Skip to content

Conversation

@yadvr
Copy link
Member

@yadvr yadvr commented Mar 12, 2019

Problem: The listVirtualMachines API response displays sensitive information which should not be visible to any other user which is not Root Admin.
Root Cause: There are currently no restrictions in place to control what
instance settings should be visible to Root Admin only.
Solution: The issue has been fixed by refactoring the response to filter details based on a global setting and also honour the cloud.user_vm_details table’s display field. The global setting used to hide details that Root admin can set is called user.vm.blacklisted.details with the following defaults;
• memoryOvercommitRatio
• cpuOvercommitRatio
• rootdisksize
• Message.ReservedCapacityFreed.Flag

Types of changes

  • Breaking change (fix or feature that would cause existing functionality to change)
  • New feature (non-breaking change which adds functionality)
  • Bug fix (non-breaking change which fixes an issue)
  • Enhancement (improves an existing feature and functionality)
  • Cleanup (Code refactoring and cleanup, that may add test cases)

This introduces a new global setting `user.vm.blacklisted.details` that
allows admins to blacklist VM details that non-admin users should not
see via the VM's settings tab.

Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
@borisstoyanov
Copy link
Contributor

@blueorangutan package

@blueorangutan
Copy link

@borisstoyanov a Jenkins job has been kicked to build packages. I'll keep you posted as I make progress.

@blueorangutan
Copy link

Packaging result: ✔centos6 ✔centos7 ✔debian. JID-2656

@yadvr yadvr requested a review from borisstoyanov March 29, 2019 06:43
@yadvr yadvr changed the title server: allow admins to blacklist vm details that users should not see [WIP DO NOT MERGE] server: allow admins to blacklist vm details that users should not see Mar 29, 2019
@borisstoyanov
Copy link
Contributor

@blueorangutan test

@blueorangutan
Copy link

@borisstoyanov a Trillian-Jenkins test job (centos7 mgmt + kvm-centos7) has been kicked to run smoke tests

Copy link
Contributor

@borisstoyanov borisstoyanov left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Copy link
Contributor

@nvazquez nvazquez left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code LGTM, subject to testing

@blueorangutan
Copy link

Trillian test result (tid-3456)
Environment: kvm-centos7 (x2), Advanced Networking with Mgmt server 7
Total time taken: 38469 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr3213-t3456-kvm-centos7.zip
Intermittent failure detected: /marvin/tests/smoke/test_privategw_acl.py
Intermittent failure detected: /marvin/tests/smoke/test_ssvm.py
Intermittent failure detected: /marvin/tests/smoke/test_vpc_redundant.py
Smoke tests completed. 70 look OK, 0 have error(s)
Only failed tests results shown below:

Test Result Time (s) Test File

@DagSonsteboSB
Copy link

LGTM

@yadvr yadvr changed the title [WIP DO NOT MERGE] server: allow admins to blacklist vm details that users should not see server: allow admins to blacklist vm details that users should not see May 10, 2019
@yadvr yadvr merged commit 6716047 into apache:master May 10, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants