Tim Gross a92461cdc9 auth: add server-only ACL (#18715) ...

* auth: add server-only ACL

The RPC handlers expect to see `nil` ACL objects whenever ACLs are disabled. By
using `nil` as a sentinel value, we have the risk of nil pointer exceptions and
improper handling of `nil` when returned from our various auth methods that can
lead to privilege escalation bugs. This is the second in a series to eliminate
the use of `nil` ACLs as a sentinel value for when ACLs are disabled.

This patch involves creating a new "virtual" ACL object for checking permissions
on server operations and a matching `AuthenticateServerOnly` method for
server-only RPCs that can produce that ACL.

Ref: https://github.com/hashicorp/nomad-enterprise/pull/1218
Ref: https://github.com/hashicorp/nomad/pull/18703

2023-10-11 10:59:31 -04:00

..

acl_test.go

auth: add server-only ACL (#18715)

2023-10-11 10:59:31 -04:00

acl.go

auth: add server-only ACL (#18715)

2023-10-11 10:59:31 -04:00

policy_test.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:29 -05:00

policy.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:29 -05:00

virtual.go

auth: add server-only ACL (#18715)

2023-10-11 10:59:31 -04:00