Fix port RBAC policies to require network ownership

Several default port policies that require network ownership incorrectly
included PROJECT_MANAGER. That rule checks the port project_id, not
network ownership, so any project manager could perform those actions
on shared/RBAC networks where they do not own the network.

Remove PROJECT_MANAGER from the affected create/update port policies
and rely on NET_OWNER_MEMBER or ADMIN_OR_NET_OWNER_MEMBER instead.
Project managers who own the network remain authorized through the
default Keystone role implication chain (manager implies member).

Closes-Bug: #2152115
Assisted-By: Claude Composer 2.5
Signed-off-by: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Change-Id: I4e258d28cdf72adcc13fc9d03749256c65881c45
(cherry picked from commit d0f61db)

Author: ralonsoh

neutron/conf/policies/base.py

@@ -76,6 +76,7 @@
 # related to the "network owner" and network isn't really parent of the subnet
 # or port. Because of that, using parent owner in those cases may be
 # missleading for users so it's better to keep also "network owner" rules.
+NET_OWNER_MANAGER = 'role:manager and ' + RULE_NET_OWNER
 NET_OWNER_MEMBER = 'role:member and ' + RULE_NET_OWNER
 NET_OWNER_READER = 'role:reader and ' + RULE_NET_OWNER
 ADMIN_OR_NET_OWNER_MEMBER = (

neutron/conf/policies/port.py

@@ -100,7 +100,6 @@
         check_str=neutron_policy.policy_or(
             'not rule:network_device',
             base.ADMIN_OR_SERVICE,
-            base.PROJECT_MANAGER,
             base.NET_OWNER_MEMBER
         ),
         scope_types=['project'],
@@ -119,7 +118,6 @@
         name='create_port:mac_address',
         check_str=neutron_policy.policy_or(
             base.ADMIN_OR_SERVICE,
-            base.PROJECT_MANAGER,
             base.NET_OWNER_MEMBER),
         scope_types=['project'],
         description='Specify ``mac_address`` attribute when creating a port',
@@ -136,7 +134,6 @@
         name='create_port:fixed_ips',
         check_str=neutron_policy.policy_or(
             base.ADMIN_OR_SERVICE,
-            base.PROJECT_MANAGER,
             base.NET_OWNER_MEMBER,
             'rule:shared'),
         scope_types=['project'],
@@ -155,7 +152,6 @@
         name='create_port:fixed_ips:ip_address',
         check_str=neutron_policy.policy_or(
             base.ADMIN_OR_SERVICE,
-            base.PROJECT_MANAGER,
             base.NET_OWNER_MEMBER),
         scope_types=['project'],
         description='Specify IP address in ``fixed_ips`` when creating a port',
@@ -172,7 +168,6 @@
         name='create_port:fixed_ips:subnet_id',
         check_str=neutron_policy.policy_or(
             base.ADMIN_OR_SERVICE,
-            base.PROJECT_MANAGER,
             base.NET_OWNER_MEMBER,
             'rule:shared'),
         scope_types=['project'],
@@ -191,7 +186,6 @@
         name='create_port:port_security_enabled',
         check_str=neutron_policy.policy_or(
             base.ADMIN_OR_SERVICE,
-            base.PROJECT_MANAGER,
             base.NET_OWNER_MEMBER),
         scope_types=['project'],
         description=(
@@ -258,7 +252,6 @@
         name='create_port:allowed_address_pairs',
         check_str=neutron_policy.policy_or(
             base.ADMIN_OR_NET_OWNER_MEMBER,
-            base.PROJECT_MANAGER,
             base.SERVICE),
         scope_types=['project'],
         description=(
@@ -276,7 +269,6 @@
         name='create_port:allowed_address_pairs:mac_address',
         check_str=neutron_policy.policy_or(
             base.ADMIN_OR_NET_OWNER_MEMBER,
-            base.PROJECT_MANAGER,
             base.SERVICE),
         scope_types=['project'],
         description=(
@@ -294,7 +286,6 @@
         name='create_port:allowed_address_pairs:ip_address',
         check_str=neutron_policy.policy_or(
             base.ADMIN_OR_NET_OWNER_MEMBER,
-            base.PROJECT_MANAGER,
             base.SERVICE),
         scope_types=['project'],
         description=(
@@ -496,7 +487,6 @@
         check_str=neutron_policy.policy_or(
             'not rule:network_device',
             base.ADMIN_OR_SERVICE,
-            base.PROJECT_MANAGER,
             base.NET_OWNER_MEMBER,
         ),
         scope_types=['project'],
@@ -515,7 +505,7 @@
         name='update_port:mac_address',
         check_str=neutron_policy.policy_or(
             base.ADMIN_OR_SERVICE,
-            base.PROJECT_MANAGER
+            base.NET_OWNER_MANAGER,
         ),
         scope_types=['project'],
         description='Update ``mac_address`` attribute of a port',
@@ -532,7 +522,6 @@
         name='update_port:fixed_ips',
         check_str=neutron_policy.policy_or(
             base.ADMIN_OR_SERVICE,
-            base.PROJECT_MANAGER,
             base.NET_OWNER_MEMBER
         ),
         scope_types=['project'],
@@ -550,7 +539,6 @@
         name='update_port:fixed_ips:ip_address',
         check_str=neutron_policy.policy_or(
             base.ADMIN_OR_SERVICE,
-            base.PROJECT_MANAGER,
             base.NET_OWNER_MEMBER
         ),
         scope_types=['project'],
@@ -571,7 +559,6 @@
         name='update_port:fixed_ips:subnet_id',
         check_str=neutron_policy.policy_or(
             base.ADMIN_OR_SERVICE,
-            base.PROJECT_MANAGER,
             base.NET_OWNER_MEMBER,
             'rule:shared'
         ),
@@ -594,7 +581,6 @@
         name='update_port:port_security_enabled',
         check_str=neutron_policy.policy_or(
             base.ADMIN_OR_SERVICE,
-            base.PROJECT_MANAGER,
             base.NET_OWNER_MEMBER
         ),
         scope_types=['project'],
@@ -653,7 +639,6 @@
         name='update_port:allowed_address_pairs',
         check_str=neutron_policy.policy_or(
             base.ADMIN_OR_NET_OWNER_MEMBER,
-            base.PROJECT_MANAGER,
             base.SERVICE),
         scope_types=['project'],
         description='Update ``allowed_address_pairs`` attribute of a port',
@@ -668,7 +653,6 @@
         name='update_port:allowed_address_pairs:mac_address',
         check_str=neutron_policy.policy_or(
             base.ADMIN_OR_NET_OWNER_MEMBER,
-            base.PROJECT_MANAGER,
             base.SERVICE),
         scope_types=['project'],
         description=(
@@ -686,7 +670,6 @@
         name='update_port:allowed_address_pairs:ip_address',
         check_str=neutron_policy.policy_or(
             base.ADMIN_OR_NET_OWNER_MEMBER,
-            base.PROJECT_MANAGER,
             base.SERVICE),
         scope_types=['project'],
         description=(