UI /fs - 'File' tabs in allocations and tasks invoke node API, unlike cli
- Dominant language
- Go
- Stars
- 17k
- Forks
- 2.1k
- Avg merge
- 1d 9h
- Merged PRs (30d)
- 105
Description
### Nomad version
Nomad v1.9.2
BuildDate 2024-11-08T08:58:16Z
Revision de8a30ba86a2ed8dfb7188da10c250056d165fea
### Operating system and Environment details
PRETTY_NAME="Ubuntu 24.04.1 LTS"
NAME="Ubuntu"
VERSION_ID="24.04"
VERSION="24.04.1 LTS (Noble Numbat)"
VERSION_CODENAME=noble
### Issue
The web ui refuses access to the files of an allocation with 'Not Authorized' screen, however when I run the equivalent step in with the cli, it lets me access the files.
### Reproduction steps
1. Create a new policy as follows [policy.hcl](https://github.com/user-attachments/files/17952869/policy.hcl.txt)
2. Login with that token
3. Create any nomad job that will run
4. From the web ui, click 'files' in allocation
=> https://server-ip:4646/ui/allocations/04700000-0000-0000-0000-000000000000/fs
#### Expected Result
Same as the command line, the above policy gives me read access to the file system. With the above policy, I can reach the file system on the CLI as seen in this screenshot:

The web ui should give me access to the '/fs' uri of a task or allocation, even if I do not have node access. I don't know why the node is invoked here, but either it should not be invoked it it should be a soft fail(ie the page loads, I have file system access, but the data from 'node' should simply be blank ).
#### Actual Result

I get 'Not Authorized'
### Job file (if appropriate)
```
job "first-nomad-job-basic" {
group "service" {
task "service" {
driver = "docker"
config {
image = "davidlublink/devopsgeneration:pretend-work"
}
}
}
}
```
### Nomad Server logs (if appropriate)
```
2024-11-28T18:31:16.962670-05:00 router nomad[2989097]: 2024-11-28T18:31:16.962-0500 [DEBUG] http: request failed: method=GET path=/v1/node/5969ccc6-0000-0000-0000-00000000000 error="Permission denied" code=403
```
If I change the attached policy as follows:
```
node {
policy = "read"
}
```
the web UI no longer returns a "Not Authorized" page.
Why does it matter?
Web UI and CLI give inconsistent experience causing confusion.
Scenario 1: New user - A new user working with ACLs who uses only the web ui may get confused when trying to give the 'read-fs' permission as it also require
Scenario 2: Security - An experienced operator may do testing of policies with temporary tokens via the web UI, when they see the 'Not Authorized' error in the web ui, they may assume that the user doesn't have filesystem access when in fact they might.
Possibly related issue, with the same above policy, when in the "allocation" page with the above policy, you can see it says docker is unhealthy:

Well, no it's not unhealthy, it's the same permission denied at the service.
let me know if you have questions.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.