[Security Solution] Add kibana system permissions for Endpoint action indices #81953

kevinlog · 2021-12-20T17:44:08Z

The PR adds proper permissions for the kibana_system user to two indices specific to Endpoint actions.

The two indices are .logs-endpoint.actions-* and .logs-endpoint.action.responses-* .

The kibana_system user will create, write, and read from the .logs-endpoint-actions-* index to log new actions and visualize them for users.

The kibana_system user will read from .logs-endpoint.action.responses-*` to visualize responses from the Endpoint for the user.

This changes is needed as Endpoint Security currently requires the superuser role. As we move away from superuser and as superuser become less permissive with system indices, we need to ensure kibana_system can properly interact with these indices. We have Kibana PRs which convert our API calls to ES from reading these system indices as asCurrentUser to asInternalUser .

Relevant Kibana PRs:
elastic/kibana#121642
elastic/kibana#121681

Checked out the Kibana PRs and ran it against a locally running ES and verified that the permissions are now properly set and we can display the proper UI:

… indices

…ndpoint-action-kibana-system-permissions

elasticmachine · 2021-12-20T20:49:18Z

Pinging @elastic/es-security (Team:Security)

ywangd

LGTM

I'd appreciate if you could address the comments before merging. Thanks!

ywangd · 2021-12-20T23:39:09Z

...core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStore.java

@@ -683,6 +683,13 @@ public static RoleDescriptor kibanaSystemRoleDescriptor(String name) {
                // Fleet Server indices. Kibana create this indice before Fleet Server use them.
                // Fleet Server indices. Kibana read and write to this indice to manage Elastic Agents
                RoleDescriptor.IndicesPrivileges.builder().indices(".fleet*").allowRestrictedIndices(true).privileges("all").build(),
+                // Endpoint specific action responses. Kibana reads from these to display responses to the user.
+                RoleDescriptor.IndicesPrivileges.builder().indices(".logs-endpoint.action.responses-*").privileges("read").build(),


I think we should merge this statement with the one from line 682:

elasticsearch/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStore.java

Line 682 in 3027039

RoleDescriptor.IndicesPrivileges.builder().indices(".logs-endpoint.diagnostic.collection-*").privileges("read").build(),

Read through the existing code, I'd prefer to put the merged statement under the block starting at line 709 so that related grants stay together:

elasticsearch/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStore.java

Lines 709 to 720 in 3027039

RoleDescriptor.IndicesPrivileges.builder()

.indices(

"logs-*",

"synthetics-*",

"traces-*",

"/metrics-.*&~(metrics-endpoint\\.metadata_current_default)/",

".logs-endpoint.action.responses-*",

".logs-endpoint.diagnostic.collection-*",

".logs-endpoint.actions-*"

)

.privileges(UpdateSettingsAction.NAME, PutMappingAction.NAME, RolloverAction.NAME)

.build(),

statement is moved: f703c23

ywangd · 2021-12-20T23:40:49Z

...core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStore.java

+                RoleDescriptor.IndicesPrivileges.builder()
+                    .indices(".logs-endpoint.actions-*")
+                    .privileges("create_index", "auto_configure", "read", "write")
+                    .build(),


We can remove auto_configure since it is covered by create_index and write.

Similar to the above comment, I'd prefer we relocate this statement along with the above one to under line 709-720.

removed auto_configure and moved the statement: f703c23

updating this, based on feedback further down, I'm using auto_configure as opposed to create_index

ywangd · 2021-12-20T23:48:19Z

Btw, the term "system indices" is mentioned a few times in the PR description. But neither .logs-endpoint.actions-* or .logs-endpoint.action.responses-* is currently a system index. Are there plans from the endpoint or observability side to change it?

kevinlog · 2021-12-21T13:25:06Z

@ywangd

Btw, the term "system indices" is mentioned a few times in the PR description.

This is me getting terms confused. These datastreams are marked as hidden, not system indices. Thanks for verifying.

My understanding is the superuser access is being limited for any . indices, so we are being proactive with this change. Let me know if I'm missing something.

joshdover · 2021-12-21T13:49:50Z

...core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStore.java

+                // Endpoint specific actions. Kibana reads and writes to this index to track new actions and display them.
+                RoleDescriptor.IndicesPrivileges.builder()
+                    .indices(".logs-endpoint.actions-*")
+                    .privileges("create_index", "read", "write")


Do we actually need create_index or could we use auto_configure instead and rely on an index template in the Endpoint package?

Yeah, auto_configure should work here. privileges-list-indices

I just made the change and tested again

ywangd · 2021-12-21T21:29:01Z

My understanding is the superuser access is being limited for any . indices, so we are being proactive with this change. Let me know if I'm missing something.

The plan is to not allow superuser to "write" to system indices. Hidden indices are not part of the restriction. But it is always better to move away from using superuser since it is still a very powerful (and unnecessary for most use cases) user even with the restriction.

… indices (elastic#81953) * [Security Solution] Add kibana system permissions for Endpoint action indices

… indices (#81953) (#82015) * [Security Solution] Add kibana system permissions for Endpoint action indices Co-authored-by: Kevin Logan <56395104+kevinlog@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

… indices (#81953) (#82206) * [Security Solution] Add kibana system permissions for Endpoint action indices

[Security Solution] Add kibana system permissions for Endpoint action…

9918998

… indices

elasticsearchmachine added v8.1.0 external-contributor Pull request authored by a developer outside the Elasticsearch team labels Dec 20, 2021

kevinlog added 4 commits December 20, 2021 12:59

check style

7478af9

check styles

7e07347

fix tests

b30546a

fix style

42d04ff

kevinlog added v7.17.0 v8.0.0 :Security/Authorization Roles, Privileges, DLS/FLS, RBAC/ABAC Team:Security Meta label for security team auto-backport-and-merge labels Dec 20, 2021

Merge branch 'master' of github.com:elastic/elasticsearch into task/e…

4318a91

…ndpoint-action-kibana-system-permissions

kevinlog marked this pull request as ready for review December 20, 2021 20:49

kevinlog requested review from joshdover and ywangd December 20, 2021 20:49

kevinlog added the >enhancement label Dec 20, 2021

ywangd approved these changes Dec 20, 2021

View reviewed changes

address pr comments

f703c23

kevinlog mentioned this pull request Dec 21, 2021

[Security Solution][Endpoint] Use internal kibana client to write to ES system indices elastic/kibana#121642

Merged

2 tasks

joshdover reviewed Dec 21, 2021

View reviewed changes

use auto_create

5487284

kevinlog merged commit c541150 into elastic:master Dec 21, 2021

ywangd pushed a commit to ywangd/elasticsearch that referenced this pull request Dec 21, 2021

[Security Solution] Add kibana system permissions for Endpoint action…

601408d

… indices (elastic#81953) * [Security Solution] Add kibana system permissions for Endpoint action indices

ywangd mentioned this pull request Dec 21, 2021

[Security Solution] Add kibana system permissions for Endpoint action indices (#81953) #82015

Merged

kevinlog deleted the task/endpoint-action-kibana-system-permissions branch December 27, 2021 12:39

kevinlog mentioned this pull request Dec 27, 2021

[7.17] [Security Solution][Endpoint] Use internal kibana client to write to ES system indices (#121642) elastic/kibana#122038

Merged

kevinlog mentioned this pull request Jan 4, 2022

[7.17] [Security Solution] Add kibana system permissions for Endpoint action indices (#81953) #82206

Merged

elasticsearchmachine pushed a commit that referenced this pull request Jan 4, 2022

[Security Solution] Add kibana system permissions for Endpoint action…

2fed2b0

… indices (#81953) (#82206) * [Security Solution] Add kibana system permissions for Endpoint action indices

mark-vieira added v8.0.0-rc1 and removed v8.0.0 labels Jan 12, 2022

patrykkopycinski mentioned this pull request Feb 23, 2022

[Osquery] Extend kibana_system role with an access to osquery_manager indices #84279

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution] Add kibana system permissions for Endpoint action indices #81953

[Security Solution] Add kibana system permissions for Endpoint action indices #81953

kevinlog commented Dec 20, 2021 •

edited

Loading

elasticmachine commented Dec 20, 2021

ywangd left a comment

ywangd Dec 20, 2021

kevinlog Dec 21, 2021

ywangd Dec 20, 2021

kevinlog Dec 21, 2021

kevinlog Dec 21, 2021

ywangd commented Dec 20, 2021

kevinlog commented Dec 21, 2021

joshdover Dec 21, 2021

ashokaditya Dec 21, 2021

kevinlog Dec 21, 2021

ywangd commented Dec 21, 2021

	RoleDescriptor.IndicesPrivileges.builder()
	.indices(
	"logs-*",
	"synthetics-*",
	"traces-*",
	"/metrics-.*&~(metrics-endpoint\\.metadata_current_default)/",
	".logs-endpoint.action.responses-*",
	".logs-endpoint.diagnostic.collection-*",
	".logs-endpoint.actions-*"
	)
	.privileges(UpdateSettingsAction.NAME, PutMappingAction.NAME, RolloverAction.NAME)
	.build(),

[Security Solution] Add kibana system permissions for Endpoint action indices #81953

[Security Solution] Add kibana system permissions for Endpoint action indices #81953

Conversation

kevinlog commented Dec 20, 2021 • edited Loading

elasticmachine commented Dec 20, 2021

ywangd left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ywangd commented Dec 20, 2021

kevinlog commented Dec 21, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ywangd commented Dec 21, 2021

kevinlog commented Dec 20, 2021 •

edited

Loading