Skip to content

Commit

Permalink
Fixes the permissions to require cluster.manage in order to create an…
Browse files Browse the repository at this point in the history
… index and in order to update an index (#89947) (#89968)

## Summary

Fixes error toaster on signals upgrades as well as creation of new signals if you have a user without a cluster manage privilege.

Simplest way to manually test both situations of a user on creating a new signal as well as upgrade is to first create a new role like so in dev tools:

```ts
PUT _security/role/reduced_permissions
{
   "indices":[
      {
         "names":[
            ".siem-signals-*",
            ".lists-*",
            ".items-*"
         ],
         "privileges":[
            "all"
         ],
         "field_security":{
            "grant":[
               "*"
            ]
         },
         "allow_restricted_indices":false
      }
   ],
   "applications":[
      {
         "application":"kibana-.kibana",
         "privileges":[
            "space_all"
         ],
         "resources":[
            "space:default"
         ]
      }
   ]
}
```

You might have to change this line above to match what your `kibana.index` is set to if it is set:
```ts
 "application" : "kibana-.kibana-hassanabad8",
```

Double check things in Stack Management to ensure you have access to at least default space:
<img width="1304" alt="Screen Shot 2021-02-01 at 5 45 54 PM" src="https://user-images.githubusercontent.com/1151048/106536383-906f3f00-64b5-11eb-97d3-060fa6f6206e.png">

Next add a user which has this role of `reduced_permissions` to login as that user. Next for testing that this causes an error toaster when there is no signals index is to either manually delete your signals index or change your `kibana.dev.yml` so that it thinks you have a new index:

```ts
xpack.securitySolution.signalsIndex: .siem-signals-some-new-index-name
```

Start up Kibana, login with the new user and visit any page and notice you get an error toaster like below:
<img width="808" alt="Screen Shot 2021-02-01 at 5 04 17 PM" src="https://user-images.githubusercontent.com/1151048/106535815-4afe4200-64b4-11eb-89b3-947b0e4ff7d5.png">

And also notice that you are blocked from viewing signals at this point:
<img width="1195" alt="Screen Shot 2021-02-01 at 5 04 43 PM" src="https://user-images.githubusercontent.com/1151048/106535835-56516d80-64b4-11eb-883c-2745b68843cf.png">

For upgrading signals manually, you can change the version number from dev tools or increment the number directly within this file and restart Kibana:
https://github.com/elastic/kibana/blob/master/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/get_signals_template.ts#L10

When you visit the detection page you will see the same error toaster and also be blocked. With this PR you will no longer be blocked.

### Checklist

Delete any items that are not applicable to this PR.

- [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
  • Loading branch information
FrankHassanabad authored Feb 2, 2021
1 parent dc7ef4e commit 9390b7f
Showing 1 changed file with 1 addition and 1 deletion.
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,7 @@ export const usePrivilegeUser = (): ReturnPrivilegeUser => {
setPrivilegeUser({
isAuthenticated: privilege.is_authenticated,
hasEncryptionKey: privilege.has_encryption_key,
hasIndexManage: privilege.index[indexName].manage,
hasIndexManage: privilege.index[indexName].manage && privilege.cluster.manage,
hasIndexMaintenance: privilege.index[indexName].maintenance,
hasIndexWrite:
privilege.index[indexName].create ||
Expand Down

0 comments on commit 9390b7f

Please sign in to comment.