no policy enforment for GET /os-hosts

[Ghanshyam Mann]

Cinder does not do policy enforcement for GET /os-hosts [0], where policy doc says opposite[1].

PUT /os-host has policy control which is default to admin only. is there any rational not to have policy control over GET /os-host ? if so we should fix the doc at least.

This is found during this - https://review.openstack.org/#/c/519609/1

[0] https://github.com/openstack/cinder/blob/0cf910d4345c000e8c306b1cb2b2dd291975cf71/cinder/api/contrib/hosts.py#L135-L190

[1]
 https://github.com/openstack/cinder/blob/10a3f4e1c6f21effc79fd309628111c221543e0d/cinder/policies
/hosts.py

[Jay Bryant (jsbryant)]

Generally we do not allow non-administrative users to do anything that gives insight to the underlying hosts/backends/etc. So, I think the documentation is right in this case.

[TommyLike (hu-husheng)]

Agree. We need to update the code.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/522110
Committed: https://git.openstack.org/cgit/openstack/cinder/commit/?id=f39c3fac2cf4e436a2c5de4f6bfcae1c879f3e43
Submitter: Zuul
Branch: master

commit f39c3fac2cf4e436a2c5de4f6bfcae1c879f3e43
Author: zhangbailin <email address hidden>
Date: Wed Nov 22 12:23:00 2017 +0800

    Update access control of show under hostAPI

    Update the detection mechanism of show interface under the host API.
    Replacement detection mode, and add policy for host show API.

    Change-Id: I76ca1251cd14da6c777bd48a28906d8362d836b0
    Closes-Bug: #1732808

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/cinder 12.0.0.0b2 development milestone.