[Bug 1880959] Re: Rules from the policy directory files are not reapplied after changes to the primary policy file
Dmitrii Shcherbakov
1880959 at bugs.launchpad.net
Fri Jul 10 17:39:42 UTC 2020
Verified for Bionic/Stein:
git show HEAD
commit f05aa4863cdeff0406f73c02e9209842aab4369f (HEAD -> stable/stein, tag: debian/2.1.1-0ubuntu1_cloud1, origin/stable/stein)
Author: Corey Bryant <corey.bryant at canonical.com>
Date: Thu Jun 25 14:40:43 2020 -0400
releasing package python-oslo.policy version 2.1.1-0ubuntu1~cloud1
root at oslop:/tmp/oslo.policy/python-oslo.policy# export
QUILT_PATCHES=debian/patches
root at oslop:/tmp/oslo.policy/python-oslo.policy# quilt push
Applying patch debian/patches/reload-policy-files.patch
patching file oslo_policy/policy.py
Hunk #3 succeeded at 763 (offset -6 lines).
Hunk #4 succeeded at 803 (offset -6 lines).
patching file oslo_policy/tests/test_policy.py
patching file releasenotes/notes/bug-1880959-8f1370a59759d40d.yaml
Now at patch debian/patches/reload-policy-files.patch
root at oslop:/tmp/oslo.policy/python-oslo.policy# tox -e py36 -- oslo_policy.tests.test_policy.EnforcerTest.test_load_directory_after_file_update
GLOB sdist-make: /tmp/oslo.policy/python-oslo.policy/setup.py
py36 inst-nodeps: /tmp/oslo.policy/python-oslo.policy/.tox/dist/oslo.policy-2.1.1.zip
py36 installed: alabaster==0.7.12,attrs==19.3.0,Babel==2.8.0,bandit==1.6.2,certifi==2020.6.20,chardet==3.0.4,cliff==3.3.0,cmd2==1.1.0,colorama==0.4.3,coverage==5.2,debtcollector==2.1.0,docutils==0.15.2,dulwich==0.20.5,extras==1.0.0,fixtures==3.0.0,flake8==2.6.2,future==0.18.2,gitdb==4.0.5,GitPython==3.1.3,hacking==1.1.0,idna==2.10,imagesize==1.2.0,importlib-resources==3.0.0,iso8601==0.1.12,Jinja2==2.11.2,linecache2==1.0.0,MarkupSafe==1.1.1,mccabe==0.5.3,mock==3.0.5,msgpack==0.6.1,netaddr==0.8.0,netifaces==0.10.9,openstackdocstheme==2.2.4,oslo.config==8.2.0,oslo.context==3.1.0,oslo.i18n==5.0.0,oslo.policy @ file:///tmp/oslo.policy/python-oslo.policy/.tox/dist/oslo.policy-2.1.1.zip,oslo.serialization==4.0.0,oslo.utils==4.2.2,oslotest==4.4.0,packaging==20.4,pbr==5.4.5,pkg-resources==0.0.0,prettytable==0.7.2,pycodestyle==2.0.0,pyflakes==1.2.3,Pygments==2.6.1,pyparsing==2.4.7,pyperclip==1.8.0,python-mimeparse==1.6.0,python-subunit==1.4.0,pytz==2020.1,PyYAML==5.3.1,reno==3.1.0,requests==2.23.0,requests-mock==1.8.0,rfc3986==1.4.0,six==1.15.0,smmap==3.0.4,snowballstemmer==2.0.0,Sphinx==3.1.2,sphinxcontrib-applehelp==1.0.2,sphinxcontrib-devhelp==1.0.2,sphinxcontrib-htmlhelp==1.0.3,sphinxcontrib-jsmath==1.0.1,sphinxcontrib-qthelp==1.0.3,sphinxcontrib-serializinghtml==1.1.4,stestr==3.0.1,stevedore==2.0.1,testtools==2.4.0,traceback2==1.4.0,unittest2==1.1.0,urllib3==1.25.9,voluptuous==0.11.7,wcwidth==0.2.5,wrapt==1.12.1,zipp==3.1.0
py36 runtests: PYTHONHASHSEED='3801095108'
py36 runtests: commands[0] | stestr run --slowest oslo_policy.tests.test_policy.EnforcerTest.test_load_directory_after_file_update
WARNING [oslo_policy.policy] Policies ['foo'] reference a rule that is not defined.
{0} oslo_policy.tests.test_policy.EnforcerTest.test_load_directory_after_file_update [0.004062s] ... ok
======
Totals
======
Ran: 1 tests in 0.0041 sec.
- Passed: 1
- Skipped: 0
- Expected Fail: 0
- Unexpected Success: 0
- Failed: 0
Sum of execute time for each test: 0.0041 sec.
==============
Worker Balance
==============
- Worker 0 (1 tests) => 0:00:00.004062
Test id Runtime (s)
-------------------------------------------------------------------------------- -----------
oslo_policy.tests.test_policy.EnforcerTest.test_load_directory_after_file_update 0.004
______________________________________________________________________________ summary _______________________________________________________________________________
py36: commands succeeded
congratulations :)
** Tags removed: verification-stein-needed
** Tags added: verification-stein-done
--
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to Ubuntu Cloud Archive.
https://bugs.launchpad.net/bugs/1880959
Title:
Rules from the policy directory files are not reapplied after changes
to the primary policy file
Status in Ubuntu Cloud Archive:
Fix Released
Status in Ubuntu Cloud Archive mitaka series:
Triaged
Status in Ubuntu Cloud Archive queens series:
Triaged
Status in Ubuntu Cloud Archive rocky series:
In Progress
Status in Ubuntu Cloud Archive stein series:
Fix Committed
Status in Ubuntu Cloud Archive train series:
Fix Committed
Status in Ubuntu Cloud Archive ussuri series:
Fix Committed
Status in oslo.policy:
Fix Released
Status in python-oslo.policy package in Ubuntu:
Fix Released
Status in python-oslo.policy source package in Xenial:
Triaged
Status in python-oslo.policy source package in Bionic:
Triaged
Status in python-oslo.policy source package in Eoan:
Won't Fix
Status in python-oslo.policy source package in Focal:
Fix Committed
Status in python-oslo.policy source package in Groovy:
Fix Released
Bug description:
[Impact]
Based on the investigation here https://bugs.launchpad.net/charm-keystone/+bug/1880847 it was determined that rules from policy files located in the directory specified in the policy_dirs option (/etc/<config_dir>/policy.d by default) are not re-applied after the rules from the primary policy file is re-applied due to a change.
This leads to scenarios where incorrect rule combinations are active.
Example from the test case in 1880847:
* policy.json gets read with the following rule;
"identity:list_credentials": "rule:admin_required or user_id:%(user_id)s",
* rule.yaml from policy.d is read with the following rule;
{'identity:list_credentials': '!'}
* policy.json's mtime gets updated (with or without a content change) and overrides the rule to be
"identity:list_credentials": "rule:admin_required or user_id:%(user_id)s",
* rule.yaml doesn't get reapplied since it hasn't changed.
[Test Case]
== ubuntu ==
The patches include unit tests that ensure the code is behaving as
expected and has not regressed. These tests are run during every
package build.
== upstream ==
For a particular version of oslo.policy:
* put the attached test (https://bugs.launchpad.net/ubuntu/+source
/python-
oslo.policy/+bug/1880959/+attachment/5377753/+files/test_1880959.py)
under oslo_policy/tests/test_1880959.py;
* run tox -e cover -- oslo_policy.tests.test_1880959.EnforcerTest;
* observe the failure;
# ...
testtools.matchers._impl.MismatchError: 'role:fakeA' != 'rule:admin'
Ran 1 tests in 0.005s (+0.001s)
FAILED (id=1, failures=1)
* apply the patch;
* run tox -e cover -- oslo_policy.tests.test_1880959.EnforcerTest
* observe that the failure is no longer there.
[Regression Potential]
The regression potential is low given that there is test coverage in the olso.policy unit tests.
To manage notifications about this bug go to:
https://bugs.launchpad.net/cloud-archive/+bug/1880959/+subscriptions
More information about the Ubuntu-openstack-bugs
mailing list