Nomad ACL roles with duplicated policies #17201
Labels
hcc/cst
Admin - internal
stage/accepted
Confirmed, and intend to work on. No timeline committment though.
theme/security
type/bug
Projects
Nomad version
Issue
The ACL lookup system fails if a token is issued with two roles containing policies with the same name.
Reproduction steps
I have two roles
my-role
andmy-role-sre
which share one or more policies with the same name.In a simplified setup:
I can then start a test job in
my-namespace
calledtest
and issue a token with both roles:Expected Result
Given the policies defined above I expect to be able to exec in the alloc started by my
test
job:Actual Result
Client:
Server:
The "Permission denied" error originates from here
tokenPolicyNames
contains the deduplicate list of resolved polices from all the roles assigned to the token, whereasargs.Names
from the RPC call contains the "raw" list.In my example:
Removing the duplicated
cluster-user-readonly
from one of the roles makes it to work as expected but it's not an uncommon pattern to scaffold ACL roles with common "basic read-only" policies.Should the client's
resolvePolicies
implement the deduplication? https://github.com/hashicorp/nomad/blob/release/1.5.5/client/acl.go#L181The issue doesn't affect all operations as not all of them rely on the RPC call.
nomad job
works and so doesnomad alloc status
, albeit with an error when retrieving stats:The text was updated successfully, but these errors were encountered: