mirror of
https://github.com/kemko/nomad.git
synced 2026-01-01 16:05:42 +03:00
cbd7248248
The RPC handlers expect to see `nil` ACL objects whenever ACLs are disabled. By using `nil` as a sentinel value, we have the risk of nil pointer exceptions and improper handling of `nil` when returned from our various auth methods that can lead to privilege escalation bugs. This is the final patch in a series to eliminate the use of `nil` ACLs as a sentinel value for when ACLs are disabled. This patch adds a new virtual ACL policy field for when ACLs are disabled and updates our authentication logic to use it. Included: * Extends auth package tests to demonstrate that nil ACLs are treated as failed auth and disabled ACLs succeed auth. * Adds a new `AllowDebug` ACL check for the weird special casing we have for pprof debugging when ACLs are disabled. * Removes the remaining unexported methods (and repeated tests) from the `nomad/acl.go` file. * Update the semgrep rules to detect improper nil ACL checking and remove the old invalid ACL checks. * Update the contributing guide for RPC authentication. Ref: https://github.com/hashicorp/nomad-enterprise/pull/1218 Ref: https://github.com/hashicorp/nomad/pull/18703 Ref: https://github.com/hashicorp/nomad/pull/18715 Ref: https://github.com/hashicorp/nomad/pull/16799 Ref: https://github.com/hashicorp/nomad/pull/18730 Ref: https://github.com/hashicorp/nomad/pull/18744
39 lines
732 B
Go
39 lines
732 B
Go
// Copyright (c) HashiCorp, Inc.
|
|
// SPDX-License-Identifier: BUSL-1.1
|
|
|
|
package acl
|
|
|
|
var ClientACL = initClientACL()
|
|
var ServerACL = initServerACL()
|
|
var ACLsDisabledACL = initACLsDisabledACL()
|
|
|
|
func initClientACL() *ACL {
|
|
aclObj, err := NewACL(false, []*Policy{})
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
aclObj.client = PolicyWrite
|
|
aclObj.agent = PolicyRead
|
|
aclObj.server = PolicyRead
|
|
return aclObj
|
|
}
|
|
|
|
func initServerACL() *ACL {
|
|
aclObj, err := NewACL(false, []*Policy{})
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
aclObj.agent = PolicyRead
|
|
aclObj.server = PolicyWrite
|
|
return aclObj
|
|
}
|
|
|
|
func initACLsDisabledACL() *ACL {
|
|
aclObj, err := NewACL(false, []*Policy{})
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
aclObj.aclsDisabled = true
|
|
return aclObj
|
|
}
|