Reproduce the bug:
1 log in as a normal user, the user switch to "Project"/"Network"/"Networks" page,
2 Click a shared network which is not created by the current user into the detail page,
3 Click into the port tab and click a port into the detail page,
4 Click into the "Allowed Address Pairs" tab and click the button "Add Allowed Address Pair" and open the form, input a ip and submit the form, there will display the error in the console: "disallowed by policy rule (rule:update_port and rule:update_port:allowed_address_pairs)"
5 Delete Allowed Address Pair also cast the same error.
Detail error as below:
Recoverable error: {'status': u'ACTIVE', u'allowed_address_pairs': [{u'ip_address': u'172.16.50.55', u'mac_address': u'fa:16:3e:1e:07:20'}, {u'ip_address': u'182.3.4.2'}], 'tags': [], 'network_id': u'80f4f8b3-75a7-4fe1-8a8b-403aa7971a75', 'tenant_id': u'0bec32ca31924d2c9ac5acd69d80f2b2', 'attributes_to_update': [u'allowed_address_pairs'], u'network:tenant_id': u'68de5ab28c114a1699cbd98b8ab1d37c', 'project_id': u'0bec32ca31924d2c9ac5acd69d80f2b2', 'id': u'18dddbeb-31ce-422b-b46f-492bfa7cd036'} is disallowed by policy rule (rule:update_port and rule:update_port:allowed_address_pairs) with {'project_id': u'0bec32ca31924d2c9ac5acd69d80f2b2', 'domain': None, 'project_name': u'\u65e0\u9521\u7814\u53d1', 'user_id': u'ebac3104465047bcb0110ecd3cc5d3fd', 'roles': [u'_member_'], 'user_domain_id': None, 'service_project_id': None, 'project_domain': None, 'tenant_id': u'0bec32ca31924d2c9ac5acd69d80f2b2', 'service_user_domain_id': None, 'service_project_domain_id': None, 'service_roles': [], 'is_admin_project': True, 'service_user_id': None, 'is_admin': False, 'user': u'ebac3104465047bcb0110ecd3cc5d3fd', 'tenant_name': u'\u65e0\u9521\u7814\u53d1', 'user_domain': None, 'user_name': u'chen.qiaomin', 'tenant': u'0bec32ca31924d2c9ac5acd69d80f2b2', 'project_domain_id': None}
Neutron server returns request_ids: ['req-17b10da8-c7e5-4bbe-a765-920a75ca8b4b']
this issue is not specific to horizon. can be reproduced even through CLI using neutron port-update or openstack port-set commands