From cb37d895a6b97e294aa838f85227d29892f4e11e Mon Sep 17 00:00:00 2001 From: Loganathan Parthipan Date: Thu, 29 Sep 2011 16:41:49 +0100 Subject: Improve access check on images Makes sure that users can delete only their own images, snapshots. Enable listing of all images, both private which are owned and the public ones. Only list the private images/snapshots for the owner and admin users. Fixes bug 863305 Change-Id: I7326ec4a99158c8db5319f2397c99c5a89be2cb5 --- nova/image/glance.py | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) (limited to 'nova/image') diff --git a/nova/image/glance.py b/nova/image/glance.py index 9a915d02d..539e7e537 100644 --- a/nova/image/glance.py +++ b/nova/image/glance.py @@ -286,10 +286,28 @@ class GlanceImageService(object): """Delete the given image. :raises: ImageNotFound if the image does not exist. + :raises: NotAuthorized if the user is not an owner. """ # NOTE(vish): show is to check if image is available - self.show(context, image_id) + image_meta = self.show(context, image_id) + + if FLAGS.use_deprecated_auth: + # NOTE(parthi): only allow image deletions if the user + # is a member of the project owning the image, in case of + # setup without keystone + # TODO Currently this access control breaks if + # 1. Image is not owned by a project + # 2. Deleting user is not bound a project + properties = image_meta['properties'] + if (context.project_id and ('project_id' in properties) + and (context.project_id != properties['project_id'])): + raise exception.NotAuthorized(_("Not the image owner")) + + if (context.project_id and ('owner_id' in properties) + and (context.project_id != properties['owner_id'])): + raise exception.NotAuthorized(_("Not the image owner")) + try: result = self._get_client(context).delete_image(image_id) except glance_exception.NotFound: @@ -329,6 +347,9 @@ class GlanceImageService(object): properties = image_meta['properties'] + if context.project_id and ('owner_id' in properties): + return str(properties['owner_id']) == str(context.project_id) + if context.project_id and ('project_id' in properties): return str(properties['project_id']) == str(context.project_id) -- cgit