Open Stack

Master review: https://review.openstack.org/#/c/86353/

-- 
You received this bug notification because you are a member of OpenStack
Security Group, which is subscribed to OpenStack.
https://bugs.launchpad.net/bugs/1290537

Title:
  RBAC policy not enforced when adding a security group rule using EC2
  API (CVE-2014-0167)

Status in OpenStack Compute (Nova):
  In Progress
Status in OpenStack Compute (nova) havana series:
  New
Status in OpenStack Security Advisories:
  Fix Committed

Bug description:
  
  It seems that when using the EC2 API, the security group implementation does not enforce RBAC policy for the add_rules, remove_rules, destroy and other functions (in compute/api.py). Only the add_to_instance and remove_from_instance functions enforce RBAC. This seems like an oversight for obvious reasons.

  The Nova API security group implementation does enforce RBAC on these
  functions.

  In addition, the add_to_instance and remove_from _instance functions
  which are wrapped in RBAC verification use the
  "compute:security_groups" action which is not even listed in the
  default /etc/nova/policy.json. The latter is confusing to users.

  This is the case on Grizlly and at first glance, it doesn't look like
  this has changed in Havana.

To manage notifications about this bug go to:
https://bugs.launchpad.net/nova/+bug/1290537/+subscriptions