ceilometer alarm-threshold-update <alarm-id> --project-id <project-id> --user-id <user-id> --time-constraint <timeconstraint>
ceilometer help alarm-threshold-update
usage: ceilometer alarm-threshold-update [--name <NAME>]
[--project-id <PROJECT_ID>]
[--user-id <USER_ID>]
[--description <DESCRIPTION>]
[--state <STATE>]
[--enabled {True|False}]
[--alarm-action <Webhook URL>]
[--ok-action <Webhook URL>]
[--insufficient-data-action <Webhook URL>]
[--time-constraint <Time Constraint>]
[--remove-time-constraint <Constraint names>]
[-m <METRIC>] [--period <PERIOD>]
[--evaluation-periods <COUNT>]
[--statistic <STATISTIC>]
[--comparison-operator <OPERATOR>]
[--threshold <THRESHOLD>]
[-q <QUERY>]
[--repeat-actions {True|False}]
[<ALARM_ID>]
There are multiple issues with above CLI.
1) user provided options are not parsed and updated properly before they were sent to API call
2) Even if project-id/user-id/time-constraint are parsed and sent to alarms.py update() method, the following code will restrict them from making API call with correct values for project-id/user-id/time-constraint
UPDATABLE_ATTRIBUTES = [
'name',
'description',
'type',
'state',
'enabled',
'alarm_actions',
'ok_actions',
'insufficient_data_actions',
'repeat_actions',
'threshold_rule',
'combination_rule'
]
def update(self, alarm_id, **kwargs):
self._compat_legacy_alarm_kwargs(kwargs)
alarm = self.get(alarm_id)
if alarm is None:
raise exc.CommandError('Alarm not found: %s' % alarm_id)
updated = alarm.to_dict()
updated['time_constraints'] = self._merge_time_constraints(
updated.get('time_constraints', []), kwargs)
kwargs = dict((k, v) for k, v in kwargs.items()
if k in updated and k in UPDATABLE_ATTRIBUTES)
utils.merge_nested_dict(updated, kwargs, depth=1)
return self._update(self._path(alarm_id), updated)
3. I can update the project-id.. params using curl but this should be restricted if CLI's restriction of project-id/user-id/timeconstraint update is valid.
curl -i -X PUT -H 'User-Agent: ceilometerclient.openstack.common.apiclient' -H 'Content-Type: application/json' -H 'X-Auth-Token: 7f42382808154545aabfda61779e6b87' -d '{"alarm_actions": [], "ok_actions": [], "name": "alarm1", "state": "insufficient data", "timestamp": "2014-11-20T17:02:21.661879", "enabled": true, "state_timestamp": "2014-11-20T17:02:21.661879", "threshold_rule":
{"meter_name": "image", "evaluation_periods": 1, "period": 60, "statistic": "avg", "threshold": 20.0, "query": [], "comparison_operator": "eq", "exclude_outliers": false}
, "alarm_id": "161b60ed-3e98-42b2-a92e-ffe7a410c78e", "time_constraints": [], "insufficient_data_actions": [], "repeat_actions": false, "user_id": "ea9817c1e4d2468daede7d586de4c8c6", "project_id": "5ffead616e7a494993c692aa11e1a989", "type": "threshold", "description": "test alarm created with project id"}' http://192.168.126.129:8777/v2/alarms/161b60ed-3e98-42b2-a92e-ffe7a410c78e
pchalla@ubuntu:~/devstack$ ceilometer alarm-show 161b60ed-3e98-42b2-a92e-ffe7a410c78e
---------------------------------------------------------------+
Property Value
---------------------------------------------------------------+
alarm_actions []
alarm_id 161b60ed-3e98-42b2-a92e-ffe7a410c78e
comparison_operator eq
description test alarm created with project id
enabled True
evaluation_periods 1
exclude_outliers False
insufficient_data_actions []
meter_name image
name alarm1
ok_actions []
period 60
project_id 5ffead616e7a494993c692aa11e1a989
query
repeat_actions False
state insufficient data
statistic avg
threshold 20.0
type threshold
user_id ea9817c1e4d2468daede7d586de4c8c6
Was this intentionally marked as a private security vulnerability report? If not, it should be switched to a normal public bug so that the Ceilometer developers will be able to see it.