[OSSN-0088] Glance leaks resource types across namespaces

[Lance Bragstad]

As a user of a project, I can see resource types associated to private namespaces I don't have access to:

╭─ubuntu@glance-devstack ~/devstack ‹master*›
╰─➤ $ cat alicerc
export OS_CACERT=
export OS_PROJECT_NAME=separate
export OS_USERNAME=alice
export OS_PASSWORD=password
export OS_REGION_NAME=RegionOne
export OS_IDENTITY_API_VERSION=3
export OS_AUTH_TYPE=password
export OS_AUTH_URL=http://192.168.1.155/identity
export OS_USER_DOMAIN_ID=default
export OS_PROJECT_DOMAIN_ID=default
export OS_VOLUME_API_VERSION=3
╭─ubuntu@glance-devstack ~/devstack ‹master*›
╰─➤ $ source alicerc
╭─ubuntu@glance-devstack ~/devstack ‹master*›
╰─➤ $ glance md-namespace-list
+------------------------------------------+
| namespace |
+------------------------------------------+
| OS::Software::DBMS |
| CIM::ResourceAllocationSettingData |
| OS::Compute::CPUPinning |
| OS::Compute::Watchdog |
| OS::Compute::GuestMemoryBacking |
| OS::Compute::AggregateDiskFilter |
| OS::Compute::RandomNumberGenerator |
| OS::Compute::Hypervisor |
| OS::Compute::AggregateIoOpsFilter |
| OS::Compute::VirtCPUTopology |
| OS::Compute::HostCapabilities |
| CIM::ProcessorAllocationSettingData |
| OS::Compute::GuestShutdownBehavior |
| OS::Cinder::Volumetype |
| OS::Software::WebServers |
| OS::Compute::Libvirt |
| OS::Compute::XenAPI |
| OS::Compute::Quota |
| OS::Compute::VMwareFlavor |
| OS::Compute::VMwareQuotaFlavor |
| OS::Compute::InstanceData |
| OS::Compute::LibvirtImage |
| OS::Compute::AggregateNumInstancesFilter |
| OS::Glance::Signatures |
| CIM::VirtualSystemSettingData |
| CIM::StorageAllocationSettingData |
| OS::Software::Runtimes |
| OS::Compute::VMware |
+------------------------------------------+
╭─ubuntu@glance-devstack ~/devstack ‹master*›
╰─➤ $ glance md-namespace-create alice-namespace
+------------+----------------------------------+
| Property | Value |
+------------+----------------------------------+
| created_at | 2021-02-25T15:55:55Z |
| namespace | alice-namespace |
| owner | 67f1495e5dc145abbfa7059c63c6eda2 |
| protected | False |
| schema | /v2/schemas/metadefs/namespace |
| updated_at | 2021-02-25T15:55:55Z |
| visibility | private |
+------------+----------------------------------+
╭─ubuntu@glance-devstack ~/devstack ‹master*›
╰─➤ $ glance md-resource-type-associate --name alice-resource-type alice-namespace
+------------+----------------------+
| Property | Value |
+------------+----------------------+
| created_at | 2021-02-25T15:57:29Z |
| name | alice-resource-type |
| updated_at | 2021-02-25T15:57:29Z |
+------------+----------------------+

Now as a separate user

╭─ubuntu@glance-devstack ~/devstack ‹master*›
╰─➤ $ source openrc demo demo
is_service_enabled:29: command not found: set +o xtrace
WARNING: setting legacy OS_TENANT_NAME to support cli tools.
╭─ubuntu@glance-devstack ~/devstack ‹master*›
╰─➤ $ glance md-resource-type-list
+---------------------+
| name |
+---------------------+
| OS::Glance::Image |
| OS::Cinder::Volume |
| OS::Nova::Server |
| OS::Nova::Aggregate |
| OS::Nova::Flavor |
| OS::Trove::Instance |
| bar |
| test |
| alice-resource-type |
+---------------------+

[Lance Bragstad (lbragstad)]

I'm opening this as a security vulnerability based on conversations with jokke

[Jeremy Stanley (fungi)]

Since this report concerns a possible security risk, an incomplete
security advisory task has been added while the core security
reviewers for the affected project or projects confirm the bug and
discuss the scope of any vulnerability along with potential
solutions.

[Jeremy Stanley (fungi)]

It has come to my attention that Dan Smith was also aware of this report, so I have subscribed him after discussing with Lance.

[Dan Smith (danms)]

I added my feeling on how we should handle this on the related bug here:

https://bugs.launchpad.net/glance/+bug/1916926/comments/3

[Jeremy Stanley (fungi)]

Thanks! If we go with that plan, I recommend a single security advisory which covers all related vulnerabilities (it may wind up with multiple CVE assignments for each problem addressed, but that's not too unusual).

[Dan Smith (danms)]

Indeed, I think a single advisory for "this whole corner of the API has fundamental issues and should be disabled or handled with care" makes perfect sense.

[Jeremy Stanley (fungi)]

We'll be switching this bug public shortly along with bug 1916926 under a single publication (OSSN-0088).

[Jeremy Stanley (fungi)]

Recommendations are now published here: https://wiki.openstack.org/wiki/OSSN/OSSN-0088