On 05/11/2015 10:14, Aline Manera wrote:

Hi Archana,

After some tests, I verified this patch set broke the guest authorization feature.

The guest authorization feature allows user to specify which users and groups can access a specific resource.

For example, in my system:

GET /plugins/kimchi/vms/fedora22
{
  "users":[
    "guest"
  ],
  "screenshot":null,
  "cpus":2,
  "persistent":true,
  "groups":[],
  "graphics":{
    "passwd":null,
    "passwdValidTo":null,
    "type":"vnc",
    "port":null,
    "listen":"127.0.0.1"
  },
  "icon":null,
  "stats":{
    "cpu_utilization":0,
    "io_throughput":0,
    "io_throughput_peak":100,
    "net_throughput":0,
    "mem_utilization":0,
    "net_throughput_peak":100
  },
  "name":"fedora22",
  "uuid":"7a07310c-6fd9-47e4-b8e1-ac5a7bd82c79",
  "access":"full",
  "state":"shutoff",
  "memory":4096.0
}

That means, in addition to sysadmin the user 'guest' can also have access to the virtual machine "fedora22"

After applying this patch, any user can has access to any virtual machine, ie, the guest authorization configuration is being ignored.
See below:

GET /plugins/kimchi/vms/ubuntu15.04
{
  "users":[],
  "screenshot":null,
  "cpus":1,
  "persistent":true,
  "groups":[],
  "graphics":{
    "passwd":null,
    "passwdValidTo":null,
    "type":"vnc",
    "port":null,
    "listen":"127.0.0.1"
  },
  "icon":null,
  "stats":{
    "cpu_utilization":0,
    "io_throughput":0,
    "io_throughput_peak":100,
    "net_throughput":0,
    "mem_utilization":0,
    "net_throughput_peak":100
  },
  "name":"ubuntu15.04",
  "uuid":"aafc4eb0-9f8e-4f8e-b001-390b180c3675",
  "access":"full",
  "state":"shutoff",
  "memory":4096.0
}

If I log into Kimchi as 'guest' user, I can also perform operation on 'ubuntu15.04' virtual machine but as you can see, only the sysadmin should be able to do that.


Just one more information. Without your patch, while trying to access the 'ubuntu15.04' virtual machine as 'guest' user I get the following:

<!DOCTYPE html PUBLIC
"-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
    <meta http-equiv="Content-Type" content="text/html; charset=utf-8"></meta>
    <title>403 Forbidden</title>
    <style type="text/css">
    #powered_by {
        margin-top: 20px;
        border-top: 2px solid black;
        font-style: italic;
    }

    #traceback {
        color: red;
    }
    </style>
</head>
    <body>
        <h2>403 Forbidden</h2>
        <p>WOKAPI0009E: WOKAPI0009E</p>
        <pre id="traceback">Traceback (most recent call last):
  File "/usr/lib/python2.7/dist-packages/cherrypy/_cprequest.py", line 670, in respond
    response.body = self.handler()
  File "/usr/lib/python2.7/dist-packages/cherrypy/lib/encoding.py", line 217, in __call__
    self.body = self.oldhandler(*args, **kwargs)
  File "/usr/lib/python2.7/dist-packages/cherrypy/_cpdispatch.py", line 61, in __call__
    return self.callable(*self.args, **self.kwargs)
  File "/home/alinefm/kimchi/src/wok/control/base.py", line 178, in index
    raise cherrypy.HTTPError(403, e.message)
HTTPError: (403, u'WOKAPI0009E: WOKAPI0009E')
</pre>
    <div id="powered_by">
      <span>
        Powered by <a href="http://www.cherrypy.org">CherryPy 3.5.0</a>
      </span>
    </div>
    </body>
</html>

On 03/11/2015 16:54, archus@linux.vnet.ibm.com wrote:
From: Archana Singh <archus@linux.vnet.ibm.com>

Incase of GET lookup was called twice.
    Once lookup() before is_authorized() and then in self.get().
    This added overhead to system when lookup() is called
    for each value in list from get_list() of Collection.
    So to avoid this overhead, lookup() should not be called
    before self.get().
    
    1) Added lookup() call from Resource's update(), delete().
    2) Removed lookup() call from Resource's index().
    2) As is_authorized() calls self.data which calls self.info.
    Added check to make sure that self.data only get called
    if self.info is not None. And intialized self.info as None
    in __init__. As its value is getting assigned in lookup().
    3) In _generate_action_handler_base(), lookup() was getting
    called before is_authorized(), move its call after is_authorized().

Archana Singh (1):
  Issue #737: Fix to remove twice calls of resource lookup on GET
    OPERATION

 src/wok/control/base.py | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)





_______________________________________________
Kimchi-devel mailing list
Kimchi-devel@ovirt.org
http://lists.ovirt.org/mailman/listinfo/kimchi-devel