commit 8edaa3254c589c20443accc21eb732038158c59f
Author: Goutham Pacha Ravi <email address hidden>
Date: Thu May 25 15:20:31 2023 -0700
[rbac] Pull up policy checks on share/snapshot APIs
RBAC enforcement in manila happens in stages:
1) Does user have access to the API
2) Does user have access to the resource
3) Is user permitted to perform the API action on the resource
If (1) fails, user gets a HTTP 403, if (2) fails,
they get a HTTP 404; if (3) fails, they get a HTTP 403.
More often than not, (2) prevents "existence" detection
of resources that don't belong to the user; except in
case of "public" resources (e.g.: shares can be "public").
In some share API methods, policy checks for (1) are
happening after a bunch of processing. This leads to
some inconsistency.
Fix these occurrences to ensure a consistent user
experience.
Change-Id: I5b1f1ce517efed000f17b1e0901e183a1913ba9f
Related-Bug: #2004230
Signed-off-by: Goutham Pacha Ravi <email address hidden>
(cherry picked from commit 190876809f2bda4153166e055c9de9bd1786f2a8)
(cherry picked from commit 318140e2505a946f7523e47dc6cf5b4ac34a7813)
Reviewed: https:/ /review. opendev. org/c/openstack /manila/ +/897990 /opendev. org/openstack/ manila/ commit/ 8edaa3254c589c2 0443accc21eb732 038158c59f
Committed: https:/
Submitter: "Zuul (22348)"
Branch: stable/2023.1
commit 8edaa3254c589c2 0443accc21eb732 038158c59f
Author: Goutham Pacha Ravi <email address hidden>
Date: Thu May 25 15:20:31 2023 -0700
[rbac] Pull up policy checks on share/snapshot APIs
RBAC enforcement in manila happens in stages:
1) Does user have access to the API
2) Does user have access to the resource
3) Is user permitted to perform the API action on the resource
If (1) fails, user gets a HTTP 403, if (2) fails,
they get a HTTP 404; if (3) fails, they get a HTTP 403.
More often than not, (2) prevents "existence" detection
of resources that don't belong to the user; except in
case of "public" resources (e.g.: shares can be "public").
In some share API methods, policy checks for (1) are
happening after a bunch of processing. This leads to
some inconsistency.
Fix these occurrences to ensure a consistent user
experience.
Change-Id: I5b1f1ce517efed 000f17b1e0901e1 83a1913ba9f 153166e055c9de9 bd1786f2a8) f7523e47dc6cf5b 4ac34a7813)
Related-Bug: #2004230
Signed-off-by: Goutham Pacha Ravi <email address hidden>
(cherry picked from commit 190876809f2bda4
(cherry picked from commit 318140e2505a946