<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body><p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">Hi,</p>
<br /><p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">Dnia wtorek, 16 maja 2023 23:52:39 CEST Ghanshyam Mann pisze:</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> ---- On Tue, 16 May 2023 07:25:52 -0700 Slawek Kaplonski wrote --- </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > Hi,</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > Dnia wtorek, 16 maja 2023 12:00:34 CEST Paolo Emilio Mazzon pisze:</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > > Hello,</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > > </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > > I'm trying to understand if this is feasible: I would like to avoid a regular user from </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > > tampering the "default" security group of a project. Specifically I would like to prevent </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > > him from deleting sg rules *from the default sg only*</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > > </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > > I can wite a policy.yaml like this</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > > </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > > # Delete a security group rule</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > > # DELETE /security-group-rules/{id}</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > > # Intended scope(s): project</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > > "delete_security_group_rule": "role:project_manager and project_id:%(project_id)s"</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > > </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > > but this is sub-optimal since the regular member can still *add* rules...</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > > </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > > Is it possible to create a rule like</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > > </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > > "sg_is_default" : ...the sg group whose name is 'default'</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > > </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > > so I can write</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > > </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > > "delete_security_group_rule": "not rule:sg_is_default" ?</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > > </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > > Thanks!</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > I'm not sure but I will try to check it later today or tomorrow morning and will let You know if that is possible or not.</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> 'not' operator is supported in oslo policy. I think the below one should work which allows admin to delete the default SG and manager role</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> can delete only non-default SG.</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> NOTE: I have not tested this, may be you can check while trying other combinations.</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> "delete_security_group_rule": "role:project_manager and project_id:%(project_id)s and not 'default':%(name)s or 'default':%(name)s and role:admin"</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> -gmann</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > > </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > > Paolo</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > > </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > > -- </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > > Paolo Emilio Mazzon</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > > System and Network Administrator</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > > </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > > paoloemilio.mazzon[at]unipd.it</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > > </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > > PNC - Padova Neuroscience Center</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > > https://www.pnc.unipd.it</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > > Via Orus 2/B - 35131 Padova, Italy</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > > +39 049 821 2624</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > > </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > > </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > -- </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > Slawek Kaplonski</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > Principal Software Engineer</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> > Red Hat</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> </p>
<br /><p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">I checked it today and it can be done like:</p>
<br /><p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;"><span style="background-color:#ffffff;"><span style="color:#000000;"><span style="font-family:monospace;"> "</span></span><span style="color:#af5f00;">sg_is_default</span><span style="color:#000000;">": "</span><span style="color:#b21818;">field:security_groups:name=default</span><span style="color:#000000;">",</span></span><br /> "delete_security_group": "<span style="background-color:#ffffff;"><span style="color:#b21818;">(role:member and project_id:%(project_id)s and not rule:sg_is_default) or role:admin</span><span style="color:#000000;">"</span></span><br /></p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;"><span style="font-family:Noto Sans;">for <strong>Security Group</strong>.</span></p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">But it <strong>won't work</strong> like that <strong>for security group rules</strong> as You want to rely Your policy on the value of the attribute which belongs to parent resource (name of the Security group when doing API call for SG rule). We had similar problem for the "network:shared" field - see [1] and it was fixed with [2] but that fix is specific for this special field ("network:shared" only). Maybe we would need to add such special handling for the default security group as well. If You would like to have something like that, please open LP bug for it and we can investigate that deeper.</p>
<br /><p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">[1] <a href="https://bugs.launchpad.net/neutron/+bug/1808112">https://bugs.launchpad.net/neutron/+bug/1808112</a></p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">[2] <a href="https://review.opendev.org/c/openstack/neutron/+/652636">https://review.opendev.org/c/openstack/neutron/+/652636</a></p>
<br /><br /><p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">-- </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">Slawek Kaplonski</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">Principal Software Engineer</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">Red Hat</p>
</body>
</html>