Internal server error if shared member tries to stage data to image

[Abhishek Kekane]

If non active image is shared with another project and any member from that project tries to stage data for the same then we get Internal server error from glance API.

Steps to reproduce:
1. Create image with shared visibility using below command
   $ glance image-create --name stage-check --visibility shared
2. Share image with another project using below command
   $ glance image-stage <IMAGE_ID_FROM_STEP_1> <PROJECT_ID>
3. Now source the credentials of project with we have shared image in stage 2
4. Stage image data using below command
   $ glance image-stage <image_id> --file <path_of_data_file>

Expected Ouput: 403 HttpForbidden: You are not permitted for this operation
Actual Output:
HTTP 502 Bad Gateway: Bad Gateway: The proxy server received an invalid: response from an upstream server.: Apache/2.4.41 (Ubuntu) Server at 10.0.78.195 Port 80

Glance API logs:
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.api.v2.image_data [None req-0c2515a8-cf31-4f8e-b365-c9f5375c386d rbac-testing rbac-member] Failed to stage image data due to internal error: glance.common.exception.Forbidden: You are not permitted to modify 'status' on this image.
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.api.v2.image_data Traceback (most recent call last):
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.api.v2.image_data File "/opt/stack/glance/glance/api/v2/image_data.py", line 372, in stage
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.api.v2.image_data image.status = 'uploading'
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.api.v2.image_data File "/opt/stack/glance/glance/api/authorization.py", line 247, in forbidden
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.api.v2.image_data raise exception.Forbidden(message % {'attr': attr,
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.api.v2.image_data glance.common.exception.Forbidden: You are not permitted to modify 'status' on this image.
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.api.v2.image_data
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.api.v2.image_data [None req-0c2515a8-cf31-4f8e-b365-c9f5375c386d rbac-testing rbac-member] Unable to restore image 30e26758-0e2d-4347-b0c0-66964f76403b: You are not permitted to modify 'status' on this image.: glance.common.exception.Forbidden: You are not permitted to modify 'status' on this image.
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.api.v2.image_data Traceback (most recent call last):
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.api.v2.image_data File "/opt/stack/glance/glance/api/v2/image_data.py", line 372, in stage
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.api.v2.image_data image.status = 'uploading'
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.api.v2.image_data File "/opt/stack/glance/glance/api/authorization.py", line 247, in forbidden
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.api.v2.image_data raise exception.Forbidden(message % {'attr': attr,
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.api.v2.image_data glance.common.exception.Forbidden: You are not permitted to modify 'status' on this image.
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.api.v2.image_data
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.api.v2.image_data During handling of the above exception, another exception occurred:
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.api.v2.image_data
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.api.v2.image_data Traceback (most recent call last):
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.api.v2.image_data File "/opt/stack/glance/glance/api/v2/image_data.py", line 66, in _restore
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.api.v2.image_data image.status = 'queued'
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.api.v2.image_data File "/opt/stack/glance/glance/api/authorization.py", line 247, in forbidden
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.api.v2.image_data raise exception.Forbidden(message % {'attr': attr,
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.api.v2.image_data glance.common.exception.Forbidden: You are not permitted to modify 'status' on this image.
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.api.v2.image_data
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.common.wsgi [None req-0c2515a8-cf31-4f8e-b365-c9f5375c386d rbac-testing rbac-member] Caught error: You are not permitted to modify 'status' on this image.: glance.common.exception.Forbidden: You are not permitted to modify 'status' on this image.
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.common.wsgi Traceback (most recent call last):
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.common.wsgi File "/opt/stack/glance/glance/common/wsgi.py", line 1353, in __call__
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.common.wsgi action_result = self.dispatch(self.controller, action,
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.common.wsgi File "/opt/stack/glance/glance/common/wsgi.py", line 1397, in dispatch
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.common.wsgi return method(*args, **kwargs)
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.common.wsgi File "/opt/stack/glance/glance/common/utils.py", line 416, in wrapped
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.common.wsgi return func(self, req, *args, **kwargs)
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.common.wsgi File "/opt/stack/glance/glance/api/v2/image_data.py", line 443, in stage
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.common.wsgi self._restore(image_repo, image)
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.common.wsgi File "/usr/local/lib/python3.8/dist-packages/oslo_utils/excutils.py", line 227, in __exit__
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.common.wsgi self.force_reraise()
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.common.wsgi File "/usr/local/lib/python3.8/dist-packages/oslo_utils/excutils.py", line 200, in force_reraise
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.common.wsgi raise self.value
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.common.wsgi File "/opt/stack/glance/glance/api/v2/image_data.py", line 372, in stage
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.common.wsgi image.status = 'uploading'
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.common.wsgi File "/opt/stack/glance/glance/api/authorization.py", line 247, in forbidden
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.common.wsgi raise exception.Forbidden(message % {'attr': attr,
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.common.wsgi glance.common.exception.Forbidden: You are not permitted to modify 'status' on this image.
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: ERROR glance.common.wsgi
Aug 13 20:49:33 akekane-xena-dev <email address hidden>[1526]: [pid: 1526|app: 0|req: 19/38] 127.0.0.1 () {40 vars in 822 bytes} [Fri Aug 13 20:49:33 2021] PUT /v2/images/30e26758-0e2d-4347-b0c0-66964f76403b/stage => generated 228 bytes in 53 msecs (HTTP/1.1 500) 4 headers in 184 bytes (1 switches on core 0)

[Durga Malleswari Varanasi (durga1)]

Hi @HanGuangyu,

I would like to work on this bug.
Kindly let me know If I can assign this to me.

Thanks,
Malleswari

[Han Guangyu (han-guangyu)]

Hi @Durga Malleswari Varanasi,

Yes, you can do it. Sorry that I don't do it ater assign it to me.
I'm very happy that you can work on this bug. Just do it.

Thanks,
Han Guagnyu

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/glance/+/834701

[Abhishek Kekane (abhishek-kekane)]

This bug is fixed when we moved policy enforcement in the API layer.

1. When S-RBAC is disabled;

a. source ~/devstack/openrc admin admin
b. glance image-create --name stage-check --visibility shared
+------------------+--------------------------------------+
| Property | Value |
+------------------+--------------------------------------+
| checksum | None |
| container_format | None |
| created_at | 2022-04-27T14:55:15Z |
| disk_format | None |
| id | 42d3b749-485c-4633-a8bf-165afe8915da |
| locations | [] |
| min_disk | 0 |
| min_ram | 0 |
| name | stage-check |
| os_hash_algo | None |
| os_hash_value | None |
| os_hidden | False |
| owner | 2666047178c044e2be920f813b4cba7a |
| protected | False |
| size | None |
| status | queued |
| tags | [] |
| updated_at | 2022-04-27T14:55:15Z |
| virtual_size | Not available |
| visibility | shared |
+------------------+--------------------------------------+

c. glance member-create 42d3b749-485c-4633-a8bf-165afe8915da 0da6425d6c864113815691286e91f071
+--------------------------------------+----------------------------------+---------+
| Image ID | Member ID | Status |
+--------------------------------------+----------------------------------+---------+
| 42d3b749-485c-4633-a8bf-165afe8915da | 0da6425d6c864113815691286e91f071 | pending |
+--------------------------------------+----------------------------------+---------+

d. source ~/devstack/rbac-member-rc (different project)

e. glance image-stage 42d3b749-485c-4633-a8bf-165afe8915da --file tox.ini
HTTP 403 Forbidden: You do not own this image

2. Now enable secure RBAC in g-api.conf and restart the service

f. glance image-stage 42d3b749-485c-4633-a8bf-165afe8915da --file tox.ini
HTTP 403 Forbidden: You are not authorized to complete modify_image action.

Only functional test is missing to cover this scenario.
https://review.opendev.org/c/openstack/glance/+/834701 adds the same.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/glance/+/834701
Committed: https://opendev.org/openstack/glance/commit/cb65cc8e44523cd04ecace02296061a6ddc3982d
Submitter: "Zuul (22348)"
Branch: master

commit cb65cc8e44523cd04ecace02296061a6ddc3982d
Author: Durga Malleswari Varanasi <email address hidden>
Date: Tue Mar 22 15:13:25 2022 +0000

    Internal server error if shared member tries to stage data
    to image

    Glance API throws an Internal Server Exception when a non
    active image is shared with another project and any member
    from that project tries to stage data for the same.

    This patch will cover the Functional Test Case for the same

    Closes-Bug: #1939922
    Change-Id: I065036cff6e107b3438007db40981459400ccb6b

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/glance 25.0.0.0b2 development milestone.