Forbidden 403 error while get public image from multitenant swift storage where object is chunked (larger than 5GB)

[Malyshev Alex]

How to reproduce:
1. Use multitenant swift store for glance.
2. Create a public image larger than 5GB.
3. Launch instance with this image from another tenant.

How to fix:
For chunked object not enough just ".r:*" acl permission for public image, we must also set ".rlistings" permission on container.

Simple, in glance/store/swift.py (class MultiTenantStore, def set_acls),
if public:
            headers['X-Container-Read'] = ".r:*,.rlistings"
 (may be, something this we must add for read_tenants acls)

[Iccha Sethi (iccha-sethi)]

Hey Malyshev,

I was wondering if the container contained other images apart from that public image, would .rlisting allow the user to be able to list those other images as well?

[Malyshev Alex (malyshevalex)]

Of course, if .rlisting allowed, user may list all of objects in container.
However, by default, glance creates separate container for each image in multitenant mode.

[Iccha Sethi (iccha-sethi)]

Malyshev, thanks for clarifying my question. Is it a config value which determines separate containers for each image in multitenant or the code? Asking because if it is config, then different deployments may have it set differently. I am just trying to understand if this would have any alternative consequences here.

[Malyshev Alex (malyshevalex)]

It's a code. You may see it in glance/store/swift.py (class MultiTenantStore, def create_location):
    def create_location(self, image_id):
        specs = {'scheme': self.scheme,
                 'container': self.container + '_' + str(image_id),
                 'obj': str(image_id),
                 'auth_or_store_url': self.storage_url}
        return StoreLocation(specs)

Since image_id is unique, then each image is created a separate container.

[Iccha Sethi (iccha-sethi)]

Thanks for clarifying, it all makes sense now.

[Flavio Percoco (flaper87)]

Malyshev, Would you like to submit a patch for this?

Thanks for the report!

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/27619

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/27619
Committed: http://github.com/openstack/glance/commit/2d492e04be9e386e402ddde248d9a55c8d04a2bb
Submitter: Jenkins
Branch: master

commit 2d492e04be9e386e402ddde248d9a55c8d04a2bb
Author: Flaper Fesp <email address hidden>
Date: Sat Apr 27 12:37:13 2013 +0200

    Don't raise HTTPForbidden on a multitenant environment

    When getting public images in a multi-tenant environment, Swift raises
    HTTPForbidden for chuncked images.

    Based on swift documentation, rlistings directive turns listings on,
    which is the desired behavior in this case.

    Fixes bug 1170156

    Change-Id: I149f702d5b3ebae73b04deed4809939ab43c6adc

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/grizzly
Review: https://review.openstack.org/28275

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/28275
Committed: http://github.com/openstack/glance/commit/0c98014fd7cbfbb9ef4b6e8b5ae43b3dc7541d29
Submitter: Jenkins
Branch: stable/grizzly

commit 0c98014fd7cbfbb9ef4b6e8b5ae43b3dc7541d29
Author: Flaper Fesp <email address hidden>
Date: Sat Apr 27 12:37:13 2013 +0200

    Don't raise HTTPForbidden on a multitenant environment

    When getting public images in a multi-tenant environment, Swift raises
    HTTPForbidden for chuncked images.

    Based on swift documentation, rlistings directive turns listings on,
    which is the desired behavior in this case.

    Fixes bug 1170156

    NOTE: Swift guys where consulted about this fix.

    Change-Id: I149f702d5b3ebae73b04deed4809939ab43c6adc
    Cherry-picked: 2d492e04be9e386e402ddde248d9a55c8d04a2bb