Hello community, here is the log from the commit of package python-oslo.policy for openSUSE:Factory checked in at 2018-10-01 08:18:17 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python-oslo.policy (Old) and /work/SRC/openSUSE:Factory/.python-oslo.policy.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python-oslo.policy" Mon Oct 1 08:18:17 2018 rev:9 rq:638871 version:1.38.1 Changes: -------- --- /work/SRC/openSUSE:Factory/python-oslo.policy/python-oslo.policy.changes 2018-09-07 15:39:00.746561348 +0200 +++ /work/SRC/openSUSE:Factory/.python-oslo.policy.new/python-oslo.policy.changes 2018-10-01 08:18:23.209930680 +0200 @@ -1,0 +2,15 @@ +Wed Sep 19 23:17:37 UTC 2018 - cloud-de...@suse.de + +- update to version 1.38.1 + - Pass dictionary as creds in policy tests + - fix tox python3 overrides + - trivial: Fix file permissions + - Add CLI usage documentation + - Add blueprints and releasenotes link to README + - Teach Enforcer.enforce to deal with context objects + - Avoid redundant policy syntax checks + - Add examples and clarification around scope_types + - Fix requirements and convert to stestr + - Clarify CLI documentation + +------------------------------------------------------------------- Old: ---- oslo.policy-1.37.0.tar.gz New: ---- oslo.policy-1.38.1.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python-oslo.policy.spec ++++++ --- /var/tmp/diff_new_pack.om6s48/_old 2018-10-01 08:18:24.141930085 +0200 +++ /var/tmp/diff_new_pack.om6s48/_new 2018-10-01 08:18:24.145930082 +0200 @@ -12,39 +12,46 @@ # license that conforms to the Open Source Definition (Version 1.9) # published by the Open Source Initiative. -# Please submit bugfixes or comments via http://bugs.opensuse.org/ +# Please submit bugfixes or comments via https://bugs.opensuse.org/ # Name: python-oslo.policy -Version: 1.37.0 +Version: 1.38.1 Release: 0 Summary: OpenStack Oslo Policy library License: Apache-2.0 Group: Development/Languages/Python URL: https://launchpad.net/oslo.policy -Source0: https://files.pythonhosted.org/packages/source/o/oslo.policy/oslo.policy-1.37.0.tar.gz +Source0: https://files.pythonhosted.org/packages/source/o/oslo.policy/oslo.policy-1.38.1.tar.gz BuildRequires: openstack-macros BuildRequires: python-devel BuildRequires: python2-PyYAML >= 3.12 +BuildRequires: python2-docutils BuildRequires: python2-oslo.config >= 5.2.0 +BuildRequires: python2-oslo.context >= 2.21.0 BuildRequires: python2-oslo.i18n >= 3.15.3 BuildRequires: python2-oslo.serialization >= 2.18.0 BuildRequires: python2-oslotest BuildRequires: python2-pbr BuildRequires: python2-requests >= 2.14.2 BuildRequires: python2-requests-mock +BuildRequires: python2-stestr BuildRequires: python3-PyYAML >= 3.12 BuildRequires: python3-devel +BuildRequires: python3-docutils BuildRequires: python3-oslo.config >= 5.2.0 +BuildRequires: python3-oslo.context >= 2.21.0 BuildRequires: python3-oslo.i18n >= 3.15.3 BuildRequires: python3-oslo.serialization >= 2.18.0 BuildRequires: python3-oslotest BuildRequires: python3-pbr BuildRequires: python3-requests >= 2.14.2 BuildRequires: python3-requests-mock +BuildRequires: python3-stestr Requires: python-PyYAML >= 3.12 Requires: python-oslo.config >= 5.2.0 +Requires: python-oslo.context >= 2.21.0 Requires: python-oslo.i18n >= 3.15.3 Requires: python-oslo.serialization >= 2.18.0 Requires: python-requests >= 2.14.2 @@ -68,14 +75,16 @@ %package -n python-oslo.policy-doc Summary: Documentation for the Oslo Policy library Group: Documentation/HTML -BuildRequires: python-Sphinx -BuildRequires: python-openstackdocstheme +BuildRequires: python2-Sphinx +BuildRequires: python2-openstackdocstheme +BuildRequires: python3-Sphinx +BuildRequires: python3-openstackdocstheme %description -n python-oslo.policy-doc Documentation for the Oslo Policy library. %prep -%autosetup -p1 -n oslo.policy-1.37.0 +%autosetup -p1 -n oslo.policy-1.38.1 %py_req_cleanup sed -i 's/^warning-is-error.*/warning-is-error = 0/g' setup.cfg @@ -101,9 +110,7 @@ %python_uninstall_alternative oslopolicy-checker %check -%{python_expand rm -rf .testrepository -python setup.py testr -} +%python_exec -m stestr.cli run %files %{python_files} %license LICENSE ++++++ oslo.policy-1.37.0.tar.gz -> oslo.policy-1.38.1.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/oslo.policy-1.37.0/.stestr.conf new/oslo.policy-1.38.1/.stestr.conf --- old/oslo.policy-1.37.0/.stestr.conf 1970-01-01 01:00:00.000000000 +0100 +++ new/oslo.policy-1.38.1/.stestr.conf 2018-07-20 03:10:38.000000000 +0200 @@ -0,0 +1,3 @@ +[DEFAULT] +test_path=./oslo_policy/tests +top_path=./ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/oslo.policy-1.37.0/.testr.conf new/oslo.policy-1.38.1/.testr.conf --- old/oslo.policy-1.37.0/.testr.conf 2018-06-05 20:03:29.000000000 +0200 +++ new/oslo.policy-1.38.1/.testr.conf 1970-01-01 01:00:00.000000000 +0100 @@ -1,7 +0,0 @@ -[DEFAULT] -test_command=OS_STDOUT_CAPTURE=${OS_STDOUT_CAPTURE:-1} \ - OS_STDERR_CAPTURE=${OS_STDERR_CAPTURE:-1} \ - OS_TEST_TIMEOUT=${OS_TEST_TIMEOUT:-60} \ - ${PYTHON:-python} -m subunit.run discover -t ./ ./oslo_policy $LISTOPT $IDOPTION -test_id_option=--load-list $IDFILE -test_list_option=--list diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/oslo.policy-1.37.0/AUTHORS new/oslo.policy-1.38.1/AUTHORS --- old/oslo.policy-1.37.0/AUTHORS 2018-06-05 20:06:26.000000000 +0200 +++ new/oslo.policy-1.38.1/AUTHORS 2018-07-20 03:13:42.000000000 +0200 @@ -56,6 +56,7 @@ Mark McClain <mark.mccl...@dreamhost.com> Mark McLoughlin <mar...@redhat.com> Maruti <maruti.ka...@hp.com> +Mateusz Kowalski <mateusz.kowal...@cern.ch> Michael McCune <m...@redhat.com> Monty Taylor <mord...@inaugust.com> Nathan Kinder <nkin...@redhat.com> @@ -99,4 +100,5 @@ ricolin <rico....@easystack.cn> sonu.kumar <sonu.ku...@nectechnologies.in> vponomaryov <vponomar...@mirantis.com> +zhangbailin <zhangbai...@inspur.com> zhangyanxian <zhangyanxianm...@163.com> diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/oslo.policy-1.37.0/ChangeLog new/oslo.policy-1.38.1/ChangeLog --- old/oslo.policy-1.37.0/ChangeLog 2018-06-05 20:06:26.000000000 +0200 +++ new/oslo.policy-1.38.1/ChangeLog 2018-07-20 03:13:42.000000000 +0200 @@ -1,9 +1,25 @@ CHANGES ======= +1.38.1 +------ + +* Avoid redundant policy syntax checks + +1.38.0 +------ + +* Teach Enforcer.enforce to deal with context objects +* Pass dictionary as creds in policy tests +* Fix requirements and convert to stestr +* Add blueprints and releasenotes link to README +* fix tox python3 overrides + 1.37.0 ------ +* Add CLI usage documentation +* Clarify CLI documentation * Remove erroneous newline in sample generation * Update sphinxext to include scope\_types in docs @@ -11,8 +27,10 @@ ------ * Fix document formatting +* Add examples and clarification around scope\_types * Include deprecated\_reason when deprecated\_rule is set * Include both new and deprecated rules in generated sample +* trivial: Fix file permissions 1.35.0 ------ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/oslo.policy-1.37.0/PKG-INFO new/oslo.policy-1.38.1/PKG-INFO --- old/oslo.policy-1.37.0/PKG-INFO 2018-06-05 20:06:27.000000000 +0200 +++ new/oslo.policy-1.38.1/PKG-INFO 2018-07-20 03:13:43.000000000 +0200 @@ -1,6 +1,6 @@ Metadata-Version: 1.1 Name: oslo.policy -Version: 1.37.0 +Version: 1.38.1 Summary: Oslo Policy library Home-page: https://docs.openstack.org/oslo.policy/latest/ Author: OpenStack @@ -34,6 +34,8 @@ * Documentation: https://docs.openstack.org/oslo.policy/latest/ * Source: https://git.openstack.org/cgit/openstack/oslo.policy * Bugs: https://bugs.launchpad.net/oslo.policy + * Blueprints: https://blueprints.launchpad.net/oslo.policy + * Release Notes: https://docs.openstack.org/releasenotes/oslo.policy Platform: UNKNOWN diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/oslo.policy-1.37.0/README.rst new/oslo.policy-1.38.1/README.rst --- old/oslo.policy-1.37.0/README.rst 2018-06-05 20:03:29.000000000 +0200 +++ new/oslo.policy-1.38.1/README.rst 2018-07-20 03:10:38.000000000 +0200 @@ -26,4 +26,5 @@ * Documentation: https://docs.openstack.org/oslo.policy/latest/ * Source: https://git.openstack.org/cgit/openstack/oslo.policy * Bugs: https://bugs.launchpad.net/oslo.policy - +* Blueprints: https://blueprints.launchpad.net/oslo.policy +* Release Notes: https://docs.openstack.org/releasenotes/oslo.policy diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/oslo.policy-1.37.0/RELEASENOTES.rst new/oslo.policy-1.38.1/RELEASENOTES.rst --- old/oslo.policy-1.37.0/RELEASENOTES.rst 2018-06-05 20:06:27.000000000 +0200 +++ new/oslo.policy-1.38.1/RELEASENOTES.rst 2018-07-20 03:13:43.000000000 +0200 @@ -2,6 +2,66 @@ oslo.policy =========== +.. _oslo.policy_1.38.1: + +1.38.1 +====== + +.. _oslo.policy_1.38.1_Bug Fixes: + +Bug Fixes +--------- + +.. releasenotes/notes/policy-check-performance-fbad83c7a4afd7d7.yaml @ b'909a1ea3a7aceb6e0637058b9c6a53d14043d6d1' + +- As reported in launchpad bug 1723030, under some circumstances policy + checks caused a significant performance degradation. This release includes + improved logic around rule validation to prevent that. + + +.. _oslo.policy_1.38.0: + +1.38.0 +====== + +.. _oslo.policy_1.38.0_New Features: + +New Features +------------ + +.. releasenotes/notes/bug-1779172-c1323c0f647bc44c.yaml @ b'775641a5fc549c20be37cf862deca394bf7f2d21' + +- [`bug 1779172 <https://bugs.launchpad.net/keystone/+bug/1779172>`_] + The ``enforce()`` method now supports the ability to parse ``oslo.context`` + objects if passed into ``enforce()`` as ``creds``. This provides more + consistent policy enforcement for service developers by ensuring the + attributes provided in policy enforcement are standardized. In this case + they are being standardized through the + ``oslo_context.context.RequestContext.to_policy_values()`` method. + + +.. _oslo.policy_1.38.0_Bug Fixes: + +Bug Fixes +--------- + +.. releasenotes/notes/bug-1779172-c1323c0f647bc44c.yaml @ b'775641a5fc549c20be37cf862deca394bf7f2d21' + +- [`bug 1779172 <https://bugs.launchpad.net/keystone/+bug/1779172>`_] + The ``enforce()`` method now supports the ability to parse ``oslo.context`` + objects if passed into ``enforce()`` as ``creds``. This provides more + consistent policy enforcement for service developers by ensuring the + attributes provided in policy enforcement are standardized. In this case + they are being standardized through the + ``oslo_context.context.RequestContext.to_policy_values()`` method. + +.. releasenotes/notes/expand-cli-docs-02c2f13adbe251c0.yaml @ b'3fe95b2aebde226bab0d710885f60a1862499b16' + +- [`bug 1741073 <https://bugs.launchpad.net/oslo.policy/+bug/1741073>`_] + Documentation has been improved to include ``oslopolicy-sample-generator`` + and ``oslopolicy-list-redundant`` usage. + + .. _oslo.policy_1.37.0: 1.37.0 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/oslo.policy-1.37.0/doc/source/cli/index.rst new/oslo.policy-1.38.1/doc/source/cli/index.rst --- old/oslo.policy-1.37.0/doc/source/cli/index.rst 2018-06-05 20:03:29.000000000 +0200 +++ new/oslo.policy-1.38.1/doc/source/cli/index.rst 2018-07-20 03:10:38.000000000 +0200 @@ -2,6 +2,12 @@ Command Line Interface ====================== +This document describes the various command line tools exposed by +``oslo.policy`` to manage policies and policy files. + +oslopolicy-checker +================== + Run the command line ``oslopolicy-checker`` to check policy against the OpenStack Identity API access information. @@ -44,3 +50,67 @@ --policy /opt/stack/nova/etc/nova/policy.json \ --access sample_data/auth_v3_token_member.json \ --rule compute_extension:flavorextraspecs:index + +oslopolicy-sample-generator +=========================== + +The ``oslopolicy-sample-generator`` command can be used to generate a sample +policy file based on the default policies in a given namespace. This tool +requires a namespace to query for policies and supports output in JSON or YAML. + +Examples +-------- + +To generate sample policies for a namespace called ``keystone``: + +.. code-block:: bash + + oslopolicy-sample-generator --namespace keystone + + +To generate sample policies in JSON use: + +.. code-block:: bash + + oslopolicy-sample-generator --namespace nova --format json + +To generate a sample policy file and output directly to a file: + +.. code-block:: bash + + oslopolicy-sample-generator --namespace keystone \ + --format yaml \ + --output-file keystone-policy.yaml + +Use the following to generate help text for additional options and arguments +supported by ``oslopolicy-sample-generator``: + +.. code-block:: bash + + oslopolicy-sample-generator --help + +oslopolicy-list-redundant +========================= + +The ``oslopolicy-list-redundant`` tool is useful for detecting policies that +are specified in policy files that are the same as the defaults provided by the +service. Operators can use this tool to find policies that they can remove from +their policy files, making maintenance easier. + +This tool assumes a policy file containing overrides exists and is specified +through configuration. + +Examples +-------- + +To list redundant default policies: + +.. code-block:: bash + + oslopolicy-list-redundant --namespace keystone --config-dir /etc/keystone + +For more information regarding the options supported by this tool: + +.. code-block:: bash + + oslopolicy-list-redundant --help diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/oslo.policy-1.37.0/doc/source/user/usage.rst new/oslo.policy-1.38.1/doc/source/user/usage.rst --- old/oslo.policy-1.37.0/doc/source/user/usage.rst 2018-06-05 20:03:29.000000000 +0200 +++ new/oslo.policy-1.38.1/doc/source/user/usage.rst 2018-07-20 03:10:38.000000000 +0200 @@ -188,7 +188,56 @@ attribute can only be set at rule definition and never overridden via a policy file. This variable is designed to save the scope at which a policy should operate. During enforcement, the information in `scope_types` is compared to -the scope of the token used in the request. +the scope of the token used in the request. It is designed to match the +available token scopes available from keystone, which are `system`, `domain`, +and `project`. The examples highlighted here will show the usage with system +and project APIs. Setting `scope_types` to anything but these three values is +unsupported. + +For example, a policy that is used to protect a resource tracked in a project +should require a project-scoped token. This can be expressed with `scope_types` +as follows:: + + policy.DocumentedRuleDefault( + name='service:create_foo', + check_str='role:admin', + scope_types=['project'], + description='Creates a foo resource', + operations=[ + { + 'path': '/v1/foos/', + 'method': 'POST' + } + ] + ) + +A policy that is used to protect system-level resources can follow the same +pattern:: + + policy.DocumentedRuleDefault( + name='service:update_bar', + check_str='role:admin', + scope_types=['system'], + description='Updates a bar resource', + operations=[ + { + 'path': '/v1/bars/{bar_id}', + 'method': 'PATCH' + } + ] + ) + +The `scope_types` attribute makes sure the token used to make the request is +scoped properly and passes the `check_str`. This is powerful because it allows +roles to be reused across different authorization levels without compromising +APIs. For example, the `admin` role in the above example is used at the +project-level and the system-level to protect two different resources. If we +only checked that the token contained the `admin` role, it would be possible +for a user with a project-scoped token to access a system-level API. + +Developers incorporating `scope_types` into OpenStack services should be +mindful of the relationship between the API they are protecting with a policy +and if it operates on system-level resources or project-level resources. Sample file generation ---------------------- diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/oslo.policy-1.37.0/lower-constraints.txt new/oslo.policy-1.38.1/lower-constraints.txt --- old/oslo.policy-1.37.0/lower-constraints.txt 2018-06-05 20:03:29.000000000 +0200 +++ new/oslo.policy-1.38.1/lower-constraints.txt 2018-07-20 03:10:38.000000000 +0200 @@ -28,6 +28,7 @@ openstackdocstheme==1.18.1 os-client-config==1.28.0 oslo.config==5.2.0 +oslo.context==2.21.0 oslo.i18n==3.15.3 oslo.serialization==2.18.0 oslo.utils==3.33.0 @@ -47,6 +48,7 @@ requestsexceptions==1.2.0 rfc3986==0.3.1 six==1.10.0 +stestr==2.0.0 smmap==0.9.0 snowballstemmer==1.2.1 Sphinx==1.6.5 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/oslo.policy-1.37.0/oslo.policy.egg-info/PKG-INFO new/oslo.policy-1.38.1/oslo.policy.egg-info/PKG-INFO --- old/oslo.policy-1.37.0/oslo.policy.egg-info/PKG-INFO 2018-06-05 20:06:26.000000000 +0200 +++ new/oslo.policy-1.38.1/oslo.policy.egg-info/PKG-INFO 2018-07-20 03:13:42.000000000 +0200 @@ -1,6 +1,6 @@ Metadata-Version: 1.1 Name: oslo.policy -Version: 1.37.0 +Version: 1.38.1 Summary: Oslo Policy library Home-page: https://docs.openstack.org/oslo.policy/latest/ Author: OpenStack @@ -34,6 +34,8 @@ * Documentation: https://docs.openstack.org/oslo.policy/latest/ * Source: https://git.openstack.org/cgit/openstack/oslo.policy * Bugs: https://bugs.launchpad.net/oslo.policy + * Blueprints: https://blueprints.launchpad.net/oslo.policy + * Release Notes: https://docs.openstack.org/releasenotes/oslo.policy Platform: UNKNOWN diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/oslo.policy-1.37.0/oslo.policy.egg-info/SOURCES.txt new/oslo.policy-1.38.1/oslo.policy.egg-info/SOURCES.txt --- old/oslo.policy-1.37.0/oslo.policy.egg-info/SOURCES.txt 2018-06-05 20:06:26.000000000 +0200 +++ new/oslo.policy-1.38.1/oslo.policy.egg-info/SOURCES.txt 2018-07-20 03:13:43.000000000 +0200 @@ -1,6 +1,6 @@ .coveragerc .mailmap -.testr.conf +.stestr.conf .zuul.yaml AUTHORS CONTRIBUTING.rst @@ -69,9 +69,12 @@ releasenotes/notes/add-sphinxpolicygen-39e2f8fa24930b0c.yaml releasenotes/notes/add_custom_rule_check_plugins-3c15c2c7ca5e.yaml releasenotes/notes/add_reno-3b4ae0789e9c45b4.yaml +releasenotes/notes/bug-1779172-c1323c0f647bc44c.yaml releasenotes/notes/enforce_scope_types-1e92f6a34e4173ef.yaml +releasenotes/notes/expand-cli-docs-02c2f13adbe251c0.yaml releasenotes/notes/fix-rendering-for-deprecated-rules-d465292e4155f483.yaml releasenotes/notes/oslo-policy-descriptive-support-3ee688c5fa48d751.yaml +releasenotes/notes/policy-check-performance-fbad83c7a4afd7d7.yaml releasenotes/source/conf.py releasenotes/source/index.rst releasenotes/source/newton.rst diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/oslo.policy-1.37.0/oslo.policy.egg-info/pbr.json new/oslo.policy-1.38.1/oslo.policy.egg-info/pbr.json --- old/oslo.policy-1.37.0/oslo.policy.egg-info/pbr.json 2018-06-05 20:06:26.000000000 +0200 +++ new/oslo.policy-1.38.1/oslo.policy.egg-info/pbr.json 2018-07-20 03:13:42.000000000 +0200 @@ -1 +1 @@ -{"git_version": "7a50c85", "is_release": true} \ No newline at end of file +{"git_version": "0fc941f", "is_release": true} \ No newline at end of file diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/oslo.policy-1.37.0/oslo.policy.egg-info/requires.txt new/oslo.policy-1.38.1/oslo.policy.egg-info/requires.txt --- old/oslo.policy-1.37.0/oslo.policy.egg-info/requires.txt 2018-06-05 20:06:26.000000000 +0200 +++ new/oslo.policy-1.38.1/oslo.policy.egg-info/requires.txt 2018-07-20 03:13:42.000000000 +0200 @@ -1,5 +1,6 @@ requests>=2.14.2 oslo.config>=5.2.0 +oslo.context>=2.21.0 oslo.i18n>=3.15.3 oslo.serialization!=2.19.1,>=2.18.0 PyYAML>=3.12 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/oslo.policy-1.37.0/oslo_policy/policy.py new/oslo.policy-1.38.1/oslo_policy/policy.py --- old/oslo.policy-1.37.0/oslo_policy/policy.py 2018-06-05 20:03:29.000000000 +0200 +++ new/oslo.policy-1.38.1/oslo_policy/policy.py 2018-07-20 03:10:38.000000000 +0200 @@ -221,12 +221,14 @@ desired rule name. """ +import collections import copy import logging import os import warnings from oslo_config import cfg +from oslo_context import context from oslo_serialization import jsonutils import six import yaml @@ -342,6 +344,13 @@ super(InvalidRuleDefault, self).__init__(msg) +class InvalidContextObject(Exception): + def __init__(self, error): + msg = (_('Invalid context object: ' + '%(error)s.') % {'error': error}) + super(InvalidContextObject, self).__init__(msg) + + def parse_file_contents(data): """Parse the raw contents of a policy file. @@ -487,6 +496,7 @@ self.policy_file = policy_file or self.conf.oslo_policy.policy_file self.use_conf = use_conf + self._need_check_rule = True self.overwrite = overwrite self._loaded_files = [] self._policy_dir_mtimes = {} @@ -506,6 +516,7 @@ raise TypeError(_('Rules must be an instance of dict or Rules, ' 'got %s instead') % type(rules)) self.use_conf = use_conf + self._need_check_rule = True if overwrite: self.rules = Rules(rules, self.default_rule) else: @@ -627,7 +638,9 @@ self.rules[default.name] = default.check # Detect and log obvious incorrect rule definitions - self.check_rules() + if self._need_check_rule: + self.check_rules() + self._need_check_rule = False def check_rules(self, raise_on_violation=False): """Look for rule definitions that are obviously incorrect.""" @@ -789,7 +802,8 @@ the Mapping abstract base class and deep copying. :param dict creds: As much information about the user performing the - action as possible. + action as possible. This parameter can also be an + instance of ``oslo_context.context.RequestContext``. :param do_raise: Whether to raise an exception or not if check fails. :param exc: Class of the exception to raise if the check fails. @@ -807,6 +821,23 @@ self.load_rules() + if isinstance(creds, context.RequestContext): + creds = self._map_context_attributes_into_creds(creds) + # NOTE(lbragstad): The oslo.context library exposes the ability to call + # a method on RequestContext objects that converts attributes of the + # context object to policy values. However, ``to_policy_values()`` + # doesn't actually return a dictionary, it's a subclass of + # collections.MutableMapping, which behaves like a dictionary but + # doesn't pass the type check. + elif not isinstance(creds, collections.MutableMapping): + msg = ( + 'Expected type oslo_context.context.RequestContext, dict, or ' + 'the output of ' + 'oslo_context.context.RequestContext.to_policy_values but ' + 'got %(creds_type)s instead' % {'creds_type': type(creds)} + ) + raise InvalidContextObject(msg) + # Allow the rule to be a Check tree if isinstance(rule, _checks.BaseCheck): # If the thing we're given is a Check, we don't know the @@ -881,6 +912,27 @@ return result + def _map_context_attributes_into_creds(self, context): + creds = {} + # port public context attributes into the creds dictionary so long as + # the attribute isn't callable + context_values = context.to_policy_values() + for k, v in context_values.items(): + creds[k] = v + + # NOTE(lbragstad): We unfortunately have to special case this + # attribute. Originally when the system scope when into oslo.policy, we + # checked for a key called 'system' in creds. The oslo.context library + # uses `system_scope` instead, and the compatibility between + # oslo.policy and oslo.context was an afterthought. We'll have to + # support services who've been setting creds['system'], but we can do + # that by making sure we populate it with what's in the context object + # if it has a system_scope attribute. + if context.system_scope: + creds['system'] = context.system_scope + + return creds + def register_default(self, default): """Registers a RuleDefault. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/oslo.policy-1.37.0/oslo_policy/tests/test_policy.py new/oslo.policy-1.38.1/oslo_policy/tests/test_policy.py --- old/oslo.policy-1.37.0/oslo_policy/tests/test_policy.py 2018-06-05 20:03:29.000000000 +0200 +++ new/oslo.policy-1.38.1/oslo_policy/tests/test_policy.py 2018-07-20 03:10:38.000000000 +0200 @@ -19,6 +19,7 @@ import mock from oslo_config import cfg +from oslo_context import context from oslo_serialization import jsonutils from oslotest import base as test_base import six @@ -390,6 +391,66 @@ group='oslo_policy') self.assertRaises(ValueError, self.enforcer.load_rules, True) + @mock.patch('oslo_policy.policy.Enforcer.check_rules') + def test_load_rules_twice(self, mock_check_rules): + self.enforcer.load_rules() + self.enforcer.load_rules() + self.assertEqual(1, mock_check_rules.call_count) + + @mock.patch('oslo_policy.policy.Enforcer.check_rules') + def test_load_rules_twice_force(self, mock_check_rules): + self.enforcer.load_rules(True) + self.enforcer.load_rules(True) + self.assertEqual(2, mock_check_rules.call_count) + + @mock.patch('oslo_policy.policy.Enforcer.check_rules') + def test_load_rules_twice_clear(self, mock_check_rules): + self.enforcer.load_rules() + self.enforcer.clear() + # NOTE(bnemec): It's weird that we have to pass True here, but clear + # sets enforcer.use_conf to False, which causes load_rules to be a + # noop when called with no parameters. This is probably a bug. + self.enforcer.load_rules(True) + self.assertEqual(2, mock_check_rules.call_count) + + @mock.patch('oslo_policy.policy.Enforcer.check_rules') + def test_load_directory_twice(self, mock_check_rules): + self.create_config_file( + os.path.join('policy.d', 'a.conf'), POLICY_A_CONTENTS) + self.create_config_file( + os.path.join('policy.d', 'b.conf'), POLICY_B_CONTENTS) + self.enforcer.load_rules() + self.enforcer.load_rules() + self.assertEqual(1, mock_check_rules.call_count) + self.assertIsNotNone(self.enforcer.rules) + + @mock.patch('oslo_policy.policy.Enforcer.check_rules') + def test_load_directory_twice_force(self, mock_check_rules): + self.create_config_file( + os.path.join('policy.d', 'a.conf'), POLICY_A_CONTENTS) + self.create_config_file( + os.path.join('policy.d', 'b.conf'), POLICY_B_CONTENTS) + self.enforcer.load_rules(True) + self.enforcer.load_rules(True) + self.assertEqual(2, mock_check_rules.call_count) + self.assertIsNotNone(self.enforcer.rules) + + @mock.patch('oslo_policy.policy.Enforcer.check_rules') + def test_load_directory_twice_changed(self, mock_check_rules): + self.create_config_file( + os.path.join('policy.d', 'a.conf'), POLICY_A_CONTENTS) + self.enforcer.load_rules() + + # Touch the file + conf_path = os.path.join(self.config_dir, os.path.join( + 'policy.d', 'a.conf')) + stinfo = os.stat(conf_path) + os.utime(conf_path, (stinfo.st_atime + 10, stinfo.st_mtime + 10)) + + self.enforcer.load_rules() + self.assertEqual(2, mock_check_rules.call_count) + self.assertIsNotNone(self.enforcer.rules) + def test_set_rules_type(self): self.assertRaises(TypeError, self.enforcer.set_rules, @@ -646,6 +707,89 @@ self.enforcer.authorize, 'test', {}, {'roles': ['test']}) + def test_enforcer_accepts_context_objects(self): + rule = policy.RuleDefault(name='fake_rule', check_str='role:test') + self.enforcer.register_default(rule) + + request_context = context.RequestContext() + target_dict = {} + self.enforcer.enforce('fake_rule', target_dict, request_context) + + def test_enforcer_accepts_subclassed_context_objects(self): + rule = policy.RuleDefault(name='fake_rule', check_str='role:test') + self.enforcer.register_default(rule) + + class SpecializedContext(context.RequestContext): + pass + + request_context = SpecializedContext() + target_dict = {} + self.enforcer.enforce('fake_rule', target_dict, request_context) + + def test_enforcer_rejects_non_context_objects(self): + rule = policy.RuleDefault(name='fake_rule', check_str='role:test') + self.enforcer.register_default(rule) + + class InvalidContext(object): + pass + + request_context = InvalidContext() + target_dict = {} + self.assertRaises( + policy.InvalidContextObject, self.enforcer.enforce, 'fake_rule', + target_dict, request_context + ) + + @mock.patch.object(policy.Enforcer, '_map_context_attributes_into_creds') + def test_enforcer_call_map_context_attributes(self, map_mock): + rule = policy.RuleDefault(name='fake_rule', check_str='role:test') + self.enforcer.register_default(rule) + + request_context = context.RequestContext() + target_dict = {} + self.enforcer.enforce('fake_rule', target_dict, request_context) + map_mock.assert_called_once_with(request_context) + + def test_enforcer_consolidates_context_attributes_with_creds(self): + request_context = context.RequestContext() + expected_creds = request_context.to_policy_values() + + creds = self.enforcer._map_context_attributes_into_creds( + request_context + ) + + # We don't use self.assertDictEqual here because to_policy_values + # actaully returns a non-dict object that just behaves like a + # dictionary, but does some special handling when people access + # deprecated policy values. + for k, v in expected_creds.items(): + self.assertEqual(expected_creds[k], creds[k]) + + def test_map_context_attributes_populated_system(self): + request_context = context.RequestContext(system_scope='all') + expected_creds = request_context.to_policy_values() + expected_creds['system'] = 'all' + + creds = self.enforcer._map_context_attributes_into_creds( + request_context + ) + + # We don't use self.assertDictEqual here because to_policy_values + # actaully returns a non-dict object that just behaves like a + # dictionary, but does some special handling when people access + # deprecated policy values. + for k, v in expected_creds.items(): + self.assertEqual(expected_creds[k], creds[k]) + + def test_enforcer_accepts_policy_values_from_context(self): + rule = policy.RuleDefault(name='fake_rule', check_str='role:test') + self.enforcer.register_default(rule) + + request_context = context.RequestContext() + policy_values = request_context.to_policy_values() + target_dict = {} + self.enforcer.enforce('fake_rule', target_dict, policy_values) + class EnforcerNoPolicyFileTest(base.PolicyBaseTestCase): def setUp(self): @@ -697,15 +841,17 @@ def test_check_explicit(self): rule = base.FakeCheck() - result = self.enforcer.enforce(rule, 'target', 'creds') - self.assertEqual(('target', 'creds', self.enforcer), result) + creds = {} + result = self.enforcer.enforce(rule, 'target', creds) + self.assertEqual(('target', creds, self.enforcer), result) def test_check_no_rules(self): # Clear the policy.json file created in setUp() self.create_config_file('policy.json', "{}") self.enforcer.default_rule = None self.enforcer.load_rules() - result = self.enforcer.enforce('rule', 'target', 'creds') + creds = {} + result = self.enforcer.enforce('rule', 'target', creds) self.assertFalse(result) def test_check_with_rule(self): @@ -722,7 +868,8 @@ self.create_config_file('policy.json', jsonutils.dumps({"a_rule": []})) self.enforcer.default_rule = None self.enforcer.load_rules() - result = self.enforcer.enforce('rule', 'target', 'creds') + creds = {} + result = self.enforcer.enforce('rule', 'target', creds) self.assertFalse(result) def test_check_raise_default(self): diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/oslo.policy-1.37.0/releasenotes/notes/bug-1779172-c1323c0f647bc44c.yaml new/oslo.policy-1.38.1/releasenotes/notes/bug-1779172-c1323c0f647bc44c.yaml --- old/oslo.policy-1.37.0/releasenotes/notes/bug-1779172-c1323c0f647bc44c.yaml 1970-01-01 01:00:00.000000000 +0100 +++ new/oslo.policy-1.38.1/releasenotes/notes/bug-1779172-c1323c0f647bc44c.yaml 2018-07-20 03:10:38.000000000 +0200 @@ -0,0 +1,19 @@ +--- +features: + - | + [`bug 1779172 <https://bugs.launchpad.net/keystone/+bug/1779172>`_] + The ``enforce()`` method now supports the ability to parse ``oslo.context`` + objects if passed into ``enforce()`` as ``creds``. This provides more + consistent policy enforcement for service developers by ensuring the + attributes provided in policy enforcement are standardized. In this case + they are being standardized through the + ``oslo_context.context.RequestContext.to_policy_values()`` method. +fixes: + - | + [`bug 1779172 <https://bugs.launchpad.net/keystone/+bug/1779172>`_] + The ``enforce()`` method now supports the ability to parse ``oslo.context`` + objects if passed into ``enforce()`` as ``creds``. This provides more + consistent policy enforcement for service developers by ensuring the + attributes provided in policy enforcement are standardized. In this case + they are being standardized through the + ``oslo_context.context.RequestContext.to_policy_values()`` method. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/oslo.policy-1.37.0/releasenotes/notes/expand-cli-docs-02c2f13adbe251c0.yaml new/oslo.policy-1.38.1/releasenotes/notes/expand-cli-docs-02c2f13adbe251c0.yaml --- old/oslo.policy-1.37.0/releasenotes/notes/expand-cli-docs-02c2f13adbe251c0.yaml 1970-01-01 01:00:00.000000000 +0100 +++ new/oslo.policy-1.38.1/releasenotes/notes/expand-cli-docs-02c2f13adbe251c0.yaml 2018-07-20 03:10:38.000000000 +0200 @@ -0,0 +1,6 @@ +--- +fixes: + - | + [`bug 1741073 <https://bugs.launchpad.net/oslo.policy/+bug/1741073>`_] + Documentation has been improved to include ``oslopolicy-sample-generator`` + and ``oslopolicy-list-redundant`` usage. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/oslo.policy-1.37.0/releasenotes/notes/policy-check-performance-fbad83c7a4afd7d7.yaml new/oslo.policy-1.38.1/releasenotes/notes/policy-check-performance-fbad83c7a4afd7d7.yaml --- old/oslo.policy-1.37.0/releasenotes/notes/policy-check-performance-fbad83c7a4afd7d7.yaml 1970-01-01 01:00:00.000000000 +0100 +++ new/oslo.policy-1.38.1/releasenotes/notes/policy-check-performance-fbad83c7a4afd7d7.yaml 2018-07-20 03:10:38.000000000 +0200 @@ -0,0 +1,7 @@ +--- +fixes: + - | + As reported in launchpad bug 1723030, under some circumstances policy + checks caused a significant performance degradation. This release includes + improved logic around rule validation to prevent that. + diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/oslo.policy-1.37.0/releasenotes/notes/reno.cache new/oslo.policy-1.38.1/releasenotes/notes/reno.cache --- old/oslo.policy-1.37.0/releasenotes/notes/reno.cache 2018-06-05 20:06:27.000000000 +0200 +++ new/oslo.policy-1.38.1/releasenotes/notes/reno.cache 2018-07-20 03:13:43.000000000 +0200 @@ -8,6 +8,45 @@ ``scope_types`` attributes. '] + releasenotes/notes/bug-1779172-c1323c0f647bc44c.yaml: + features: ['[`bug 1779172 <https://bugs.launchpad.net/keystone/+bug/1779172>`_] + + The ``enforce()`` method now supports the ability to parse ``oslo.context`` + + objects if passed into ``enforce()`` as ``creds``. This provides more + + consistent policy enforcement for service developers by ensuring the + + attributes provided in policy enforcement are standardized. In this case + + they are being standardized through the + + ``oslo_context.context.RequestContext.to_policy_values()`` method. + + '] + fixes: ['[`bug 1779172 <https://bugs.launchpad.net/keystone/+bug/1779172>`_] + + The ``enforce()`` method now supports the ability to parse ``oslo.context`` + + objects if passed into ``enforce()`` as ``creds``. This provides more + + consistent policy enforcement for service developers by ensuring the + + attributes provided in policy enforcement are standardized. In this case + + they are being standardized through the + + ``oslo_context.context.RequestContext.to_policy_values()`` method. + + '] + releasenotes/notes/expand-cli-docs-02c2f13adbe251c0.yaml: + fixes: ['[`bug 1741073 <https://bugs.launchpad.net/oslo.policy/+bug/1741073>`_] + + Documentation has been improved to include ``oslopolicy-sample-generator`` + + and ``oslopolicy-list-redundant`` usage. + + '] releasenotes/notes/fix-rendering-for-deprecated-rules-d465292e4155f483.yaml: fixes: ['[`bug 1771442 <https://bugs.launchpad.net/oslo.policy/+bug/1771442>`_] @@ -16,8 +55,29 @@ when rendering sample policy files for documentation. '] + releasenotes/notes/policy-check-performance-fbad83c7a4afd7d7.yaml: + fixes: ['As reported in launchpad bug 1723030, under some circumstances policy + + checks caused a significant performance degradation. This release includes + + improved logic around rule validation to prevent that. + + '] notes: - files: + - - releasenotes/notes/policy-check-performance-fbad83c7a4afd7d7.yaml + - !!binary | + OTA5YTFlYTNhN2FjZWI2ZTA2MzcwNThiOWM2YTUzZDE0MDQzZDZkMQ== + version: 1.38.1 +- files: + - - releasenotes/notes/bug-1779172-c1323c0f647bc44c.yaml + - !!binary | + Nzc1NjQxYTVmYzU0OWMyMGJlMzdjZjg2MmRlY2EzOTRiZjdmMmQyMQ== + - - releasenotes/notes/expand-cli-docs-02c2f13adbe251c0.yaml + - !!binary | + M2ZlOTViMmFlYmRlMjI2YmFiMGQ3MTA4ODVmNjBhMTg2MjQ5OWIxNg== + version: 1.38.0 +- files: - - releasenotes/notes/add-scope-types-to-sphinxext-cacd845c4575e965.yaml - !!binary | ZWIxNTQ2ZmRmYzE1N2ViY2UwZDUyY2JlZTU0ZTI4OThkMTNkZTI0NQ== diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/oslo.policy-1.37.0/requirements.txt new/oslo.policy-1.38.1/requirements.txt --- old/oslo.policy-1.37.0/requirements.txt 2018-06-05 20:03:29.000000000 +0200 +++ new/oslo.policy-1.38.1/requirements.txt 2018-07-20 03:10:38.000000000 +0200 @@ -4,6 +4,7 @@ requests>=2.14.2 # Apache-2.0 oslo.config>=5.2.0 # Apache-2.0 +oslo.context>=2.21.0 # Apache-2.0 oslo.i18n>=3.15.3 # Apache-2.0 oslo.serialization!=2.19.1,>=2.18.0 # Apache-2.0 PyYAML>=3.12 # MIT diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/oslo.policy-1.37.0/test-requirements.txt new/oslo.policy-1.38.1/test-requirements.txt --- old/oslo.policy-1.37.0/test-requirements.txt 2018-06-05 20:03:29.000000000 +0200 +++ new/oslo.policy-1.38.1/test-requirements.txt 2018-07-20 03:10:38.000000000 +0200 @@ -4,13 +4,15 @@ hacking!=0.13.0,<0.14,>=0.12.0 # Apache-2.0 oslotest>=3.2.0 # Apache-2.0 requests-mock>=1.1.0 # Apache-2.0 +stestr>=2.0.0 # Apache-2.0 +oslo.context>=2.21.0 # Apache-2.0 # computes code coverage percentages coverage!=4.4,>=4.0 # Apache-2.0 # These are needed for docs generation openstackdocstheme>=1.18.1 # Apache-2.0 -sphinx!=1.6.6,!=1.6.7,>=1.6.2 # BSD +sphinx!=1.6.6,!=1.6.7,>=1.6.5 # BSD reno>=2.5.0 # Apache-2.0 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/oslo.policy-1.37.0/tox.ini new/oslo.policy-1.38.1/tox.ini --- old/oslo.policy-1.37.0/tox.ini 2018-06-05 20:03:29.000000000 +0200 +++ new/oslo.policy-1.38.1/tox.ini 2018-07-20 03:10:38.000000000 +0200 @@ -3,18 +3,18 @@ envlist = py35,py27,pep8,docs [testenv] -basepython = python3 install_command = pip install {opts} {packages} deps = -c{env:UPPER_CONSTRAINTS_FILE:https://git.openstack.org/cgit/openstack/requirements/plain/upper-constraints.txt} -r{toxinidir}/test-requirements.txt -r{toxinidir}/requirements.txt -commands = python setup.py testr --slowest --testr-args='{posargs}' +commands = stestr run --slowest {posargs} [testenv:py27] basepython = python2.7 [testenv:pep8] +basepython = python3 deps = -r{toxinidir}/test-requirements.txt commands = @@ -23,12 +23,15 @@ bandit -r oslo_policy tests -n5 [testenv:venv] +basepython = python3 commands = {posargs} [testenv:docs] +basepython = python3 commands = python setup.py build_sphinx [testenv:cover] +basepython = python3 commands = python setup.py test --coverage --coverage-package-name=oslo_policy --testr-args='{posargs}' [flake8] @@ -42,9 +45,11 @@ import_exceptions = oslo_policy._i18n [testenv:releasenotes] +basepython = python3 commands = sphinx-build -a -E -W -d releasenotes/build/doctrees -b html releasenotes/source releasenotes/build/html [testenv:lower-constraints] +basepython = python3 deps = -c{toxinidir}/lower-constraints.txt -r{toxinidir}/test-requirements.txt