Reader can update object tag

[Vadym Markov]

Update of Neutron object tags ignores policies for this object update. So, reader user can update tags for all objects of his project

Reproduced on Devstack - Yoga. Newer releases up to master have no changes here, so also should be affected

Steps to reproduce:
All operations in default alt_demo project, which has all needed users provisioned by default

1. Create network object, i.e. floating ip using alt_demo user - as project admin
2. Re-login as alt_demo_reader and try to update tags for this floating

Tags are updated successfully, but reader user has no rights for floating update - "update_floatingip" policy enabled for at least member

[Bernard Cafarelli (bcafarel)]

It is possible tags slipped by in RBAC.

Though while trying to reproduce this (fresh devstack from 2023-09-22), I got an issue with more generic reader role: after "source ~/devstack/openrc alt_demo_reader alt_demo" I could still do admin commands (creating/deleting network, ports, ...)

[Rodolfo Alonso (rodolfo-alonso-hernandez)]

That's correct. The "tag" plugin has its own API paths (get_tags, update_tags, etc) that are not considered in the policy checks.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/neutron/+/896509

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/neutron/+/896509
Committed: https://opendev.org/openstack/neutron/commit/f9b91289a5c2948429e69e1b58098cec846fba99
Submitter: "Zuul (22348)"
Branch: master

commit f9b91289a5c2948429e69e1b58098cec846fba99
Author: Rodolfo Alonso Hernandez <email address hidden>
Date: Tue Sep 26 08:03:19 2023 +0000

    Add policy enforcer for "tags" service plugin

    The following resources have been updated with new policies for
    tags:
    * Port
    * Subnet
    * Network
    * Router
    * FloatingIP
    * NetworkSegmentRange
    * NetworkSegment
    * SecurityGroup
    * Trunk
    * Subnetpool

    The admin can now enforce specific policies for the resource tags
    for the creation, update and deletion actions.

    NOTE: a follow-up patch, with a new Launchpad bug reference, will
          be created to move the ``Tagging`` class from
          ``ExtensionDescriptor`` to ``APIExtensionDescriptor``, and
          refactor the ``TaggingController`` to be a standard
          ``neutron.api.v2.base.Controller``. Any API resource using
          the second controller will use the path used by the wsgi
          hooks, in particular the policy hook. That will make unnecessary
          to manually call the ``policy.enforce`` method from the
          extension class methods.

    Closes-Bug: #2037002
    Change-Id: I9f3e032739824f268db74c5a1b4f04d353742dbd

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/neutron 24.0.0.0b1 development milestone.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/2023.2
Review: https://review.opendev.org/c/openstack/neutron/+/923493

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/neutron/+/923493
Committed: https://opendev.org/openstack/neutron/commit/11cfa25d1386618c15a01977e004a7f5e0957944
Submitter: "Zuul (22348)"
Branch: stable/2023.2

commit 11cfa25d1386618c15a01977e004a7f5e0957944
Author: Rodolfo Alonso Hernandez <email address hidden>
Date: Tue Sep 26 08:03:19 2023 +0000

    Add policy enforcer for "tags" service plugin

    The following resources have been updated with new policies for
    tags:
    * Port
    * Subnet
    * Network
    * Router
    * FloatingIP
    * NetworkSegmentRange
    * NetworkSegment
    * SecurityGroup
    * Trunk
    * Subnetpool

    The admin can now enforce specific policies for the resource tags
    for the creation, update and deletion actions.

    NOTE: a follow-up patch, with a new Launchpad bug reference, will
          be created to move the ``Tagging`` class from
          ``ExtensionDescriptor`` to ``APIExtensionDescriptor``, and
          refactor the ``TaggingController`` to be a standard
          ``neutron.api.v2.base.Controller``. Any API resource using
          the second controller will use the path used by the wsgi
          hooks, in particular the policy hook. That will make unnecessary
          to manually call the ``policy.enforce`` method from the
          extension class methods.

    Conflicts:
        neutron/tests/unit/conf/policies/test_network.py
        neutron/tests/unit/conf/policies/test_subnet.py
        neutron/tests/unit/conf/policies/test_subnetpool.py

    Closes-Bug: #2037002
    Change-Id: I9f3e032739824f268db74c5a1b4f04d353742dbd
    (cherry picked from commit f9b91289a5c2948429e69e1b58098cec846fba99)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/neutron 23.2.0 release.