VMs and volumes can be accessed in a different tenant by a different user

[Vincent Hou]

1. Set username=admin and tenant=admin, create a volume and a VM. Run "cinder list" and "nova list". Remember the volume-id and vm-id.
2. Switch to another user and tenant, run "cinder list" and "nova list". There is no volume or VM listed.
3. Since we have already known the volume-id and vm-id. It is possible to try all the commands which applies to volumes and VMs, like delete, attach, start, stop, reboot... Theoretically under a different user and tenant, we are not supposed to access the volume or the VM. However, we can do any operation we want, as long as we know the volume-id and VM-id.

Related blueprint: https://blueprints.launchpad.net/cinder/+spec/volume-acl

[John Griffith (john-griffith)]

Hey Vincent,
So I'm not sure I follow this... I did a quick test to make sure I was right here:

I created two users in the same project (user-a and user-b);
Logged in as user-a and created a volume (made a note of the volume id)
Logged in as user-b and tried 'cinder delete xxxxxx'

The response to the delete command was "ERROR: No volume with a name or ID of '70694366-65e0-4f41-954d-301b6dd23607' exists." as I would have expected.

[sandeep mane (sandeep-mane)]

Hi,

I have created to 2 different user A_user as a member and B_user as a admin
Try to access the vm and volume with their IDS using volume-attach commnd

ERROR: No Server with name or ID of ' ' exists

I got an error under different users
can you please give us more details on this problem

--Sandeep

[Vincent Hou (houshengbo)]

Hi Sandeep. Thank you for asking.
This is a bug no longer valid. I was using service as the tenant/projecet, service is actually a tenant, in which any user can access the resource.
If we create different users and tenants, it should behave normally.