Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Avoid leakage of state.check_commandline to restricted users #784

Merged
merged 2 commits into from
Jun 22, 2023
Merged

Avoid leakage of state.check_commandline to restricted users #784

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a8f891f
Avoid leakage of `state.check_commandline` to restricted users
raviks789 Jun 21, 2023
6f6defc
VolatileStateResults: Don't reapply commandline values if not permitted
nilmerg Jun 22, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 31 additions & 0 deletions library/Icingadb/Common/Auth.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -137,6 +137,9 @@ public function applyRestrictions(Query $query)
// Hence why the hosts restriction is also applied if only services are queried.
|| $applyServiceRestriction;

$hostStateRelation = array_search('host_state', $relations, true);
$serviceStateRelation = array_search('service_state', $relations, true);

$resolver = $query->getResolver();

$queryFilter = Filter::any();
Expand Down Expand Up @@ -196,6 +199,34 @@ public function applyRestrictions(Query $query)
}
}

if (! $this->getAuth()->hasPermission('icingadb/object/show-source')) {
// In case the user does not have permission to see the object's `Source` tab, then the user must be
// restricted from accessing the executed command for the object.
$columns = $query->getColumns();
$commandColumns = [];
if ($hostStateRelation !== false) {
$commandColumns[] = $resolver->qualifyColumn('check_commandline', $hostStateRelation);
}

if ($serviceStateRelation !== false) {
$commandColumns[] = $resolver->qualifyColumn('check_commandline', $serviceStateRelation);
}

if (! empty($columns)) {
foreach ($commandColumns as $commandColumn) {
$commandColumnPath = array_search($commandColumn, $columns, true);
if ($commandColumnPath !== false) {
$columns[$commandColumn] = new Expression("'***'");
unset($columns[$commandColumnPath]);
}
}

$query->columns($columns);
} else {
$query->withoutColumns($commandColumns);
}
}

if (! $obfuscationRules->isEmpty()) {
$flatvaluePath = $customVarRelationName
? $resolver->qualifyColumn('flatvalue', $customVarRelationName)
Expand Down
8 changes: 8 additions & 0 deletions library/Icingadb/Redis/VolatileStateResults.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
use Exception;
use Generator;
use Icinga\Application\Benchmark;
use Icinga\Module\Icingadb\Common\Auth;
use Icinga\Module\Icingadb\Common\IcingaRedis;
use Icinga\Module\Icingadb\Model\Host;
use Icinga\Module\Icingadb\Model\Service;
Expand All @@ -18,6 +19,8 @@

class VolatileStateResults extends ResultSet
{
use Auth;

/** @var Resolver */
private $resolver;

Expand Down Expand Up @@ -91,6 +94,8 @@ protected function applyRedisUpdates()
$keys = [];
$hostStateKeys = [];

$showSourceGranted = $this->getAuth()->hasPermission('icingadb/object/show-source');

$states = [];
$hostStates = [];
foreach ($this as $row) {
Expand All @@ -112,6 +117,9 @@ protected function applyRedisUpdates()
$states[bin2hex($row->id)] = $row->state;
if (empty($keys)) {
$keys = $row->state->getColumns();
if (! $showSourceGranted) {
$keys = array_diff($keys, ['check_commandline']);
}
}

if ($type === 'service' && $row->host instanceof Host) {
Expand Down