[Bug 1880959] Re: Rules from the policy directory files are not reapplied after changes to the primary policy file

Dmitrii Shcherbakov 1880959 at bugs.launchpad.net
Fri Jul 10 17:39:42 UTC 2020


Verified for Bionic/Stein:

git show HEAD
commit f05aa4863cdeff0406f73c02e9209842aab4369f (HEAD -> stable/stein, tag: debian/2.1.1-0ubuntu1_cloud1, origin/stable/stein)
Author: Corey Bryant <corey.bryant at canonical.com>
Date:   Thu Jun 25 14:40:43 2020 -0400

    releasing package python-oslo.policy version 2.1.1-0ubuntu1~cloud1


root at oslop:/tmp/oslo.policy/python-oslo.policy# export
QUILT_PATCHES=debian/patches


root at oslop:/tmp/oslo.policy/python-oslo.policy# quilt push
Applying patch debian/patches/reload-policy-files.patch
patching file oslo_policy/policy.py
Hunk #3 succeeded at 763 (offset -6 lines).
Hunk #4 succeeded at 803 (offset -6 lines).
patching file oslo_policy/tests/test_policy.py
patching file releasenotes/notes/bug-1880959-8f1370a59759d40d.yaml

Now at patch debian/patches/reload-policy-files.patch


root at oslop:/tmp/oslo.policy/python-oslo.policy# tox -e py36 -- oslo_policy.tests.test_policy.EnforcerTest.test_load_directory_after_file_update
GLOB sdist-make: /tmp/oslo.policy/python-oslo.policy/setup.py
py36 inst-nodeps: /tmp/oslo.policy/python-oslo.policy/.tox/dist/oslo.policy-2.1.1.zip
py36 installed: alabaster==0.7.12,attrs==19.3.0,Babel==2.8.0,bandit==1.6.2,certifi==2020.6.20,chardet==3.0.4,cliff==3.3.0,cmd2==1.1.0,colorama==0.4.3,coverage==5.2,debtcollector==2.1.0,docutils==0.15.2,dulwich==0.20.5,extras==1.0.0,fixtures==3.0.0,flake8==2.6.2,future==0.18.2,gitdb==4.0.5,GitPython==3.1.3,hacking==1.1.0,idna==2.10,imagesize==1.2.0,importlib-resources==3.0.0,iso8601==0.1.12,Jinja2==2.11.2,linecache2==1.0.0,MarkupSafe==1.1.1,mccabe==0.5.3,mock==3.0.5,msgpack==0.6.1,netaddr==0.8.0,netifaces==0.10.9,openstackdocstheme==2.2.4,oslo.config==8.2.0,oslo.context==3.1.0,oslo.i18n==5.0.0,oslo.policy @ file:///tmp/oslo.policy/python-oslo.policy/.tox/dist/oslo.policy-2.1.1.zip,oslo.serialization==4.0.0,oslo.utils==4.2.2,oslotest==4.4.0,packaging==20.4,pbr==5.4.5,pkg-resources==0.0.0,prettytable==0.7.2,pycodestyle==2.0.0,pyflakes==1.2.3,Pygments==2.6.1,pyparsing==2.4.7,pyperclip==1.8.0,python-mimeparse==1.6.0,python-subunit==1.4.0,pytz==2020.1,PyYAML==5.3.1,reno==3.1.0,requests==2.23.0,requests-mock==1.8.0,rfc3986==1.4.0,six==1.15.0,smmap==3.0.4,snowballstemmer==2.0.0,Sphinx==3.1.2,sphinxcontrib-applehelp==1.0.2,sphinxcontrib-devhelp==1.0.2,sphinxcontrib-htmlhelp==1.0.3,sphinxcontrib-jsmath==1.0.1,sphinxcontrib-qthelp==1.0.3,sphinxcontrib-serializinghtml==1.1.4,stestr==3.0.1,stevedore==2.0.1,testtools==2.4.0,traceback2==1.4.0,unittest2==1.1.0,urllib3==1.25.9,voluptuous==0.11.7,wcwidth==0.2.5,wrapt==1.12.1,zipp==3.1.0
py36 runtests: PYTHONHASHSEED='3801095108'
py36 runtests: commands[0] | stestr run --slowest oslo_policy.tests.test_policy.EnforcerTest.test_load_directory_after_file_update
 WARNING [oslo_policy.policy] Policies ['foo'] reference a rule that is not defined.
{0} oslo_policy.tests.test_policy.EnforcerTest.test_load_directory_after_file_update [0.004062s] ... ok

======
Totals
======
Ran: 1 tests in 0.0041 sec.
 - Passed: 1
 - Skipped: 0
 - Expected Fail: 0
 - Unexpected Success: 0
 - Failed: 0
Sum of execute time for each test: 0.0041 sec.

==============
Worker Balance
==============
 - Worker 0 (1 tests) => 0:00:00.004062
Test id                                                                           Runtime (s)
--------------------------------------------------------------------------------  -----------
oslo_policy.tests.test_policy.EnforcerTest.test_load_directory_after_file_update  0.004
______________________________________________________________________________ summary _______________________________________________________________________________
  py36: commands succeeded
  congratulations :)


** Tags removed: verification-stein-needed
** Tags added: verification-stein-done

-- 
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to Ubuntu Cloud Archive.
https://bugs.launchpad.net/bugs/1880959

Title:
  Rules from the policy directory files are not reapplied after changes
  to the primary policy file

Status in Ubuntu Cloud Archive:
  Fix Released
Status in Ubuntu Cloud Archive mitaka series:
  Triaged
Status in Ubuntu Cloud Archive queens series:
  Triaged
Status in Ubuntu Cloud Archive rocky series:
  In Progress
Status in Ubuntu Cloud Archive stein series:
  Fix Committed
Status in Ubuntu Cloud Archive train series:
  Fix Committed
Status in Ubuntu Cloud Archive ussuri series:
  Fix Committed
Status in oslo.policy:
  Fix Released
Status in python-oslo.policy package in Ubuntu:
  Fix Released
Status in python-oslo.policy source package in Xenial:
  Triaged
Status in python-oslo.policy source package in Bionic:
  Triaged
Status in python-oslo.policy source package in Eoan:
  Won't Fix
Status in python-oslo.policy source package in Focal:
  Fix Committed
Status in python-oslo.policy source package in Groovy:
  Fix Released

Bug description:
  [Impact]
  Based on the investigation here https://bugs.launchpad.net/charm-keystone/+bug/1880847 it was determined that rules from policy files located in the directory specified in the policy_dirs option (/etc/<config_dir>/policy.d by default) are not re-applied after the rules from the primary policy file is re-applied due to a change.

  This leads to scenarios where incorrect rule combinations are active.

  Example from the test case in 1880847:

  * policy.json gets read with the following rule;
      "identity:list_credentials": "rule:admin_required or user_id:%(user_id)s",
  * rule.yaml from policy.d is read with the following rule;
  {'identity:list_credentials': '!'}
  * policy.json's mtime gets updated (with or without a content change) and overrides the rule to be
      "identity:list_credentials": "rule:admin_required or user_id:%(user_id)s",
  * rule.yaml doesn't get reapplied since it hasn't changed.

  [Test Case]
  == ubuntu ==

  The patches include unit tests that ensure the code is behaving as
  expected and has not regressed. These tests are run during every
  package build.

  == upstream ==
  For a particular version of oslo.policy:

  * put the attached test (https://bugs.launchpad.net/ubuntu/+source
  /python-
  oslo.policy/+bug/1880959/+attachment/5377753/+files/test_1880959.py)
  under oslo_policy/tests/test_1880959.py;

  * run tox -e cover -- oslo_policy.tests.test_1880959.EnforcerTest;
  * observe the failure;
  # ...
  testtools.matchers._impl.MismatchError: 'role:fakeA' != 'rule:admin'
  Ran 1 tests in 0.005s (+0.001s)
  FAILED (id=1, failures=1)

  * apply the patch;
  * run tox -e cover -- oslo_policy.tests.test_1880959.EnforcerTest
  * observe that the failure is no longer there.

  [Regression Potential]
  The regression potential is low given that there is test coverage in the olso.policy unit tests.

To manage notifications about this bug go to:
https://bugs.launchpad.net/cloud-archive/+bug/1880959/+subscriptions



More information about the Ubuntu-openstack-bugs mailing list