There is no policy controlling the "complete attachment" API action

[Matt Riedemann]

There is no policy rule restricting the "os-complete" action to a volume attachment:

https://github.com/openstack/cinder/blob/master/cinder/api/v3/attachments.py#L262

https://github.com/openstack/cinder/blob/master/cinder/policies/attachments.py

This means anyone that can read the attachment from the database can also complete it.

You could likely re-use the same policy rules as the attachment update action, or add a new one for granularity. This is low severity but probably good to have for completeness.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/536119

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/536119
Committed: https://git.openstack.org/cgit/openstack/cinder/commit/?id=7bcd2a1c6b63caba3578b02f512d52cf72c00a22
Submitter: Zuul
Branch: master

commit 7bcd2a1c6b63caba3578b02f512d52cf72c00a22
Author: Aseel Awwad <email address hidden>
Date: Sun Jan 21 08:45:13 2018 -0500

    Add policy check for complete attachment API action

    Add new policy rule for complete_attachment action to
    prevent anyone who can read the attachment from the database
    to complete it (mark it as in-use)

    Change-Id: Idad8c44acde155e70f6f9f618887a97fc956cdd2
    Closes-Bug: #1737000

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/cinder 12.0.0.0b3 development milestone.