User cannot list their own trusts

Since this report concerns a possible security risk, an incomplete security advisory task has been added while the core security reviewers for the affected project or projects confirm the bug and discuss the scope of any vulnerability along with potential solutions.

While I've temporarily triaged this as a potential vulnerability under embargo, it sounds more like something we could discuss and fix in the open as a security-related improvement instead. I'm eager to get more input from Adam, the Keystone core security reviewers and other VMT members on whether they agree.

This is something I think can be done in the public. This is more "not enough information is given" vs. "too much" or ultimately something exploitable.

Public is fine. Just wanted it flagged as a security issue to get appropriate attention and priority. An attacker is already thinking along these lines.

Solution could be to add parameters to the API along the lines of self=true and honor that in the CLI.

It seems like a class D according to the VMT's taxonomy ( https://security.openstack.org/vmt-process.html#incident-report-taxonomy ). I agree this can be fixed in the open.

I concur, class D.

Based on consensus above, I've switched the bug to public and triaged it as a class D report, tagging it as a potential hardening opportunity or security-related improvement.

Looking at the policy check:

        # FIXME(lbragstad): Trusts have the ability to optionally include a
        # project, but until trusts deal with system scope it's not really
        # useful. For now, this should be a project only operation.
        scope_types=['project'],

It seems to me that this should be an unscoped only operation for users, where they are listing their own trusts, not scoped to a project.