Default rule does not work in ceilometer policy.json

[Divya K Konoor]

The rule default does not work for ceilometer. I tried with few of these and they don't work. I am able to proceed with the REST apis that are not mentioned even when the default is set to not_allowed.

"default": "not_allowed:True",
"default": "!",

The problem appears to be here >>/usr/lib/python2.7/site-packages/ceilometer/api/rbac.py

    for rule_name in _ENFORCER.rules.keys():
        if rule_method == rule_name:
            if not _ENFORCER.enforce(
                    rule_name,
                    {},
                    policy_dict):
                pecan.core.abort(status_code=403,
                                 detail='RBAC Authorization Failed')

The rbac.enforce method loops through all the rules and filters the one that matches the one requested for. However , in a case where the rule has not been specified in the policy.json file , there is no logic in the above to fall back on the default value. The default logic is already taken case of by oslo_policy and the above loop seems to be causing the problem.

[Divya K Konoor (dikonoor)]

patch submitted for review >> https://review.openstack.org/#/c/167370/

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/167370
Committed: https://git.openstack.org/cgit/openstack/ceilometer/commit/?id=aa78d70df29c3927c032ef49079011fd9c937f73
Submitter: Jenkins
Branch: master

commit aa78d70df29c3927c032ef49079011fd9c937f73
Author: Divya <email address hidden>
Date: Fri Mar 27 09:27:35 2015 +0100

    Adds support for default rule in ceilometer policy.json.

    The default rule is broken in the current implementation of
    ceilometer rbac, because ceilometer rbac.py does not leverage
    the support provided by oslo_policy . It instead tries to
    loop through all the rules in the policy.json to check if the
    rule corresponding to the requested REST api matches with the
    any in the policy.json. In this process, it completely ignores
    the existence of the default rule.

    Closes-Bug: 1435855

    Change-Id: Icab626b28d14514b0f024df447a8e7f35c52257c