[Openstack-security] [Bug 1376915] Re: Ceilometer policy file settings ignored
Jeremy Stanley
fungi at yuggoth.org
Mon Oct 13 15:53:08 UTC 2014
Okay, so it sounds to me like this is a (perhaps contentious and/or
incomplete) design decision in Ceilometer. It's certainly worth
discussing how to improve this in the project going forward, and the
blueprint linked above appears to be an approved solution if anyone
wants to help address the issue. However it does not match the
Vulnerability Management Team's criteria for issuing an OpenStack
Security Advisory since this sort of ongoing development is not likely
to get backported to any existing stable releases, but would instead be
a behavior change/new feature in an upcoming release.
The OpenStack Security Group may be interested in issuing a security
note about this as an addendum to the Security Guide, so I've tagged it
as "security" accordingly.
** Information type changed from Private Security to Public
** Tags added: security
** Changed in: ossa
Status: Incomplete => Won't Fix
--
You received this bug notification because you are a member of OpenStack
Security Group, which is subscribed to OpenStack.
https://bugs.launchpad.net/bugs/1376915
Title:
Ceilometer policy file settings ignored
Status in OpenStack Telemetry (Ceilometer):
New
Status in OpenStack Security Advisories:
Won't Fix
Bug description:
Configuring the ceilometer policy.json file to restrict certain
actions has no effect whatsoever. This allows all users access to
sensitive information, such as audit data stored in the http.request
meter.
E.g. policy.json file:
{
"adm": "role:admin",
"default": "!",
"meter:get_all": "rule:adm",
"meters:get_all": "rule:adm"
}
With the above policy, tokens for users without the admin role are
still able to access meters, and any token still works for alarms
despite the default supposedly being to disallow for everyone.
To manage notifications about this bug go to:
https://bugs.launchpad.net/ceilometer/+bug/1376915/+subscriptions
More information about the Openstack-security
mailing list