[Bug 1502136] Please test proposed package

James Page james.page at ubuntu.com
Tue Jul 25 13:16:01 UTC 2017


Hello Stuart, or anyone else affected,

Accepted glance into kilo-proposed. The package will build now and be
available in the Ubuntu Cloud Archive in a few hours, and then in the
-proposed repository.

Please help us by testing this new package. To enable the -proposed
repository:

  sudo add-apt-repository cloud-archive:kilo-proposed
  sudo apt-get update

Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug,
mentioning the version of the package you tested, and change the tag
from verification-kilo-needed to verification-kilo-done. If it does not
fix the bug for you, please add a comment stating that, and change the
tag to verification-kilo-failed. In either case, details of your testing
will help us make a better decision.

Further information regarding the verification process can be found at
https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in
advance!

** Changed in: cloud-archive/kilo
       Status: In Progress => Fix Committed

** Tags added: verification-kilo-needed

-- 
You received this bug notification because you are a member of Ubuntu
Sponsors Team, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/1502136

Title:
  Everything returns 403 if show_multiple_locations is true and
  get_image_location policy is set

Status in Ubuntu Cloud Archive:
  Fix Released
Status in Ubuntu Cloud Archive kilo series:
  Fix Committed
Status in Glance:
  Fix Released
Status in glance package in Ubuntu:
  Fix Released
Status in glance source package in Trusty:
  Triaged
Status in glance source package in Xenial:
  Fix Released

Bug description:
  [Impact]

  If, in glance-api.conf you set:

   show_multiple_locations = true

  Things work as expected:

   $ glance --os-image-api-version 2 image-show 13ae74f0-74bf-4792-a8bb-7c622abc5410
   +------------------+----------------------------------------------------------------------------------+
   | Property         | Value                                                                            |
   +------------------+----------------------------------------------------------------------------------+
   | checksum         | 9cb02fe7fcac26f8a25d6db3109063ae                                                 |
   | container_format | bare                                                                             |
   | created_at       | 2015-10-02T12:43:33Z                                                             |
   | disk_format      | raw                                                                              |
   | id               | 13ae74f0-74bf-4792-a8bb-7c622abc5410                                             |
   | locations        | [{"url": "swift+config://ref1/glance/13ae74f0-74bf-4792-a8bb-7c622abc5410",      |
   |                  | "metadata": {}}]                                                                 |
   | min_disk         | 0                                                                                |
   | min_ram          | 0                                                                                |
   | name             | good-image                                                                       |
   | owner            | 88cffb9c8aee457788066c97b359585b                                                 |
   | protected        | False                                                                            |
   | size             | 145                                                                              |
   | status           | active                                                                           |
   | tags             | []                                                                               |
   | updated_at       | 2015-10-02T12:43:34Z                                                             |
   | virtual_size     | None                                                                             |
   | visibility       | private                                                                          |
   +------------------+----------------------------------------------------------------------------------+

  but if you then set the get_image_location policy to role:admin, most
  calls return 403:

   $ glance --os-image-api-version 2 image-list
   403 Forbidden: You are not authorized to complete this action. (HTTP 403)

   $ glance --os-image-api-version 2 image-show 13ae74f0-74bf-4792-a8bb-7c622abc5410
   403 Forbidden: You are not authorized to complete this action. (HTTP 403)

   $ glance --os-image-api-version 2 image-delete 13ae74f0-74bf-4792-a8bb-7c622abc5410
   403 Forbidden: You are not authorized to complete this action. (HTTP 403)

  etc.

  As https://review.openstack.org/#/c/48401/ says:

   1. A user should be able to list/show/update/download image without
   needing permission on get_image_location.
   2. A policy failure should result in a 403 return code. We're
   getting a 500

  This is v2 only, v1 works ok.

  [Test Case]

  - Set show_multiple_locations = true on glance-api.conf 
  - Set get_image_location policy to role:admin in /etc/glance/policy.json
  - Run glance --os-image-api-version 2 image-show 13ae74f0-74bf-4792-a8bb-7c622abc5410 , This should work.

  [Regression Potential]

  * None Identified

  [Other Info]

  * Already backported to mitaka/newton.

To manage notifications about this bug go to:
https://bugs.launchpad.net/cloud-archive/+bug/1502136/+subscriptions



More information about the Ubuntu-sponsors mailing list