Ceilometer user in service tenant cannot access EventsController::get_all without admin role.

[Shunli Zhou]

Without admin role, ceilometer user in service tenant cannot access EventsController::get_all.
This doesn't make sense.

For an openstack service to access other services, such as nova to access ceilometer. It's better to use the ceilometer user without admin role to avoid some pertential security problems, only the service role is enough.

Only ceilometer user in service tenant with admin role can access EventsController::get_all will prevent other service to user service user without admin role to retrieve events.

[Shunli Zhou (shunliz)]

Services interact need assign ceilometer user admin role in service tenant, such as this patch in cookbook https://review.openstack.org/#/c/176663/ to workaround this problem.

[Jeremy Stanley (fungi)]

You currently have this open as a security bug, indicating you believe it represents an exploitable vulnerability in the software. Can you elaborate on the circumstances under which this bug might be exploited by a malicious actor, and the risks it implies?

[Shunli Zhou (shunliz)]

Maybe this is just a improper user right problems.

The case I can think of:
A service only need to view the ceilometer event list, but cluster admin has to give the service admin rights. Then the service can get data only admin has right.

I'm not sure this can be tagged as a security bug. I think it's definitely a improper user right setting problem.
If you think this is not a security bug, we can remove the security tag.

[gordon chung (chungg)]

the reason ceilometer requires admin role to access events is to ensure audit events are only visible to admin users. i assume there is a lack of flexibility here and we need some way to tag events.

[Shunli Zhou (shunliz)]

This bug is same reason as https://bugs.launchpad.net/ceilometer/+bug/1346778

[gordon chung (chungg)]

this is addressed by: blueprint events-rbac