glance.api.v2.policy module

class glance.api.v2.policy.APIPolicyBase(context, target=None, enforcer=None)

Bases: object

check(name, *args)

Perform a soft check of a named policy.

This is used when you need to check if a policy is allowed for the given resource, without needing to catch an exception. If the policy check requires args, those are accepted here as well.

Parameters:

name – Policy name to check

Returns:

bool indicating if the policy is allowed.

class glance.api.v2.policy.CacheImageAPIPolicy(context, image=None, policy_str=None, target=None, enforcer=None)

Bases: APIPolicyBase

manage_image_cache()

class glance.api.v2.policy.DiscoveryAPIPolicy(context, target=None, enforcer=None)

Bases: APIPolicyBase

stores_info_detail()

class glance.api.v2.policy.ImageAPIPolicy(context, image, enforcer=None)

Bases: APIPolicyBase

add_image()

add_location()

check(name, *args)

Perform a soft check of a named policy.

This is used when you need to check if a policy is allowed for the given resource, without needing to catch an exception. If the policy check requires args, those are accepted here as well.

Parameters:

name – Policy name to check

Returns:

bool indicating if the policy is allowed.

copy_image()

deactivate_image()

delete_image()

delete_locations()

download_image()

get_image()

get_image_location()

get_images()

get_locations()

property is_created

Signal whether the image actually exists or not.

False if the image is only being proposed by a create operation, True if it has already been created.

modify_image()

reactivate_image()

update_locations()

update_property(name, value=None)

upload_image()

class glance.api.v2.policy.MemberAPIPolicy(context, image, target=None, enforcer=None)

Bases: APIPolicyBase

add_member()

delete_member()

get_member()

get_members()

modify_member()

class glance.api.v2.policy.MetadefAPIPolicy(context, md_resource=None, target=None, enforcer=None)

Bases: APIPolicyBase

add_metadef_namespace()

add_metadef_object()

add_metadef_property()

add_metadef_resource_type_association()

add_metadef_tag()

add_metadef_tags()

check(name, *args)

Perform a soft check of a named policy.

This is used when you need to check if a policy is allowed for the given resource, without needing to catch an exception. If the policy check requires args, those are accepted here as well.

Parameters:

name – Policy name to check

Returns:

bool indicating if the policy is allowed.

delete_metadef_namespace()

delete_metadef_object()

delete_metadef_tag()

delete_metadef_tags()

get_metadef_namespace()

get_metadef_namespaces()

get_metadef_object()

get_metadef_objects()

get_metadef_properties()

get_metadef_property()

get_metadef_resource_type()

get_metadef_tag()

get_metadef_tags()

list_metadef_resource_types()

modify_metadef_namespace()

modify_metadef_object()

modify_metadef_property()

modify_metadef_tag()

remove_metadef_property()

remove_metadef_resource_type_association()

class glance.api.v2.policy.TasksAPIPolicy(context, target=None, enforcer=None)

Bases: APIPolicyBase

tasks_api_access()

glance.api.v2.policy.check_admin_or_same_owner(context, properties)

Check that legacy behavior on create with owner is preserved.

Legacy behavior requires a static check that owner is not inconsistent with the context, unless the caller is an admin. Enforce that here, if needed.

Parameters:

• context – A RequestContext

• properties – The properties being used to create the image, which may contain an owner

Raises:

exception.Forbidden if the context is not an admin and owner is set to something other than the context’s project

glance.api.v2.policy.check_is_image_mutable(context, image)

Replicate the DB-layer admin-or-owner check for the API.

Much of the API code depends on hard-coded admin-or-owner enforcement in the DB or authorization layer, as the policy layer is largely a no-op by default. During blueprint policy-refactor, we are trying to remove as much of that as possible, but in certain places we need to do that (if secure_rbac is not enabled). This transitional helper provides a way to do that enforcement where necessary.

Parameters:

• context – A RequestContext

• image – An ImageProxy

Raises:

exception.Forbidden if the context is not the owner or an admin