{"action":"closed","issue":{"url":"https://api.github.com/repos/openshift/origin/issues/9755","repository_url":"https://api.github.com/repos/openshift/origin","labels_url":"https://api.github.com/repos/openshift/origin/issues/9755/labels{/name}","comments_url":"https://api.github.com/repos/openshift/origin/issues/9755/comments","events_url":"https://api.github.com/repos/openshift/origin/issues/9755/events","html_url":"https://github.com/openshift/origin/issues/9755","id":164557788,"number":9755,"title":"Docker registry allows to serve any blob user wants","user":{"login":"miminar","id":1478803,"avatar_url":"https://avatars.githubusercontent.com/u/1478803?v=3","gravatar_id":"","url":"https://api.github.com/users/miminar","html_url":"https://github.com/miminar","followers_url":"https://api.github.com/users/miminar/followers","following_url":"https://api.github.com/users/miminar/following{/other_user}","gists_url":"https://api.github.com/users/miminar/gists{/gist_id}","starred_url":"https://api.github.com/users/miminar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/miminar/subscriptions","organizations_url":"https://api.github.com/users/miminar/orgs","repos_url":"https://api.github.com/users/miminar/repos","events_url":"https://api.github.com/users/miminar/events{/privacy}","received_events_url":"https://api.github.com/users/miminar/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/openshift/origin/labels/component/imageregistry","name":"component/imageregistry","color":"0052cc"},{"url":"https://api.github.com/repos/openshift/origin/labels/priority/P0","name":"priority/P0","color":"e11d21"}],"state":"closed","locked":false,"assignee":{"login":"miminar","id":1478803,"avatar_url":"https://avatars.githubusercontent.com/u/1478803?v=3","gravatar_id":"","url":"https://api.github.com/users/miminar","html_url":"https://github.com/miminar","followers_url":"https://api.github.com/users/miminar/followers","following_url":"https://api.github.com/users/miminar/following{/other_user}","gists_url":"https://api.github.com/users/miminar/gists{/gist_id}","starred_url":"https://api.github.com/users/miminar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/miminar/subscriptions","organizations_url":"https://api.github.com/users/miminar/orgs","repos_url":"https://api.github.com/users/miminar/repos","events_url":"https://api.github.com/users/miminar/events{/privacy}","received_events_url":"https://api.github.com/users/miminar/received_events","type":"User","site_admin":false},"assignees":[{"login":"miminar","id":1478803,"avatar_url":"https://avatars.githubusercontent.com/u/1478803?v=3","gravatar_id":"","url":"https://api.github.com/users/miminar","html_url":"https://github.com/miminar","followers_url":"https://api.github.com/users/miminar/followers","following_url":"https://api.github.com/users/miminar/following{/other_user}","gists_url":"https://api.github.com/users/miminar/gists{/gist_id}","starred_url":"https://api.github.com/users/miminar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/miminar/subscriptions","organizations_url":"https://api.github.com/users/miminar/orgs","repos_url":"https://api.github.com/users/miminar/repos","events_url":"https://api.github.com/users/miminar/events{/privacy}","received_events_url":"https://api.github.com/users/miminar/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/openshift/origin/milestones/14","html_url":"https://github.com/openshift/origin/milestones/1.3.0","labels_url":"https://api.github.com/repos/openshift/origin/milestones/14/labels","id":1664374,"number":14,"title":"1.3.0","description":"","creator":{"login":"jwforres","id":1467629,"avatar_url":"https://avatars.githubusercontent.com/u/1467629?v=3","gravatar_id":"","url":"https://api.github.com/users/jwforres","html_url":"https://github.com/jwforres","followers_url":"https://api.github.com/users/jwforres/followers","following_url":"https://api.github.com/users/jwforres/following{/other_user}","gists_url":"https://api.github.com/users/jwforres/gists{/gist_id}","starred_url":"https://api.github.com/users/jwforres/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jwforres/subscriptions","organizations_url":"https://api.github.com/users/jwforres/orgs","repos_url":"https://api.github.com/users/jwforres/repos","events_url":"https://api.github.com/users/jwforres/events{/privacy}","received_events_url":"https://api.github.com/users/jwforres/received_events","type":"User","site_admin":false},"open_issues":28,"closed_issues":31,"state":"open","created_at":"2016-03-24T17:23:55Z","updated_at":"2016-08-07T19:06:29Z","due_on":null,"closed_at":null},"comments":13,"created_at":"2016-07-08T15:38:30Z","updated_at":"2016-08-07T19:06:29Z","closed_at":"2016-08-07T19:06:29Z","body":"Previously there was an authorization check comprising of existence check on a layer link inside the repository.\r\n\r\nWe're skipping layer links completely now. The [`Stat()`](https://github.com/openshift/origin/blob/master/pkg/dockerregistry/server/errorblobstore.go#L22) and [`ServeBlob()`](https://github.com/openshift/origin/blob/master/pkg/dockerregistry/server/errorblobstore.go#L76) calls reach directly to global registry blob store (storing blobs pushed to the registry). Because of that, any user, who is authorized to pull from at least one repository, can pull any blob he wants. Thanks to our [blobDescriptorService()](https://github.com/openshift/origin/blob/master/pkg/dockerregistry/server/blobdescriptorservice.go#L29).\r\n\r\nThe only restriction from pulling any blob a user wants is that he doesn't know what blobs are stored in the registry unless he is able to get somehow an image manifest or image object.\r\n\r\n##### Version\r\nDocker registry 2.4.0.\r\n\r\n##### Steps To Reproduce\r\n1. push any image as a userA to image stream **A/IS**\r\n2. choose one of its layers (`oc get -o yaml isimage <imagename>`), let's call it layer **L**\r\n3. login as a userB\r\n4. create a new project **P** and a new image stream in there (`oc create imagestream IS`)\r\n5. stat the blob using simple curl:\r\n\r\n```\r\n$ curl -v -X HEAD -u \"userB:$btoken\" \"$registry_url/v2/P/IS/blobs/L\"\r\n``` \r\n\r\n##### Current Result\r\n```\r\n* About to connect() to 172.30.241.183 port 5000 (#0)\r\n*   Trying 172.30.241.183...\r\n* Connected to 172.30.241.183 (172.30.241.183) port 5000 (#0)\r\n* Server auth using Basic with user 'alice'\r\n> HEAD /v2/target/busybox/blobs/sha256:8ddc19f16526912237dd8af81971d5e4dd0587907234be2b83e249518d5b673f HTTP/1.1\r\n> Authorization: Basic YWxpY2U6d1RyTFN6VnQxTjJvREl5ZENrVDEzR1pTekZsMnFYWVlYYmdDQmw4QzRPWQ==\r\n> User-Agent: curl/7.29.0\r\n> Host: 172.30.241.183:5000\r\n> Accept: */*\r\n> \r\n< HTTP/1.1 200 OK\r\n< Accept-Ranges: bytes\r\n< Cache-Control: max-age=31536000\r\n< Content-Length: 667590\r\n< Content-Type: application/octet-stream\r\n< Docker-Content-Digest: sha256:8ddc19f16526912237dd8af81971d5e4dd0587907234be2b83e249518d5b673f\r\n< Docker-Distribution-Api-Version: registry/2.0\r\n< Etag: \"sha256:8ddc19f16526912237dd8af81971d5e4dd0587907234be2b83e249518d5b673f\"\r\n< Date: Fri, 08 Jul 2016 15:28:43 GMT\r\n```\r\n##### Expected Result\r\nUnauthorized\r\n\r\n##### Additional info\r\nSuggested priority: P1"}}
{"actor":{"display_login":"openshift-bot"}}