Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 5 Packages Projects Releases Wiki Activity

fix: don't allow observer and observer+ to download software installers (#19938)

Browse Source 
> Related issue: https://github.com/fleetdm/confidential/issues/6979

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
This commit is contained in:
Jahziel Villasana-Espinoza
2024-06-25 16:22:51 -04:00
committed by GitHub
parent b2dec6de57
commit fdee411b58
4 changed files with 19 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
changes/6979-observer-software
+1
View File
@@ -0,0 +1 @@
- Bug fix: do not allow Observer and Observer+ roles to download software installers.
server/authz/policy.rego
+4 -4
View File
@@ -643,10 +643,10 @@ allow {
action == read
}
# Global admins, maintainers, observers, and observer_plus can read any software installer.
# Global admins and maintainers can read any software installer.
allow {
object.type == "software_installer"
subject.global_role == [admin, maintainer, observer, observer_plus][_]
subject.global_role == [admin, maintainer][_]
action == read
}
@@ -657,11 +657,11 @@ allow {
action == write
}
# Team admins, maintainers, observers, and observer_plus can read any software installer in their teams.
# Team admins and maintainers can read any software installer in their teams.
allow {
not is_null(object.team_id)
object.type == "software_installer"
team_role(subject, object.team_id) == [admin, maintainer, observer, observer_plus][_]
team_role(subject, object.team_id) == [admin, maintainer][_]
action == read
}
server/authz/policy_test.go
+8 -8
View File
@@ -535,18 +535,18 @@ func TestAuthorizeSoftwareInstaller(t *testing.T) {
{user: test.UserMaintainer, object: team2Installer, action: read, allow: true},
{user: test.UserMaintainer, object: team2Installer, action: write, allow: true},
{user: test.UserObserver, object: noTeamInstaller, action: read, allow: true},
{user: test.UserObserver, object: noTeamInstaller, action: read, allow: false},
{user: test.UserObserver, object: noTeamInstaller, action: write, allow: false},
{user: test.UserObserver, object: team1Installer, action: read, allow: true},
{user: test.UserObserver, object: team1Installer, action: read, allow: false},
{user: test.UserObserver, object: team1Installer, action: write, allow: false},
{user: test.UserObserver, object: team2Installer, action: read, allow: true},
{user: test.UserObserver, object: team2Installer, action: read, allow: false},
{user: test.UserObserver, object: team2Installer, action: write, allow: false},
{user: test.UserObserverPlus, object: noTeamInstaller, action: read, allow: true},
{user: test.UserObserverPlus, object: noTeamInstaller, action: read, allow: false},
{user: test.UserObserverPlus, object: noTeamInstaller, action: write, allow: false},
{user: test.UserObserverPlus, object: team1Installer, action: read, allow: true},
{user: test.UserObserverPlus, object: team1Installer, action: read, allow: false},
{user: test.UserObserverPlus, object: team1Installer, action: write, allow: false},
{user: test.UserObserverPlus, object: team2Installer, action: read, allow: true},
{user: test.UserObserverPlus, object: team2Installer, action: read, allow: false},
{user: test.UserObserverPlus, object: team2Installer, action: write, allow: false},
// TODO: confirm gitops permissions
@@ -581,14 +581,14 @@ func TestAuthorizeSoftwareInstaller(t *testing.T) {
{user: test.UserTeamObserverTeam1, object: noTeamInstaller, action: read, allow: false},
{user: test.UserTeamObserverTeam1, object: noTeamInstaller, action: write, allow: false},
{user: test.UserTeamObserverTeam1, object: team1Installer, action: read, allow: true},
{user: test.UserTeamObserverTeam1, object: team1Installer, action: read, allow: false},
{user: test.UserTeamObserverTeam1, object: team1Installer, action: write, allow: false},
{user: test.UserTeamObserverTeam1, object: team2Installer, action: read, allow: false},
{user: test.UserTeamObserverTeam1, object: team2Installer, action: write, allow: false},
{user: test.UserTeamObserverPlusTeam1, object: noTeamInstaller, action: read, allow: false},
{user: test.UserTeamObserverPlusTeam1, object: noTeamInstaller, action: write, allow: false},
{user: test.UserTeamObserverPlusTeam1, object: team1Installer, action: read, allow: true},
{user: test.UserTeamObserverPlusTeam1, object: team1Installer, action: read, allow: false},
{user: test.UserTeamObserverPlusTeam1, object: team1Installer, action: write, allow: false},
{user: test.UserTeamObserverPlusTeam1, object: team2Installer, action: read, allow: false},
{user: test.UserTeamObserverPlusTeam1, object: team2Installer, action: write, allow: false},
server/service/software_installers_test.go
+6 -6
View File
@@ -33,10 +33,10 @@ func TestSoftwareInstallersAuth(t *testing.T) {
{"global admin team", test.UserAdmin, ptr.Uint(1), false, false},
{"global maintainer no team", test.UserMaintainer, nil, false, false},
{"global maintainer team", test.UserMaintainer, ptr.Uint(1), false, false},
{"global observer no team", test.UserObserver, nil, false, true},
{"global observer team", test.UserObserver, ptr.Uint(1), false, true},
{"global observer+ no team", test.UserObserverPlus, nil, false, true},
{"global observer+ team", test.UserObserverPlus, ptr.Uint(1), false, true},
{"global observer no team", test.UserObserver, nil, true, true},
{"global observer team", test.UserObserver, ptr.Uint(1), true, true},
{"global observer+ no team", test.UserObserverPlus, nil, true, true},
{"global observer+ team", test.UserObserverPlus, ptr.Uint(1), true, true},
{"global gitops no team", test.UserGitOps, nil, true, false},
{"global gitops team", test.UserGitOps, ptr.Uint(1), true, false},
{"team admin no team", test.UserTeamAdminTeam1, nil, true, true},
@@ -46,10 +46,10 @@ func TestSoftwareInstallersAuth(t *testing.T) {
{"team maintainer team", test.UserTeamMaintainerTeam1, ptr.Uint(1), false, false},
{"team maintainer other team", test.UserTeamMaintainerTeam2, ptr.Uint(1), true, true},
{"team observer no team", test.UserTeamObserverTeam1, nil, true, true},
{"team observer team", test.UserTeamObserverTeam1, ptr.Uint(1), false, true},
{"team observer team", test.UserTeamObserverTeam1, ptr.Uint(1), true, true},
{"team observer other team", test.UserTeamObserverTeam2, ptr.Uint(1), true, true},
{"team observer+ no team", test.UserTeamObserverPlusTeam1, nil, true, true},
{"team observer+ team", test.UserTeamObserverPlusTeam1, ptr.Uint(1), false, true},
{"team observer+ team", test.UserTeamObserverPlusTeam1, ptr.Uint(1), true, true},
{"team observer+ other team", test.UserTeamObserverPlusTeam2, ptr.Uint(1), true, true},
{"team gitops no team", test.UserTeamGitOpsTeam1, nil, true, true},
{"team gitops team", test.UserTeamGitOpsTeam1, ptr.Uint(1), true, false},