saltstack / saltstack/salt

[BUG] Publisher_ACL's doesn't work like expected in 3006

Open
#66,067 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug needs-triage
Dominant language
Python
Stars
15.7k
Forks
5.6k
Avg merge
2d 44m
Merged PRs (30d)
80

Description

Description
For simplicity. Create a user and create a simple publisher_acl restriction (see below) and run a command not in the publisher ACL. In a previous salt version 3004 for us. The example below would properly give us an authentication issue if we did anything not defined in the publisher_acl. So if you ran

salt '*' test.ping
Authorization error occurred. (the result we would expect)

And

salt '*' pillar.items 

(and the display would be the pillar values as we would expect).

For testing use a simple setup:
Add proper user.

publisher_acl:
  USER-NAME:
	- pillar.items

Run a (with user in publisher_acl

salt '*' test.ping

Expected result:

Authorization error occurred.

Actual result:
Minions ping back.

Setup
create a user & set the publisher_acl to limit the user to be able to run a few salt commands

publisher_acl:
  USER-NAME:
	- pillar.items

switch to the user created and run a

salt '*' test.ping

Then run a

salt '*' pillar.items
  • on-prem machine
  • VM (Virtualbox, KVM, etc. please specify)
  • KVM
  • VM running on a cloud service, please be explicit and add details
  • container (Kubernetes, Docker, containerd, etc. please specify)
  • or a combination, please be explicit
  • jails if it is FreeBSD
  • classic packaging
  • onedir packaging
  • used bootstrap to install

Steps to Reproduce the behavior
(Include debug logs if possible and relevant)

Expected behavior
When a command is run that is allowed it should run. When a command is not specified to be allowed it should be:

Authorization error occurred.

Screenshots
If applicable, add screenshots to help explain your problem.

Versions Report

salt --versions-report (Provided by running salt --versions-report. Please also mention any differences in master/minion versions.)
Salt Version:
          Salt: 3006.6

Python Version:
        Python: 3.10.13 (main, Nov 15 2023, 04:34:27) [GCC 11.2.0]

Dependency Versions:
          cffi: 1.16.0
      cherrypy: unknown
      dateutil: 2.8.1
     docker-py: Not Installed
         gitdb: 4.0.11
     gitpython: 3.1.40
        Jinja2: 3.1.3
       libgit2: Not Installed
  looseversion: 1.0.2
      M2Crypto: Not Installed
          Mako: Not Installed
       msgpack: 1.0.2
  msgpack-pure: Not Installed
  mysql-python: Not Installed
     packaging: 22.0
     pycparser: 2.21
      pycrypto: Not Installed
  pycryptodome: 3.19.1
        pygit2: Not Installed
  python-gnupg: 0.4.8
        PyYAML: 6.0.1
         PyZMQ: 23.2.0
        relenv: 0.14.2
         smmap: 5.0.1
       timelib: 0.2.4
       Tornado: 4.5.3
           ZMQ: 4.3.4

System Versions:
          dist: rhel 9.3 Plow
        locale: utf-8
       machine: x86_64
       release: 5.14.0-362.18.1.el9_3.x86_64
        system: Linux
       version: Red Hat Enterprise Linux 9.3 Plow

Additional context
Add any other context about the problem here.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the publisher_acl configuration and the salt '' test.ping and salt '' pillar.items commands on Salt 3006.6, then trace the authorization path used by those commands. Done means the allowed pillar.items command succeeds while the unauthorized test.ping command returns "Authorization error occurred."

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
authorization, cli, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.