Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Disallow mapping updates for doc ingestion privileges #58784

Merged
merged 43 commits into from
Jul 14, 2020
Merged

Disallow mapping updates for doc ingestion privileges #58784

Show file tree
Hide file tree
Changes from 37 commits
Commits
Show all changes
43 commits
Select commit Hold shift + click to select a range
d62250d
Done maybe
albertzaharovits Jun 30, 2020
547faa3
Merge branch 'master' into remove_put_mapping_priv
albertzaharovits Jun 30, 2020
9dce3fc
Merge branch 'master' into remove_put_mapping_priv
albertzaharovits Jul 6, 2020
00bbb0f
Merge fallout
albertzaharovits Jul 6, 2020
f4fb1c7
Auto put mapping is also bwc supported
albertzaharovits Jul 6, 2020
ac0966d
IndicesPermission
albertzaharovits Jul 7, 2020
63e7ade
WIP
albertzaharovits Jul 7, 2020
905e458
Maybeee?
albertzaharovits Jul 7, 2020
e2dc3f9
authorizeMappingUpdateBwcSpecialCase
albertzaharovits Jul 7, 2020
9a5ff34
Merge branch 'master' into remove_put_mapping_priv
albertzaharovits Jul 7, 2020
ec96511
ReservedRolesStoreTests
albertzaharovits Jul 7, 2020
e155998
Merge branch 'master' into remove_put_mapping_priv
albertzaharovits Jul 7, 2020
04f95a9
WIP adjust tests
albertzaharovits Jul 7, 2020
a99f9f0
Existing tests compiled
albertzaharovits Jul 7, 2020
0e7efed
Merge branch 'master' into remove_put_mapping_priv
albertzaharovits Jul 7, 2020
4dfe44a
Checkstyle
albertzaharovits Jul 7, 2020
66e244d
Checkstyle
albertzaharovits Jul 7, 2020
2d34b46
Merge branch 'master' into remove_put_mapping_priv
albertzaharovits Jul 7, 2020
44e0517
Merge branch 'master' into remove_put_mapping_priv
albertzaharovits Jul 8, 2020
3c53f41
XPackRestIT
albertzaharovits Jul 8, 2020
008ec5a
index -> write for ml yaml tests
albertzaharovits Jul 8, 2020
aa62846
SmokeTestSecurityWithMustacheClientYamlTestSuiteIT
albertzaharovits Jul 8, 2020
c09a20b
Merge branch 'master' into remove_put_mapping_priv
albertzaharovits Jul 8, 2020
3ec62d3
Data stream tests
albertzaharovits Jul 8, 2020
774a423
Merge branch 'master' into remove_put_mapping_priv
albertzaharovits Jul 8, 2020
4c6383c
IndexPrivilege tests
albertzaharovits Jul 8, 2020
75bb67e
Nit
albertzaharovits Jul 8, 2020
b114c13
IndicesMatcher action
albertzaharovits Jul 8, 2020
4a2394c
Almost
albertzaharovits Jul 8, 2020
e08624a
Done testing
albertzaharovits Jul 8, 2020
4071e95
Review
albertzaharovits Jul 8, 2020
e6bd53f
Merge branch 'master' into remove_put_mapping_priv
albertzaharovits Jul 13, 2020
eb50c54
Merge fallout
albertzaharovits Jul 13, 2020
49b92c6
Review partway
albertzaharovits Jul 13, 2020
50f393b
Merge branch 'master' into remove_put_mapping_priv
albertzaharovits Jul 14, 2020
f5a85d7
Review
albertzaharovits Jul 14, 2020
3d3f64d
Merge branch 'master' into remove_put_mapping_priv
albertzaharovits Jul 14, 2020
44c3473
Review partway
albertzaharovits Jul 14, 2020
fd45d7b
Merge branch 'master' into remove_put_mapping_priv
albertzaharovits Jul 14, 2020
3e4f130
Message
albertzaharovits Jul 14, 2020
148057c
Deprecation msgs fallout
albertzaharovits Jul 14, 2020
9e12382
Update more deprecation logs
albertzaharovits Jul 14, 2020
f3fec33
Merge branch 'master' into remove_put_mapping_priv
albertzaharovits Jul 14, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
170 changes: 125 additions & 45 deletions ...c/main/java/org/elasticsearch/xpack/core/security/authz/permission/IndicesPermission.java
View file
Open in desktop

Large diffs are not rendered by default.

4 changes: 2 additions & 2 deletions ...ore/src/main/java/org/elasticsearch/xpack/core/security/authz/permission/LimitedRole.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,8 +72,8 @@ public IndicesAccessControl authorize(String action, Set<String> requestedIndice
* action on.
*/
@Override
public Predicate<String> allowedIndicesMatcher(String action) {
Predicate<String> predicate = super.indices().allowedIndicesMatcher(action);
public Predicate<IndexAbstraction> allowedIndicesMatcher(String action) {
Predicate<IndexAbstraction> predicate = super.indices().allowedIndicesMatcher(action);
predicate = predicate.and(limitedBy.indices().allowedIndicesMatcher(action));
return predicate;
}
Expand Down
2 changes: 1 addition & 1 deletion ...lugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/permission/Role.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,7 +83,7 @@ public static Builder builder(RoleDescriptor rd, FieldPermissionsCache fieldPerm
* @return A predicate that will match all the indices that this role
* has the privilege for executing the given action on.
*/
public Predicate<String> allowedIndicesMatcher(String action) {
public Predicate<IndexAbstraction> allowedIndicesMatcher(String action) {
return indices.allowedIndicesMatcher(action);
}

Expand Down
11 changes: 4 additions & 7 deletions ...e/src/main/java/org/elasticsearch/xpack/core/security/authz/privilege/IndexPrivilege.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,6 @@
import org.elasticsearch.action.admin.indices.mapping.get.GetFieldMappingsAction;
import org.elasticsearch.action.admin.indices.mapping.get.GetMappingsAction;
import org.elasticsearch.action.admin.indices.mapping.put.AutoPutMappingAction;
import org.elasticsearch.action.admin.indices.mapping.put.PutMappingAction;
import org.elasticsearch.action.admin.indices.settings.get.GetSettingsAction;
import org.elasticsearch.action.admin.indices.validate.query.ValidateQueryAction;
import org.elasticsearch.common.Strings;
Expand Down Expand Up @@ -51,15 +50,13 @@ public final class IndexPrivilege extends Privilege {
private static final Automaton READ_AUTOMATON = patterns("indices:data/read/*");
private static final Automaton READ_CROSS_CLUSTER_AUTOMATON = patterns("internal:transport/proxy/indices:data/read/*",
ClusterSearchShardsAction.NAME);
private static final Automaton CREATE_AUTOMATON = patterns("indices:data/write/index*", "indices:data/write/bulk*",
PutMappingAction.NAME, AutoPutMappingAction.NAME);
private static final Automaton CREATE_AUTOMATON = patterns("indices:data/write/index*", "indices:data/write/bulk*");
private static final Automaton CREATE_DOC_AUTOMATON = patterns("indices:data/write/index", "indices:data/write/index[*",
"indices:data/write/index:op_type/create", "indices:data/write/bulk*", PutMappingAction.NAME, AutoPutMappingAction.NAME);
"indices:data/write/index:op_type/create", "indices:data/write/bulk*");
private static final Automaton INDEX_AUTOMATON = patterns("indices:data/write/index*", "indices:data/write/bulk*",
"indices:data/write/update*", PutMappingAction.NAME, AutoPutMappingAction.NAME);
"indices:data/write/update*");
private static final Automaton DELETE_AUTOMATON = patterns("indices:data/write/delete*", "indices:data/write/bulk*");
private static final Automaton WRITE_AUTOMATON = patterns("indices:data/write/*", PutMappingAction.NAME,
AutoPutMappingAction.NAME);
private static final Automaton WRITE_AUTOMATON = patterns("indices:data/write/*", AutoPutMappingAction.NAME);
private static final Automaton MONITOR_AUTOMATON = patterns("indices:monitor/*");
private static final Automaton MANAGE_AUTOMATON =
unionAndMinimize(Arrays.asList(MONITOR_AUTOMATON, patterns("indices:admin/*")));
Expand Down
36 changes: 23 additions & 13 deletions ...rc/test/java/org/elasticsearch/xpack/core/security/authz/permission/LimitedRoleTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@
import org.elasticsearch.action.bulk.BulkAction;
import org.elasticsearch.action.search.SearchAction;
import org.elasticsearch.cluster.metadata.AliasMetadata;
import org.elasticsearch.cluster.metadata.IndexAbstraction;
import org.elasticsearch.cluster.metadata.IndexMetadata;
import org.elasticsearch.cluster.metadata.Metadata;
import org.elasticsearch.common.collect.MapBuilder;
Expand Down Expand Up @@ -40,6 +41,7 @@
import static org.hamcrest.Matchers.is;
import static org.hamcrest.Matchers.notNullValue;
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.when;

public class LimitedRoleTests extends ESTestCase {
List<ApplicationPrivilegeDescriptor> applicationPrivilegeDescriptors;
Expand Down Expand Up @@ -181,27 +183,27 @@ public void testCheckIndicesAction() {

public void testAllowedIndicesMatcher() {
Role fromRole = Role.builder("a-role").add(IndexPrivilege.READ, "ind-1*").build();
assertThat(fromRole.allowedIndicesMatcher(SearchAction.NAME).test("ind-1"), is(true));
assertThat(fromRole.allowedIndicesMatcher(SearchAction.NAME).test("ind-11"), is(true));
assertThat(fromRole.allowedIndicesMatcher(SearchAction.NAME).test("ind-2"), is(false));
assertThat(fromRole.allowedIndicesMatcher(SearchAction.NAME).test(mockIndexAbstraction("ind-1")), is(true));
assertThat(fromRole.allowedIndicesMatcher(SearchAction.NAME).test(mockIndexAbstraction("ind-11")), is(true));
assertThat(fromRole.allowedIndicesMatcher(SearchAction.NAME).test(mockIndexAbstraction("ind-2")), is(false));

{
Role limitedByRole = Role.builder("limited-role").add(IndexPrivilege.READ, "ind-1", "ind-2").build();
assertThat(limitedByRole.allowedIndicesMatcher(SearchAction.NAME).test("ind-1"), is(true));
assertThat(limitedByRole.allowedIndicesMatcher(SearchAction.NAME).test("ind-11"), is(false));
assertThat(limitedByRole.allowedIndicesMatcher(SearchAction.NAME).test("ind-2"), is(true));
assertThat(limitedByRole.allowedIndicesMatcher(SearchAction.NAME).test(mockIndexAbstraction("ind-1")), is(true));
assertThat(limitedByRole.allowedIndicesMatcher(SearchAction.NAME).test(mockIndexAbstraction("ind-11")), is(false));
assertThat(limitedByRole.allowedIndicesMatcher(SearchAction.NAME).test(mockIndexAbstraction("ind-2")), is(true));
Role role = LimitedRole.createLimitedRole(fromRole, limitedByRole);
assertThat(role.allowedIndicesMatcher(SearchAction.NAME).test("ind-1"), is(true));
assertThat(role.allowedIndicesMatcher(SearchAction.NAME).test("ind-11"), is(false));
assertThat(role.allowedIndicesMatcher(SearchAction.NAME).test("ind-2"), is(false));
assertThat(role.allowedIndicesMatcher(SearchAction.NAME).test(mockIndexAbstraction("ind-1")), is(true));
assertThat(role.allowedIndicesMatcher(SearchAction.NAME).test(mockIndexAbstraction("ind-11")), is(false));
assertThat(role.allowedIndicesMatcher(SearchAction.NAME).test(mockIndexAbstraction("ind-2")), is(false));
}
{
Role limitedByRole = Role.builder("limited-role").add(IndexPrivilege.READ, "ind-*").build();
assertThat(limitedByRole.allowedIndicesMatcher(SearchAction.NAME).test("ind-1"), is(true));
assertThat(limitedByRole.allowedIndicesMatcher(SearchAction.NAME).test("ind-2"), is(true));
assertThat(limitedByRole.allowedIndicesMatcher(SearchAction.NAME).test(mockIndexAbstraction("ind-1")), is(true));
assertThat(limitedByRole.allowedIndicesMatcher(SearchAction.NAME).test(mockIndexAbstraction("ind-2")), is(true));
Role role = LimitedRole.createLimitedRole(fromRole, limitedByRole);
assertThat(role.allowedIndicesMatcher(SearchAction.NAME).test("ind-1"), is(true));
assertThat(role.allowedIndicesMatcher(SearchAction.NAME).test("ind-2"), is(false));
assertThat(role.allowedIndicesMatcher(SearchAction.NAME).test(mockIndexAbstraction("ind-1")), is(true));
assertThat(role.allowedIndicesMatcher(SearchAction.NAME).test(mockIndexAbstraction("ind-2")), is(false));
}
}

Expand Down Expand Up @@ -441,6 +443,14 @@ private void verifyResourcesPrivileges(ResourcePrivilegesMap resourcePrivileges,
assertThat(resourcePrivileges, equalTo(expectedAppPrivsByResource));
}

private IndexAbstraction mockIndexAbstraction(String name) {
IndexAbstraction mock = mock(IndexAbstraction.class);
when(mock.getName()).thenReturn(name);
when(mock.getType()).thenReturn(randomFrom(IndexAbstraction.Type.CONCRETE_INDEX,
IndexAbstraction.Type.ALIAS, IndexAbstraction.Type.DATA_STREAM));
return mock;
}

private ApplicationPrivilege defineApplicationPrivilege(String app, String name, String... actions) {
applicationPrivilegeDescriptors
.add(new ApplicationPrivilegeDescriptor(app, name, Sets.newHashSet(actions), Collections.emptyMap()));
Expand Down
Loading