[Openstack-security] [Bug 1376915] Re: Access to sensitive audit data is not properly restricted
Matthew Edmonds
edmondsw at us.ibm.com
Fri Oct 31 15:30:40 UTC 2014
** Summary changed:
- Ceilometer policy file settings ignored
+ Access to sensitive audit data is not properly restricted
--
You received this bug notification because you are a member of OpenStack
Security Group, which is subscribed to OpenStack.
https://bugs.launchpad.net/bugs/1376915
Title:
Access to sensitive audit data is not properly restricted
Status in OpenStack Telemetry (Ceilometer):
In Progress
Status in OpenStack Security Advisories:
Won't Fix
Bug description:
Configuring the ceilometer policy.json file to restrict certain
actions has no effect whatsoever. This allows all users access to
sensitive information, such as audit data stored in the http.request
meter.
E.g. policy.json file:
{
"adm": "role:admin",
"default": "!",
"meter:get_all": "rule:adm",
"meters:get_all": "rule:adm"
}
With the above policy, tokens for users without the admin role are
still able to access meters, and any token still works for alarms
despite the default supposedly being to disallow for everyone.
To manage notifications about this bug go to:
https://bugs.launchpad.net/ceilometer/+bug/1376915/+subscriptions
More information about the Openstack-security
mailing list