Hugh Saunders bba6fa84a1 Revert "Add proper RBAC to Glance's policy.json" ...

This reverts commit 8f190b9121.

From Ian:
"So I spent most of today trying to figure out why Glance’s policy isn’t
working with the proposed glance policy changes for RBAC. I only was
just able to find (by adding tons of logging) the basic check is parsed
something like this

OrCheck
/     \
Role   GenericCheck

The RoleCheck is straight-forward and just works. Glance (in Juno) used
a very old and very hacky policy enforcement system that has been made a
lot better in oslo.policy (soon to be released). At the moment the
GenericCheck receives a target dictionary that is empty. So doing
something like tenant:%(tenant_id)s will return False immediately
because there is no tenant_id key in the dictionary passed in for the
target object (because it is empty). This seems to be a failure
somewhere along the line but I haven’t found it yet. Regardless, it
seems like the RBAC changes need to be reverted because there’s no
chance of them working until a new stable glance comes out with a fix."

So I spent most of today trying to figure out why Glance’s policy isn’t
working with the proposed glance policy changes for RBAC. I only was
just able to find (by adding tons of logging) the basic check is parsed
something like this.

Partial-bug: #1408363
Change-Id: I094050e5ea6e1daa94c2f933c222268654f5ef78

2015-01-15 10:16:48 +00:00

641 B

Raw Blame History

View Raw