The Enforcer object doesn't deepcopy rules before modifying them

[Lance Bragstad]

The Enforcer() object has methods that load and register default rules. These rules are usually passed

The Enforcer() object has methods to register default rules, which are typically pass in from whatever created the instance of the Enforcer(). The Enforcer() will modify the rules if it detects a rule is deprecated and it's being overridden with a specific value from the operator. This modification allows for smooth upgrades during the deprecation period.

The modification is done on the original copy of the rules that are passed into the Enforcer(), which can cause issues with callers who aren't expecting the rules to change (e.g., tests sharing an enforcer)[0].

We can improve this by ensuring the Enforcer makes a deep copy of the rules before it modifies them.

[0] https://storyboard.openstack.org/#!/story/2008556

[Ghanshyam Mann (ghanshyammann)]

fixing in https://review.opendev.org/c/openstack/oslo.policy/+/773950

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/oslo.policy 3.6.2 release.