Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

api: apply new ACL check for wildcard namespace #13608

Merged
merged 2 commits into from
Jul 6, 2022
Merged

api: apply new ACL check for wildcard namespace #13608

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5a218cf
api: apply new ACL check for wildcard namespace
lgfa29 Jul 6, 2022
98d8fee
changelog: add entry for #13608
lgfa29 Jul 6, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
3 changes: 3 additions & 0 deletions .changelog/13608.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
```release-note:improvement
api: refactor ACL check when using the all namespaces wildcard in the job and alloc list endpoints
```
21 changes: 4 additions & 17 deletions nomad/alloc_endpoint.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,29 +35,16 @@ func (a *Alloc) List(args *structs.AllocListRequest, reply *structs.AllocListRes
defer metrics.MeasureSince([]string{"nomad", "alloc", "list"}, time.Now())

namespace := args.RequestNamespace()
var allow func(string) bool

// Check namespace read-job permissions
aclObj, err := a.srv.ResolveToken(args.AuthToken)

switch {
case err != nil:
if err != nil {
return err
case aclObj == nil:
allow = func(string) bool {
return true
}
case namespace == structs.AllNamespacesSentinel:
allow = func(ns string) bool {
return aclObj.AllowNsOp(ns, acl.NamespaceCapabilityReadJob)
}
case !aclObj.AllowNsOp(namespace, acl.NamespaceCapabilityReadJob):
}
if !aclObj.AllowNsOp(namespace, acl.NamespaceCapabilityReadJob) {
return structs.ErrPermissionDenied
default:
allow = func(string) bool {
return true
}
}
allow := aclObj.AllowNsOpFunc(acl.NamespaceCapabilityReadJob)

// Setup the blocking query
sort := state.SortOption(args.Reverse)
Expand Down
3 changes: 2 additions & 1 deletion nomad/alloc_endpoint_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1284,8 +1284,9 @@ func TestAllocEndpoint_List_AllNamespaces_ACL_OSS(t *testing.T) {
{
Label: "all namespaces with insufficient token",
Namespace: "*",
Allocs: []*structs.Allocation{},
Token: ns1tokenInsufficient.SecretID,
Error: true,
Message: structs.ErrPermissionDenied.Error(),
Comment on lines 1285 to +1289
Copy link
Contributor Author

@lgfa29 lgfa29 Jul 6, 2022 •
edited

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was the only test the failed after the refactoring, but I think returning a 403 is the correct result in this case since the test token doesn't have the read-job capability?

Looking through the documentation I couldn't find any expected output.

},
{
Label: "ns1 with ns1 token",
Expand Down
23 changes: 5 additions & 18 deletions nomad/job_endpoint.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1297,29 +1297,16 @@ func (j *Job) List(args *structs.JobListRequest, reply *structs.JobListResponse)
defer metrics.MeasureSince([]string{"nomad", "job", "list"}, time.Now())

namespace := args.RequestNamespace()
var allow func(string) bool

// Check for list-job permissions
aclObj, err := j.srv.ResolveToken(args.AuthToken)

switch {
case err != nil:
if err != nil {
return err
case aclObj == nil:
allow = func(string) bool {
return true
}
case namespace == structs.AllNamespacesSentinel:
allow = func(ns string) bool {
return aclObj.AllowNsOp(ns, acl.NamespaceCapabilityListJobs)
}
case !aclObj.AllowNsOp(namespace, acl.NamespaceCapabilityListJobs):
}
if !aclObj.AllowNsOp(namespace, acl.NamespaceCapabilityListJobs) {
return structs.ErrPermissionDenied
default:
allow = func(string) bool {
return true
}
}
allow := aclObj.AllowNsOpFunc(acl.NamespaceCapabilityListJobs)

// Setup the blocking query
opts := blockingOptions{
Expand All @@ -1330,7 +1317,7 @@ func (j *Job) List(args *structs.JobListRequest, reply *structs.JobListResponse)
var err error
var iter memdb.ResultIterator

// check if user has permission to all namespaces
// Get the namespaces the user is allowed to access.
allowableNamespaces, err := allowedNSes(aclObj, state, allow)
if err == structs.ErrPermissionDenied {
// return empty jobs if token isn't authorized for any
Expand Down