Fix is_admin check via policy

When we create an admin context internally, we need to make sure
that all of the policy actions that are available to that context
are still available. This wasn't working in some cases because
we were looking for a hard-coded role called 'admin'.

Fixes bug 1039093

Change-Id: I939f834a63c9e6e6e7c87b115bd469466da66a69

1 files changed, 7 insertions, 2 deletions

diff --git a/nova/policy.py b/nova/policy.py
index acfe830b99..16ff15b861 100644
--- a/nova/policy.py
+++ b/nova/policy.py
@@ -90,17 +90,22 @@ def enforce(context, action, target):
     match_list = ('rule:%s' % action,)
     credentials = context.to_dict()
 
+    # NOTE(vish): This is to work around the following launchpad bug:
+    #             https://bugs.launchpad.net/openstack-common/+bug/1039132
+    #             It can be removed when that bug is fixed.
+    credentials['is_admin'] = unicode(credentials['is_admin'])
+
     policy.enforce(match_list, target, credentials,
                    exception.PolicyNotAuthorized, action=action)
 
 
-def check_admin_role(roles):
+def check_is_admin(roles):
     """Whether or not roles contains 'admin' role according to policy setting.
 
     """
     init()
 
-    action = 'admin'
+    action = 'context_is_admin'
     match_list = ('rule:%s' % action,)
     target = {}
     credentials = {'roles': roles}