Do not allow a tenant to create a default SG for another one

The attempt to list security groups for a project, or any
random string, can create a default SG for it. Only allow if
privileges support it.

Closes-bug: #1988026

Change-Id: Ieef7011f48cd2188d4254ff16d90a6465bbabfe3
(cherry picked from commit 01fc2b9)

neutron/db/securitygroups_db.py

@@ -931,6 +931,10 @@ def _ensure_default_security_group(self, context, tenant_id):
 
         :returns: the default security group id for given tenant.
         """
+        # Do not allow a tenant to create a default SG for another one.
+        # See Bug 1987410.
+        if tenant_id != context.tenant_id and not context.is_admin:
+            return
         if not extensions.is_extension_supported(self, 'security-group'):
             return
         default_group_id = self._get_default_sg_id(context, tenant_id)

neutron/tests/unit/db/test_securitygroups_db.py

@@ -659,3 +659,15 @@ def test__ensure_default_security_group_when_disabled(self):
             self.mixin._ensure_default_security_group(self.ctx, 'tenant_1')
             create_sg.assert_not_called()
             get_default_sg_id.assert_not_called()
+
+    def test__ensure_default_security_group_tenant_mismatch(self):
+        with mock.patch.object(
+                self.mixin, '_get_default_sg_id') as get_default_sg_id,\
+                mock.patch.object(
+                        self.mixin, 'create_security_group') as create_sg:
+            context = mock.Mock()
+            context.tenant_id = 'tenant_0'
+            context.is_admin = False
+            self.mixin._ensure_default_security_group(context, 'tenant_1')
+            create_sg.assert_not_called()
+            get_default_sg_id.assert_not_called()