Nomad ACL roles with dangling policies cause permission evaluation issues

[the-nando]

Nomad version

Nomad v1.6.2

Issue

#17201 addressed the issue of roles with overlapping policies but there's another issue I stumbled upon related to a role containing one or more policies which have been deleted, which causes the list of allowed permissions to be erroneously computed; ultimately this results in allowed actions being denied to the user.
The involved code path is the same as for #17201, ACL.GetPolicies.

Reproduction steps

1. Create two namespaces monitoring and system and deploy a simple job in the system one.
2. Create two policies:

cat > policy1.hcl << EOF
operator {
  policy = "read"
}

namespace "monitoring" {
  policy = "write"
}
EOF

cat > policy2.hcl << EOF
operator {
  policy = "read"
}

namespace "system" {
  policy = "write"
}
EOF

nomad acl policy apply monitoring-admin policy1.hcl
nomad acl policy apply system-admin policy2.hcl

3. Create a role and get a token:

nomad acl role create -name test-role -policy system-admin -policy monitoring-admin
export NOMAD_TOKEN=$(nomad acl token create -ttl=10m -name=test-token -role-name=test-role -t '{{ .SecretID }}')

4. Exec in the test container

~ nomad alloc exec -namespace='system' -job my-test-job echo foo
foo
~

5. With another token, delete the monitoring-admin policy

nomad acl policy delete monitoring-admin

6. Re-try to exec

~ nomad alloc exec -namespace='system' -job my-test-job echo foo
failed to exec into task: rpc error: Permission denied
~ 

Expected Result

~ nomad alloc exec -namespace='system' -job my-test-job echo foo
foo
~

Actual Result

~ nomad alloc exec -namespace='system' -job my-test-job echo foo
failed to exec into task: rpc error: Permission denied
~

[jrasell]

Hi @the-nando and thanks for raising this issue with some great information. I'll take a look into reproducing this locally next week and report back with any findings.

[jrasell]

Hi @the-nando; I have been able to reproduce this locally, the setup I am using can be found: https://github.com/jrasell/dev-mess/tree/main/nomad/development/gh18619

I'll try and find some time to look into what is causing this and report back what I find.