can_share option grants write permissions on swift container in multi tenant mode.

[Nassim Babaci]

In v1, in multi tenant mode, when a user from a tenant (let say T1) share an image with the 'can_share' flag, then the user with who the image is shared is granted write permission on the swift container of tenant T1.

As a consequence all user from the tenant T2 can write to that container and thus consuming User1 swift quotas.

here how to reproduce:
  http://paste.openstack.org/show/61511/

Important lines here are, when we share an image with other user with can_share flag
  ubuntu@devstack-nb:~/devstack$ glance member-create --can-share image-demo cd563ba051bd4341b1015566e260f09e

The ACL of the swift container become:
   Read ACL:
   Write ACL: cd563ba051bd4341b1015566e260f09e:*

Note that the users from T2 can write to the container but not read, which make him unable to use the image that have been shared.

[Nikhil Komawar (nikhil-komawar)]

Is this still valid?

[OpenStack Infra (hudson-openstack)]

Change abandoned by Flavio Percoco (<email address hidden>) on branch: master
Review: https://review.openstack.org/67701
Reason: after all this time, I'd assume we don't need this patch anymore. The bug/blueprint was probably fixed already or invalidated. Please, feel free to re-open it if you think otherwise.