OpenStack Compute (nova)

  1. Bug #1290537
  2. Comment #23

Comment 23 for bug 1290537

Revision history for this message
John Garbutt (johngarbutt) wrote : Re: RBAC policy not enforced when adding a security group rule using EC2 API (CVE-2014-0167)

Yeah, I am -1 for what chris said.

Seems like we should use the same policy as the core openstack API, otherwise people will have to configure new policy for an api they may not release that had turned on, or something like that.

I agree that we should have a more granular policy on both in the long term, but thats not really the fix for this bug, as I see it.