Cinder Quota RBAC does not consider project_id passed

[Divya K Konoor]

The problem reported below is not limited to just cinder quotas. I checked and see this in other apis as well like quota classes and lots of others. The problem listed down is specific to quotas because I ran into this problem when I tried this rest api:

As we know the policy.json file defines the RBAC for a rest api. I updated my policy json rules for quotas as seen below with an intent that the admin user of a particular project is not able to update or access information w.r.t. quotas of other project . But the below project segregation rules do not work.

"volume_extension:quotas:show": "role:admin and project_id:%(project_id)s",
"volume_extension:quotas:update": "role:admin and project_id:%(project_id)s",
"volume_extension:quotas:delete": "role:admin and project_id:%(project_id)s",

These do not work because in the api level code, the same project id is passed for target and credentials.
https://github.com/openstack/cinder/blob/master/cinder/api/contrib/quotas.py#L165

This happens because there's no target information passed at the time of rule enforcement in which case the code uses the context project id as the target :

https://github.com/openstack/cinder/blob/master/cinder/api/extensions.py#L326

[Sean McGinnis (sean-mcginnis)]

Unassigning due to no activity for > 6 months.

[Matthew Edmonds (edmondsw)]

scope checks should be done in code, not by adding project_id:%(project_id)s in policy files. That said, there are at least a couple things that need to happen here:
1) we need to start doing proper scope checks in the code
2) target data needs to be filled to enable other types of checks from policy