[Openstack-security] [Bug 1654598] Re: User can list other tenant's and admin's export locations
Author: Tom Barron <tpb at dyncloud.net>
Date: Sun Mar 1 13:12:08 2020 +0100
Enforce policy checks for share export locations
(cherry picked from commit 84daeb481d852d6531df11e842df1a70672d938c)
** Changed in: manila/train
Status: In Progress => Fix Committed
You received this bug notification because you are a member of OpenStack
Security SIG, which is subscribed to OpenStack.
User can list other tenant's and admin's export locations
Status in Manila:
Status in Manila ocata series:
Status in Manila pike series:
Status in Manila queens series:
Status in Manila rocky series:
Status in Manila stein series:
Status in Manila train series:
Status in Manila ussuri series:
Currently, the share export locations API is allowing any tenant to
obtain export locations of any tenant's share.
See the below URL:
64350ec996cb4d91bfaa728fd7199313: this is a non-admin tenant ID
e93eb079-58fb-4758-9d95-a9a645b0250a: this is an admin's share ID
This is because the API layer of the share export locations controller
is going directly to the database to obtain the export locations of
the supplied share ID.
The ownership check is performed at the Share/API layer, which is not
invoked in this workflow.
Most surprisingly of all, the tempest tests:
... should not be passing at all (and should be negative tests), as
they are testing if a non-admin tenant is able to obtain and list
export locations of a share created by the admin_client used by
To manage notifications about this bug go to: