StackStorm / StackStorm/st2-rbac-backend

RBAC permissions don't seem to be hierarchical as documentation has made it to be

Open
#60 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
5
Forks
13
PR merge metrics
No merged PRs in 30d

Description

I have a user with a role assigned as this:

name: "my_role"
permission_grants:
  -
    resource_uid: "pack:<my special pack>"
    permission_types:
      - "pack_all"
      - "sensor_type_all"
      - "action_all"
      - "action_alias_all"
      - "rule_all"

In the documentation under pack its lead to believe that action_all will allow the execution of any action under that pack but this is not the case.

from st2api.log

2021-10-06 09:56:21,637 140650525596712 ERROR router [-] Failed to call controller function "post" for operation "st2api.controllers.v1.actionexecutions:action_execution_rerun_controller.post": User "<user>" doesn't have required permission "action_execute" on resource "action:<my special pack>:<my action>"
Traceback (most recent call last):
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/st2common/router.py", line 621, in __call__
    resp = func(**kw)
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/st2api/controllers/v1/actionexecutions.py", line 675, in post
    show_secrets=show_secrets,
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/st2api/controllers/v1/actionexecutions.py", line 130, in _handle_schedule_execution
    permission_type=permission_type,
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/st2rbac_backend/utils.py", line 127, in assert_user_has_resource_db_permission
    permission_type=permission_type)
st2common.exceptions.rbac.ResourceAccessDeniedError: User "<user>" doesn't have required permission "action_execute" on resource "action:<my special pack>:<my action>"

So action_all is ignored with the pack resource.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the permission check using the YAML role and error shown in the issue. Start with st2rbac_backend/utils.py at assert_user_has_resource_db_permission, then trace the action execution path in st2api/controllers/v1/actionexecutions.py. Resolve whether pack-level action_all should grant action_execute and align the implementation or documentation accordingly.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
authorization, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.