Tim Gross a92461cdc9 auth: add server-only ACL (#18715) ...

* auth: add server-only ACL

The RPC handlers expect to see `nil` ACL objects whenever ACLs are disabled. By
using `nil` as a sentinel value, we have the risk of nil pointer exceptions and
improper handling of `nil` when returned from our various auth methods that can
lead to privilege escalation bugs. This is the second in a series to eliminate
the use of `nil` ACLs as a sentinel value for when ACLs are disabled.

This patch involves creating a new "virtual" ACL object for checking permissions
on server operations and a matching `AuthenticateServerOnly` method for
server-only RPCs that can produce that ACL.

Ref: https://github.com/hashicorp/nomad-enterprise/pull/1218
Ref: https://github.com/hashicorp/nomad/pull/18703

2023-10-11 10:59:31 -04:00

..

api_errorf.yml

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

changelog.yml

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

fsm_time.yml

ci: ensure semgrep tests all state store funcs for FSM time rule. (#18315)

2023-08-24 15:08:53 +01:00

go_tests.yml

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

http_endpoint.yml

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

imports.yml

all: swap exp packages for maps, slices (#18311)

2023-08-23 15:42:13 -05:00

loopclosure.yml

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

protect_globals.yml

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

rpc_endpoint.yml

auth: add server-only ACL (#18715)

2023-10-11 10:59:31 -04:00

rpc_metrics.yml

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

time_after.yml

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

ui.yml

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00