecec
This commit is contained in:
Lance Bragstad 2020-12-01 20:03:33 +00:00 committed by ramishra
parent 8daa7e9389
commit 93594c30ec
24 changed files with 1214 additions and 213 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
heat/api/openstack/v1/util.py
View File

@ -29,12 +29,17 @@ def registered_policy_enforce(handler):
"""
@functools.wraps(handler)
def handle_stack_method(controller, req, tenant_id, **kwargs):
if req.context.tenant_id != tenant_id and not req.context.is_admin:
_target = {"project_id": tenant_id}
if req.context.tenant_id != tenant_id and not (
req.context.is_admin or
req.context.system_scope == all):
raise exc.HTTPForbidden()
allowed = req.context.policy.enforce(
context=req.context,
action=handler.__name__,
scope=controller.REQUEST_SCOPE,
target=_target,
is_registered_policy=True)
if not allowed:
raise exc.HTTPForbidden()

132
heat/policies/actions.py
View File

@ -10,29 +10,51 @@
# License for the specific language governing permissions and limitations
# under the License.
from oslo_log import versionutils
from oslo_policy import policy
from heat.policies import base
POLICY_ROOT = 'actions:%s'
DEPRECATED_REASON = """
The actions API now supports system scope and default roles.
"""
def _action_rule(action_name, description):
return policy.DocumentedRuleDefault(
name=POLICY_ROOT % action_name,
check_str='rule:%s' % (POLICY_ROOT % 'action'),
description=description,
operations=[{
'path': '/v1/{tenant_id}/stacks/{stack_name}/{stack_id}/actions',
'method': 'POST',
}]
)
deprecated_action = policy.DeprecatedRule(
name=POLICY_ROOT % 'action',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_snapshot = policy.DeprecatedRule(
name=POLICY_ROOT % 'snapshot',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_suspend = policy.DeprecatedRule(
name=POLICY_ROOT % 'suspend',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_resume = policy.DeprecatedRule(
name=POLICY_ROOT % 'resume',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_check = policy.DeprecatedRule(
name=POLICY_ROOT % 'check',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_cancel_update = policy.DeprecatedRule(
name=POLICY_ROOT % 'cancel_update',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_cancel_without_rollback = policy.DeprecatedRule(
name=POLICY_ROOT % 'cancel_without_rollback',
check_str=base.RULE_DENY_STACK_USER
)
actions_policies = [
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'action',
check_str=base.RULE_DENY_STACK_USER,
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,
description='Performs non-lifecycle operations on the stack '
'(Snapshot, Resume, Cancel update, or check stack resources). '
'This is the default for all actions but can be overridden by more '
@ -41,14 +63,88 @@ actions_policies = [
'path': '/v1/{tenant_id}/stacks/{stack_name}/{stack_id}/actions',
'method': 'POST',
}],
deprecated_rule=deprecated_action,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
_action_rule('snapshot', 'Create stack snapshot.'),
_action_rule('suspend', 'Suspend a stack.'),
_action_rule('resume', 'Resume a suspended stack.'),
_action_rule('check', 'Check stack resources.'),
_action_rule('cancel_update', 'Cancel stack operation and roll back.'),
_action_rule('cancel_without_rollback',
'Cancel stack operation without rolling back.'),
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'snapshot',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'],
description='Create stack snapshot',
operations=[{
'path': '/v1/{tenant_id}/stacks/{stack_name}/{stack_id}/actions',
'method': 'POST',
}],
deprecated_rule=deprecated_snapshot,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'suspend',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'],
description='Suspend a stack.',
operations=[{
'path': '/v1/{tenant_id}/stacks/{stack_name}/{stack_id}/actions',
'method': 'POST',
}],
deprecated_rule=deprecated_suspend,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'resume',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'],
description='Resume a suspended stack.',
operations=[{
'path': '/v1/{tenant_id}/stacks/{stack_name}/{stack_id}/actions',
'method': 'POST',
}],
deprecated_rule=deprecated_resume,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'check',
check_str=base.SYSTEM_OR_PROJECT_READER,
scope_types=['system', 'project'],
description='Check stack resources.',
operations=[{
'path': '/v1/{tenant_id}/stacks/{stack_name}/{stack_id}/actions',
'method': 'POST',
}],
deprecated_rule=deprecated_check,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'cancel_update',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'],
description='Cancel stack operation and roll back.',
operations=[{
'path': '/v1/{tenant_id}/stacks/{stack_name}/{stack_id}/actions',
'method': 'POST',
}],
deprecated_rule=deprecated_cancel_update,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'cancel_without_rollback',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'],
description='Cancel stack operation without rolling back.',
operations=[{
'path': '/v1/{tenant_id}/stacks/{stack_name}/{stack_id}/actions',
'method': 'POST',
}],
deprecated_rule=deprecated_cancel_without_rollback,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
)
]

36
heat/policies/base.py
View File

@ -18,11 +18,45 @@ RULE_DENY_STACK_USER = 'rule:deny_stack_user'
RULE_DENY_EVERYBODY = 'rule:deny_everybody'
RULE_ALLOW_EVERYBODY = 'rule:allow_everybody'
# Check strings that embody common personas
SYSTEM_ADMIN = 'role:admin and system_scope:all'
SYSTEM_READER = 'role:reader and system_scope:all'
PROJECT_MEMBER = 'role:member and project_id:%(project_id)s'
PROJECT_READER = 'role:reader and project_id:%(project_id)s'
# Heat personas
PROJECT_ADMIN = 'role:admin and project_id:%(project_id)s'
PROJECT_STACK_USER = 'role:heat_stack_user and project_id:%(project_id)s'
# Composite check strings that are useful for policies that protect APIs that
# operate at different scopes.
SYSTEM_ADMIN_OR_PROJECT_MEMBER = (
'(' + SYSTEM_ADMIN + ')'
' or (' + PROJECT_MEMBER + ')'
)
SYSTEM_OR_PROJECT_READER = (
'(' + SYSTEM_READER + ')'
' or (' + PROJECT_READER + ')'
)
SYSTEM_ADMIN_OR_PROJECT_MEMBER_OR_STACK_USER = (
'(' + SYSTEM_ADMIN + ')'
' or (' + PROJECT_MEMBER + ')'
' or (' + PROJECT_STACK_USER + ')'
)
SYSTEM_OR_PROJECT_READER_OR_STACK_USER = (
'(' + SYSTEM_READER + ')'
' or (' + PROJECT_READER + ')'
' or (' + PROJECT_STACK_USER + ')'
)
rules = [
policy.RuleDefault(
name="context_is_admin",
check_str="role:admin and is_admin_project:True",
check_str=(
"(role:admin and is_admin_project:True) OR "
"(" + SYSTEM_ADMIN + ")"
),
description="Decides what is required for the 'is_admin:True' check "
"to succeed."),
policy.RuleDefault(

19
heat/policies/build_info.py
View File

@ -10,23 +10,38 @@
# License for the specific language governing permissions and limitations
# under the License.
from oslo_log import versionutils
from oslo_policy import policy
from heat.policies import base
DEPRECATED_REASON = """
The build API now supports system scope and default roles.
"""
POLICY_ROOT = 'build_info:%s'
deprecated_build_info = policy.DeprecatedRule(
name=POLICY_ROOT % 'build_info',
check_str=base.RULE_DENY_STACK_USER
)
build_info_policies = [
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'build_info',
check_str=base.RULE_DENY_STACK_USER,
check_str=base.SYSTEM_OR_PROJECT_READER,
scope_types=['system', 'project'],
description='Show build information.',
operations=[
{
'path': '/v1/{tenant_id}/build_info',
'method': 'GET'
}
]
],
deprecated_rule=deprecated_build_info,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
)
]

149
heat/policies/cloudformation.py
View File

@ -10,6 +10,7 @@
# License for the specific language governing permissions and limitations
# under the License.
from oslo_log import versionutils
from oslo_policy import policy
from heat.policies import base
@ -17,48 +18,170 @@ from heat.policies import base
# These policies are for AWS CloudFormation-like APIs, so we won't list out
# the URI paths in rules.
DEPRECATED_REASON = """
The cloud formation API now supports system scope and default roles.
"""
POLICY_ROOT = 'cloudformation:%s'
deprecated_list_stacks = policy.DeprecatedRule(
name=POLICY_ROOT % 'ListStacks',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_create_stack = policy.DeprecatedRule(
name=POLICY_ROOT % 'CreateStack',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_describe_stacks = policy.DeprecatedRule(
name=POLICY_ROOT % 'DescribeStacks',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_delete_stack = policy.DeprecatedRule(
name=POLICY_ROOT % 'DeleteStack',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_update_stack = policy.DeprecatedRule(
name=POLICY_ROOT % 'UpdateStack',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_cancel_update_stack = policy.DeprecatedRule(
name=POLICY_ROOT % 'CancelUpdateStack',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_describe_stack_events = policy.DeprecatedRule(
name=POLICY_ROOT % 'DescribeStackEvents',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_validate_template = policy.DeprecatedRule(
name=POLICY_ROOT % 'ValidateTemplate',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_get_template = policy.DeprecatedRule(
name=POLICY_ROOT % 'GetTemplate',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_estimate_template_cost = policy.DeprecatedRule(
name=POLICY_ROOT % 'EstimateTemplateCost',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_describe_stack_resource = policy.DeprecatedRule(
name=POLICY_ROOT % 'DescribeStackResource',
check_str=base.RULE_ALLOW_EVERYBODY
)
deprecated_describe_stack_resources = policy.DeprecatedRule(
name=POLICY_ROOT % 'DescribeStackResources',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_list_stack_resources = policy.DeprecatedRule(
name=POLICY_ROOT % 'ListStackResources',
check_str=base.RULE_DENY_STACK_USER
)
cloudformation_policies = [
policy.RuleDefault(
name=POLICY_ROOT % 'ListStacks',
check_str=base.RULE_DENY_STACK_USER),
check_str=base.SYSTEM_OR_PROJECT_READER,
scope_types=['system', 'project'],
deprecated_rule=deprecated_list_stacks,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.RuleDefault(
name=POLICY_ROOT % 'CreateStack',
check_str=base.RULE_DENY_STACK_USER),
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'],
deprecated_rule=deprecated_create_stack,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.RuleDefault(
name=POLICY_ROOT % 'DescribeStacks',
check_str=base.RULE_DENY_STACK_USER),
check_str=base.SYSTEM_OR_PROJECT_READER,
scope_types=['system', 'project'],
deprecated_rule=deprecated_describe_stacks,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.RuleDefault(
name=POLICY_ROOT % 'DeleteStack',
check_str=base.RULE_DENY_STACK_USER),
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'],
deprecated_rule=deprecated_delete_stack,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.RuleDefault(
name=POLICY_ROOT % 'UpdateStack',
check_str=base.RULE_DENY_STACK_USER),
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'],
deprecated_rule=deprecated_update_stack,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.RuleDefault(
name=POLICY_ROOT % 'CancelUpdateStack',
check_str=base.RULE_DENY_STACK_USER),
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'],
deprecated_rule=deprecated_cancel_update_stack,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.RuleDefault(
name=POLICY_ROOT % 'DescribeStackEvents',
check_str=base.RULE_DENY_STACK_USER),
check_str=base.SYSTEM_OR_PROJECT_READER,
scope_types=['system', 'project'],
deprecated_rule=deprecated_describe_stack_events,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.RuleDefault(
name=POLICY_ROOT % 'ValidateTemplate',
check_str=base.RULE_DENY_STACK_USER),
check_str=base.SYSTEM_OR_PROJECT_READER,
scope_types=['system', 'project'],
deprecated_rule=deprecated_validate_template,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.RuleDefault(
name=POLICY_ROOT % 'GetTemplate',
check_str=base.RULE_DENY_STACK_USER),
check_str=base.SYSTEM_OR_PROJECT_READER,
scope_types=['system', 'project'],
deprecated_rule=deprecated_get_template,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.RuleDefault(
name=POLICY_ROOT % 'EstimateTemplateCost',
check_str=base.RULE_DENY_STACK_USER),
check_str=base.SYSTEM_OR_PROJECT_READER,
scope_types=['system', 'project'],
deprecated_rule=deprecated_estimate_template_cost,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.RuleDefault(
name=POLICY_ROOT % 'DescribeStackResource',
check_str=base.RULE_ALLOW_EVERYBODY),
check_str=base.SYSTEM_OR_PROJECT_READER_OR_STACK_USER,
scope_types=['system', 'project'],
deprecated_rule=deprecated_describe_stack_resource,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.RuleDefault(
name=POLICY_ROOT % 'DescribeStackResources',
check_str=base.RULE_DENY_STACK_USER),
check_str=base.SYSTEM_OR_PROJECT_READER,
scope_types=['system', 'project'],
deprecated_rule=deprecated_describe_stack_resources,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.RuleDefault(
name=POLICY_ROOT % 'ListStackResources',
check_str=base.RULE_DENY_STACK_USER)
check_str=base.SYSTEM_OR_PROJECT_READER,
scope_types=['system', 'project'],
deprecated_rule=deprecated_list_stack_resources,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
)
]

31
heat/policies/events.py
View File

@ -10,16 +10,32 @@
# License for the specific language governing permissions and limitations
# under the License.
from oslo_log import versionutils
from oslo_policy import policy
from heat.policies import base
POLICY_ROOT = 'events:%s'
DEPRECATED_REASON = """
The events API now supports system scope and default roles.
"""
deprecated_index = policy.DeprecatedRule(
name=POLICY_ROOT % 'index',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_show = policy.DeprecatedRule(
name=POLICY_ROOT % 'show',
check_str=base.RULE_DENY_STACK_USER
)
events_policies = [
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'index',
check_str=base.RULE_DENY_STACK_USER,
check_str=base.SYSTEM_OR_PROJECT_READER,
scope_types=['system', 'project'],
description='List events.',
operations=[
{
@ -27,11 +43,15 @@ events_policies = [
'events',
'method': 'GET'
}
]
],
deprecated_rule=deprecated_index,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'show',
check_str=base.RULE_DENY_STACK_USER,
check_str=base.SYSTEM_OR_PROJECT_READER,
scope_types=['system', 'project'],
description='Show event.',
operations=[
{
@ -39,7 +59,10 @@ events_policies = [
'resources/{resource_name}/events/{event_id}',
'method': 'GET'
}
]
],
deprecated_rule=deprecated_show,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
)
]

66
heat/policies/resource.py
View File

@ -10,16 +10,43 @@
# License for the specific language governing permissions and limitations
# under the License.
from oslo_log import versionutils
from oslo_policy import policy
from heat.policies import base
POLICY_ROOT = 'resource:%s'
DEPRECATED_REASON = """
The resources API now supports system scope and default roles.
"""
deprecated_list_resources = policy.DeprecatedRule(
name=POLICY_ROOT % 'index',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_mark_unhealthy = policy.DeprecatedRule(
name=POLICY_ROOT % 'mark_unhealthy',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_show_resource = policy.DeprecatedRule(
name=POLICY_ROOT % 'show',
check_str=base.RULE_DENY_STACK_USER,
)
deprecated_metadata = policy.DeprecatedRule(
name=POLICY_ROOT % 'metadata',
check_str=base.RULE_ALLOW_EVERYBODY,
)
deprecated_signal = policy.DeprecatedRule(
name=POLICY_ROOT % 'signal',
check_str=base.RULE_ALLOW_EVERYBODY,
)
resource_policies = [
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'index',
check_str=base.RULE_DENY_STACK_USER,
check_str=base.SYSTEM_OR_PROJECT_READER,
scope_types=['system', 'project'],
description='List resources.',
operations=[
{
@ -27,11 +54,15 @@ resource_policies = [
'resources',
'method': 'GET'
}
]
],
deprecated_rule=deprecated_list_resources,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'metadata',
check_str=base.RULE_ALLOW_EVERYBODY,
check_str=base.SYSTEM_OR_PROJECT_READER_OR_STACK_USER,
scope_types=['system', 'project'],
description='Show resource metadata.',
operations=[
{
@ -39,11 +70,15 @@ resource_policies = [
'resources/{resource_name}/metadata',
'method': 'GET'
}
]
],
deprecated_rule=deprecated_metadata,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'signal',
check_str=base.RULE_ALLOW_EVERYBODY,
check_str=base.SYSTEM_OR_PROJECT_READER_OR_STACK_USER,
scope_types=['system', 'project'],
description='Signal resource.',
operations=[
{
@ -51,11 +86,15 @@ resource_policies = [
'resources/{resource_name}/signal',
'method': 'POST'
}
]
],
deprecated_rule=deprecated_signal,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'mark_unhealthy',
check_str=base.RULE_DENY_STACK_USER,
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'],
description='Mark resource as unhealthy.',
operations=[
{
@ -63,11 +102,15 @@ resource_policies = [
'resources/{resource_name_or_physical_id}',
'method': 'PATCH'
}
]
],
deprecated_rule=deprecated_mark_unhealthy,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'show',
check_str=base.RULE_DENY_STACK_USER,
check_str=base.SYSTEM_OR_PROJECT_READER,
scope_types=['system', 'project'],
description='Show resource.',
operations=[
{
@ -75,7 +118,10 @@ resource_policies = [
'resources/{resource_name}',
'method': 'GET'
}
]
],
deprecated_rule=deprecated_show_resource,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
)
]

16
heat/policies/service.py
View File

@ -10,16 +10,30 @@
# License for the specific language governing permissions and limitations
# under the License.
from oslo_log import versionutils
from oslo_policy import policy
from heat.policies import base
DEPRECATED_REASON = """
The service API now supports system scope and default roles.
"""
POLICY_ROOT = 'service:%s'
deprecated_index = policy.DeprecatedRule(
name=POLICY_ROOT % 'index',
check_str=base.RULE_CONTEXT_IS_ADMIN
)
service_policies = [
policy.RuleDefault(
name=POLICY_ROOT % 'index',
check_str=base.RULE_CONTEXT_IS_ADMIN)
check_str=base.SYSTEM_READER,
deprecated_rule=deprecated_index,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
)
]

66
heat/policies/software_configs.py
View File

@ -10,67 +10,113 @@
# License for the specific language governing permissions and limitations
# under the License.
from oslo_log import versionutils
from oslo_policy import policy
from heat.policies import base
DEPRECATED_REASON = """
The software configuration API now support system scope and default roles.
"""
POLICY_ROOT = 'software_configs:%s'
deprecated_global_index = policy.DeprecatedRule(
name=POLICY_ROOT % 'global_index',
check_str=base.RULE_DENY_EVERYBODY
)
deprecated_index = policy.DeprecatedRule(
name=POLICY_ROOT % 'index',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_create = policy.DeprecatedRule(
name=POLICY_ROOT % 'create',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_show = policy.DeprecatedRule(
name=POLICY_ROOT % 'show',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_delete = policy.DeprecatedRule(
name=POLICY_ROOT % 'delete',
check_str=base.RULE_DENY_STACK_USER
)
software_configs_policies = [
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'global_index',
check_str=base.RULE_DENY_EVERYBODY,
check_str=base.SYSTEM_READER,
scope_types=['system', 'project'],
description='List configs globally.',
operations=[
{
'path': '/v1/{tenant_id}/software_configs',
'method': 'GET'
}
]
],
deprecated_rule=deprecated_global_index,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'index',
check_str=base.RULE_DENY_STACK_USER,
check_str=base.SYSTEM_OR_PROJECT_READER,
scope_types=['system', 'project'],
description='List configs.',
operations=[
{
'path': '/v1/{tenant_id}/software_configs',
'method': 'GET'
}
]
],
deprecated_rule=deprecated_index,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'create',
check_str=base.RULE_DENY_STACK_USER,
check_str=base.SYSTEM_OR_PROJECT_READER,
scope_types=['system', 'project'],
description='Create config.',
operations=[
{
'path': '/v1/{tenant_id}/software_configs',
'method': 'POST'
}
]
],
deprecated_rule=deprecated_create,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'show',
check_str=base.RULE_DENY_STACK_USER,
check_str=base.SYSTEM_OR_PROJECT_READER,
scope_types=['system', 'project'],
description='Show config details.',
operations=[
{
'path': '/v1/{tenant_id}/software_configs/{config_id}',
'method': 'GET'
}
]
],
deprecated_rule=deprecated_show,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'delete',
check_str=base.RULE_DENY_STACK_USER,
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'],
description='Delete config.',
operations=[
{
'path': '/v1/{tenant_id}/software_configs/{config_id}',
'method': 'DELETE'
}
]
],
deprecated_rule=deprecated_delete,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
)
]

70
heat/policies/software_deployments.py
View File

@ -10,71 +10,119 @@
# License for the specific language governing permissions and limitations
# under the License.
from oslo_log import versionutils
from oslo_policy import policy
from heat.policies import base
DEPRECATED_REASON = """
The software deployment API now supports system scope and default roles.
"""
POLICY_ROOT = 'software_deployments:%s'
deprecated_index = policy.DeprecatedRule(
name=POLICY_ROOT % 'index',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_create = policy.DeprecatedRule(
name=POLICY_ROOT % 'create',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_show = policy.DeprecatedRule(
name=POLICY_ROOT % 'show',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_update = policy.DeprecatedRule(
name=POLICY_ROOT % 'update',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_delete = policy.DeprecatedRule(
name=POLICY_ROOT % 'delete',
check_str=base.RULE_DENY_STACK_USER
)
software_deployments_policies = [
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'index',
check_str=base.RULE_DENY_STACK_USER,
check_str=base.SYSTEM_OR_PROJECT_READER,
scope_types=['system', 'project'],
description='List deployments.',
operations=[
{
'path': '/v1/{tenant_id}/software_deployments',
'method': 'GET'
}
]
],
deprecated_rule=deprecated_index,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'create',
check_str=base.RULE_DENY_STACK_USER,
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'],
description='Create deployment.',
operations=[
{
'path': '/v1/{tenant_id}/software_deployments',
'method': 'POST'
}
]
],
deprecated_rule=deprecated_create,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'show',
check_str=base.RULE_DENY_STACK_USER,
check_str=base.SYSTEM_OR_PROJECT_READER,
scope_types=['system', 'project'],
description='Show deployment details.',
operations=[
{
'path': '/v1/{tenant_id}/software_deployments/{deployment_id}',
'method': 'GET'
}
]
],
deprecated_rule=deprecated_show,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'update',
check_str=base.RULE_DENY_STACK_USER,
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'],
description='Update deployment.',
operations=[
{
'path': '/v1/{tenant_id}/software_deployments/{deployment_id}',
'method': 'PUT'
}
]
],
deprecated_rule=deprecated_update,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'delete',
check_str=base.RULE_DENY_STACK_USER,
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'],
description='Delete deployment.',
operations=[
{
'path': '/v1/{tenant_id}/software_deployments/{deployment_id}',
'method': 'DELETE'
}
]
],
deprecated_rule=deprecated_delete,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'metadata',
check_str=base.RULE_ALLOW_EVERYBODY,
check_str=base.SYSTEM_OR_PROJECT_READER_OR_STACK_USER,
scope_types=['system', 'project'],
description='Show server configuration metadata.',
operations=[
{

367
heat/policies/stacks.py
View File

@ -10,16 +10,144 @@
# License for the specific language governing permissions and limitations
# under the License.
from oslo_log import versionutils
from oslo_policy import policy
from heat.policies import base
DEPRECATED_REASON = """
The stack API now supports system scope and default roles.
"""
POLICY_ROOT = 'stacks:%s'
deprecated_abandon = policy.DeprecatedRule(
name=POLICY_ROOT % 'abandon',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_create = policy.DeprecatedRule(
name=POLICY_ROOT % 'create',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_delete = policy.DeprecatedRule(
name=POLICY_ROOT % 'delete',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_detail = policy.DeprecatedRule(
name=POLICY_ROOT % 'detail',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_export = policy.DeprecatedRule(
name=POLICY_ROOT % 'export',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_generate_template = policy.DeprecatedRule(
name=POLICY_ROOT % 'generate_template',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_global_index = policy.DeprecatedRule(
name=POLICY_ROOT % 'global_index',
check_str=base.RULE_DENY_EVERYBODY
)
deprecated_index = policy.DeprecatedRule(
name=POLICY_ROOT % 'index',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_list_resource_types = policy.DeprecatedRule(
name=POLICY_ROOT % 'list_resource_types',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_list_template_versions = policy.DeprecatedRule(
name=POLICY_ROOT % 'list_template_versions',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_list_template_functions = policy.DeprecatedRule(
name=POLICY_ROOT % 'list_template_functions',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_preview = policy.DeprecatedRule(
name=POLICY_ROOT % 'preview',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_resource_schema = policy.DeprecatedRule(
name=POLICY_ROOT % 'resource_schema',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_show = policy.DeprecatedRule(
name=POLICY_ROOT % 'show',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_template = policy.DeprecatedRule(
name=POLICY_ROOT % 'template',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_environment = policy.DeprecatedRule(
name=POLICY_ROOT % 'environment',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_files = policy.DeprecatedRule(
name=POLICY_ROOT % 'files',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_update = policy.DeprecatedRule(
name=POLICY_ROOT % 'update',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_update_patch = policy.DeprecatedRule(
name=POLICY_ROOT % 'update_patch',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_preview_update = policy.DeprecatedRule(
name=POLICY_ROOT % 'preview_update',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_preview_update_patch = policy.DeprecatedRule(
name=POLICY_ROOT % 'preview_update_patch',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_validate_template = policy.DeprecatedRule(
name=POLICY_ROOT % 'validate_template',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_snapshot = policy.DeprecatedRule(
name=POLICY_ROOT % 'snapshot',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_show_snapshot = policy.DeprecatedRule(
name=POLICY_ROOT % 'show_snapshot',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_delete_snapshot = policy.DeprecatedRule(
name=POLICY_ROOT % 'delete_snapshot',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_list_snapshots = policy.DeprecatedRule(
name=POLICY_ROOT % 'list_snapshots',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_restore_snapshot = policy.DeprecatedRule(
name=POLICY_ROOT % 'restore_snapshot',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_list_outputs = policy.DeprecatedRule(
name=POLICY_ROOT % 'list_outputs',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_show_output = policy.DeprecatedRule(
name=POLICY_ROOT % 'show_output',
check_str=base.RULE_DENY_STACK_USER
)
deprecated_lookup = policy.DeprecatedRule(
name=POLICY_ROOT % 'lookup',
check_str=base.RULE_ALLOW_EVERYBODY
)
stacks_policies = [
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'abandon',
check_str=base.RULE_DENY_STACK_USER,
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'],
description='Abandon stack.',
operations=[
{
@ -27,44 +155,60 @@ stacks_policies = [
'abandon',
'method': 'DELETE'
}
]
],
deprecated_rule=deprecated_abandon,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'create',
check_str=base.RULE_DENY_STACK_USER,
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'],
description='Create stack.',
operations=[
{
'path': '/v1/{tenant_id}/stacks',
'method': 'POST'
}
]
],
deprecated_rule=deprecated_create,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'delete',
check_str=base.RULE_DENY_STACK_USER,
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'],
description='Delete stack.',
operations=[
{
'path': '/v1/{tenant_id}/stacks/{stack_name}/{stack_id}',
'method': 'DELETE'
}
]
],
deprecated_rule=deprecated_delete,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'detail',
check_str=base.RULE_DENY_STACK_USER,
check_str=base.SYSTEM_OR_PROJECT_READER,
scope_types=['system', 'project'],
description='List stacks in detail.',
operations=[
{
'path': '/v1/{tenant_id}/stacks',
'method': 'GET'
}
]
],
deprecated_rule=deprecated_detail,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'export',
check_str=base.RULE_DENY_STACK_USER,
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'],
description='Export stack.',
operations=[
{
@ -72,11 +216,15 @@ stacks_policies = [
'export',
'method': 'GET'
}
]
],
deprecated_rule=deprecated_export,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'generate_template',
check_str=base.RULE_DENY_STACK_USER,
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'],
description='Generate stack template.',
operations=[
{
@ -84,55 +232,75 @@ stacks_policies = [
'template',
'method': 'GET'
}
]
],
deprecated_rule=deprecated_generate_template,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'global_index',
check_str=base.RULE_DENY_EVERYBODY,
check_str=base.SYSTEM_READER,
scope_types=['system', 'project'],
description='List stacks globally.',
operations=[
{
'path': '/v1/{tenant_id}/stacks',
'method': 'GET'
}
]
],
deprecated_rule=deprecated_global_index,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'index',
check_str=base.RULE_DENY_STACK_USER,
check_str=base.SYSTEM_OR_PROJECT_READER,
scope_types=['system', 'project'],
description='List stacks.',
operations=[
{
'path': '/v1/{tenant_id}/stacks',
'method': 'GET'
}
]
],
deprecated_rule=deprecated_index,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'list_resource_types',
check_str=base.RULE_DENY_STACK_USER,
check_str=base.SYSTEM_OR_PROJECT_READER,
scope_types=['system', 'project'],
description='List resource types.',
operations=[
{
'path': '/v1/{tenant_id}/resource_types',
'method': 'GET'
}
]
],
deprecated_rule=deprecated_list_resource_types,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'list_template_versions',
check_str=base.RULE_DENY_STACK_USER,
check_str=base.SYSTEM_OR_PROJECT_READER,
scope_types=['system', 'project'],
description='List template versions.',
operations=[
{
'path': '/v1/{tenant_id}/template_versions',
'method': 'GET'
}
]
],
deprecated_rule=deprecated_list_template_versions,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'list_template_functions',
check_str=base.RULE_DENY_STACK_USER,
check_str=base.SYSTEM_OR_PROJECT_READER,
scope_types=['system', 'project'],
description='List template functions.',
operations=[
{
@ -140,55 +308,75 @@ stacks_policies = [
'{template_version}/functions',
'method': 'GET'
}
]
],
deprecated_rule=deprecated_list_template_functions,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'lookup',
check_str=base.RULE_ALLOW_EVERYBODY,
check_str=base.SYSTEM_OR_PROJECT_READER_OR_STACK_USER,
scope_types=['system', 'project'],
description='Find stack.',
operations=[
{
'path': '/v1/{tenant_id}/stacks/{stack_identity}',
'method': 'GET'
}
]
],
deprecated_rule=deprecated_lookup,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'preview',
check_str=base.RULE_DENY_STACK_USER,
check_str=base.SYSTEM_OR_PROJECT_READER,
scope_types=['system', 'project'],
description='Preview stack.',
operations=[
{
'path': '/v1/{tenant_id}/stacks/preview',
'method': 'POST'
}
]
],
deprecated_rule=deprecated_preview,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'resource_schema',
check_str=base.RULE_DENY_STACK_USER,
check_str=base.SYSTEM_OR_PROJECT_READER,
scope_types=['system', 'project'],
description='Show resource type schema.',
operations=[
{
'path': '/v1/{tenant_id}/resource_types/{type_name}',
'method': 'GET'
}
]
],
deprecated_rule=deprecated_resource_schema,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'show',
check_str=base.RULE_DENY_STACK_USER,
check_str=base.SYSTEM_OR_PROJECT_READER,
scope_types=['system', 'project'],
description='Show stack.',
operations=[
{
'path': '/v1/{tenant_id}/stacks/{stack_identity}',
'method': 'GET'
}
]
],
deprecated_rule=deprecated_show,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'template',
check_str=base.RULE_DENY_STACK_USER,
check_str=base.SYSTEM_OR_PROJECT_READER,
scope_types=['system', 'project'],
description='Get stack template.',
operations=[
{
@ -196,11 +384,15 @@ stacks_policies = [
'template',
'method': 'GET'
}
]
],
deprecated_rule=deprecated_template,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'environment',
check_str=base.RULE_DENY_STACK_USER,
check_str=base.SYSTEM_OR_PROJECT_READER,
scope_types=['system', 'project'],
description='Get stack environment.',
operations=[
{
@ -208,11 +400,15 @@ stacks_policies = [
'environment',
'method': 'GET'
}
]
],
deprecated_rule=deprecated_environment,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'files',
check_str=base.RULE_DENY_STACK_USER,
check_str=base.SYSTEM_OR_PROJECT_READER,
scope_types=['system', 'project'],
description='Get stack files.',
operations=[
{
@ -220,33 +416,45 @@ stacks_policies = [
'files',
'method': 'GET'
}
]
],
deprecated_rule=deprecated_files,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'update',
check_str=base.RULE_DENY_STACK_USER,
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'],
description='Update stack.',
operations=[