On 12/10/2014 04:05 PM, Jeremy Stanley wrote:
On 2014-12-10 15:34:57 -0500 (-0500), Jay Pipes wrote:
On 12/10/2014 02:43 PM, George Shuklin wrote:
I have some small discussion in launchpad: is lack of a quota
for unprivileged user counted as security bug (or at least as a
bug)?
If user can create 100500 objects in database via normal API and
ops have no way to restrict this, is it OK for Openstack or not?
That would be a major security bug. Please do file one and we'll
get on it immediately.
I think the bigger question is whether the lack of a quota
implementation for everything a tenant could ever possibly create is
something we should have reported in secret, worked under embargo,
backported to supported stable branches, and announced via
high-profile security advisories once fixed.
Sure, fine.
-jay
_______________________________________________
OpenStack-dev mailing list
[email protected]
http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev
