policy checks for detach_interface not working correctly

[Kenneth Cummings]

Hello,

we want to prevent non-admin users to detach interfaces from running instances. So we changed the policy to
    "compute:detach_interface": "role:admin",
but still non-admin users see the Option and can use it.

Am I missing some place to declare this option?

Kind regards,
Kenneth Cummings

[Ying Zuo (yingzuo)]

This action is not controlled by policy currently. See comment on https://github.com/openstack/horizon/blob/master/openstack_dashboard/dashboards/project/instances/tables.py#L930.

[Ying Zuo (yingzuo)]

As discussed in today's meeting, we should do the same check for this action as in Nova.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/527414

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/527414
Committed: https://git.openstack.org/cgit/openstack/horizon/commit/?id=c999239fed8d2213a8913d1cc8fb294f7086b594
Submitter: Zuul
Branch: master

commit c999239fed8d2213a8913d1cc8fb294f7086b594
Author: Abdallah Banishamsa <email address hidden>
Date: Tue Dec 12 09:25:05 2017 -0500

    Prevent non-admin users from detaching interfaces

    Remove the option to detach_interface from running instances for
    non-admin users.

    Change-Id: Id641bde457e8723ace0bc1e49aab2c46b2227485
    Closes-bug: #1690790

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/horizon 13.0.0.0b3 development milestone.