[Security Solution] split endpoint rbac feature flags (#143991)

elastic · Oct 28, 2022 · c5b1afd · c5b1afd
1 parent c7769ce
commit c5b1afd
Show file tree

Hide file tree

Showing 8 changed files with 439 additions and 414 deletions.
diff --git a/x-pack/plugins/security_solution/common/endpoint/service/authz/authz.test.ts b/x-pack/plugins/security_solution/common/endpoint/service/authz/authz.test.ts
@@ -115,6 +115,10 @@ describe('Endpoint Authz service', () => {
     });
 
     describe('and endpoint rbac is enabled', () => {
+      beforeEach(() => {
+        userRoles = [];
+      });
+
       it.each<[EndpointAuthzKeyList[number], string]>([
         ['canWriteEndpointList', 'writeEndpointList'],
         ['canReadEndpointList', 'readEndpointList'],

diff --git a/x-pack/plugins/security_solution/common/endpoint/service/authz/authz.ts b/x-pack/plugins/security_solution/common/endpoint/service/authz/authz.ts
@@ -25,9 +25,18 @@ function hasPermission(
   hasEndpointManagementAccess: boolean,
   privilege: typeof ENDPOINT_PRIVILEGES[number]
 ): boolean {
-  return isEndpointRbacEnabled
-    ? fleetAuthz.packagePrivileges?.endpoint?.actions[privilege].executePackageAction ?? false
-    : hasEndpointManagementAccess;
+  // user is superuser, always return true
+  if (hasEndpointManagementAccess) {
+    return true;
+  }
+
+  // not superuser and FF not enabled, no access
+  if (!isEndpointRbacEnabled) {
+    return false;
+  }
+
+  // FF enabled, access based on privileges
+  return fleetAuthz.packagePrivileges?.endpoint?.actions[privilege].executePackageAction ?? false;
 }
 
 /**

diff --git a/x-pack/plugins/security_solution/common/experimental_features.ts b/x-pack/plugins/security_solution/common/experimental_features.ts
@@ -65,6 +65,12 @@ export const allowedExperimentalValues = Object.freeze({
    */
   endpointRbacEnabled: false,
 
+  /**
+   * Enables endpoint package level rbac for response actions only.
+   * if endpointRbacEnabled is enabled, it will take precedence.
+   */
+  endpointRbacV1Enabled: false,
+
   /**
    * Enables the Guided Onboarding tour in security
    */

diff --git a/...ity_solution/public/common/components/user_privileges/endpoint/use_endpoint_privileges.ts b/...ity_solution/public/common/components/user_privileges/endpoint/use_endpoint_privileges.ts
@@ -44,6 +44,7 @@ export const useEndpointPrivileges = (): Immutable<EndpointPrivileges> => {
 
   const fleetServices = fleetServicesFromUseKibana ?? fleetServicesFromPluginStart;
   const isEndpointRbacEnabled = useIsExperimentalFeatureEnabled('endpointRbacEnabled');
+  const isEndpointRbacV1Enabled = useIsExperimentalFeatureEnabled('endpointRbacV1Enabled');
 
   const endpointPermissions = calculatePermissionsFromCapabilities(
     useKibana().services.application.capabilities
@@ -57,7 +58,7 @@ export const useEndpointPrivileges = (): Immutable<EndpointPrivileges> => {
             licenseService,
             fleetAuthz,
             userRoles,
-            isEndpointRbacEnabled,
+            isEndpointRbacEnabled || isEndpointRbacV1Enabled,
             endpointPermissions
           )
         : getEndpointAuthzInitialState()),
@@ -72,6 +73,7 @@ export const useEndpointPrivileges = (): Immutable<EndpointPrivileges> => {
     licenseService,
     userRoles,
     isEndpointRbacEnabled,
+    isEndpointRbacV1Enabled,
     endpointPermissions,
   ]);
 

diff --git a/x-pack/plugins/security_solution/public/management/links.ts b/x-pack/plugins/security_solution/public/management/links.ts
@@ -244,7 +244,7 @@ export const getManagementFilteredLinks = async (
   plugins: StartPlugins
 ): Promise<LinkItem> => {
   const fleetAuthz = plugins.fleet?.authz;
-  const isEndpointRbacEnabled = ExperimentalFeaturesService.get().endpointRbacEnabled;
+  const { endpointRbacEnabled, endpointRbacV1Enabled } = ExperimentalFeaturesService.get();
   const endpointPermissions = calculatePermissionsFromCapabilities(core.application.capabilities);
   const linksToExclude: SecurityPageName[] = [];
 
@@ -255,7 +255,7 @@ export const getManagementFilteredLinks = async (
           licenseService,
           fleetAuthz,
           currentUserResponse.roles,
-          isEndpointRbacEnabled,
+          endpointRbacEnabled || endpointRbacV1Enabled,
           endpointPermissions
         )
       : getEndpointAuthzInitialState();

diff --git a/x-pack/plugins/security_solution/server/endpoint/endpoint_app_context_services.ts b/x-pack/plugins/security_solution/server/endpoint/endpoint_app_context_services.ts
@@ -167,7 +167,7 @@ export class EndpointAppContextService {
   public async getEndpointAuthz(request: KibanaRequest): Promise<EndpointAuthz> {
     const fleetAuthz = await this.getFleetAuthzService().fromRequest(request);
     const userRoles = this.security?.authc.getCurrentUser(request)?.roles ?? [];
-    const isEndpointRbacEnabled = this.experimentalFeatures.endpointRbacEnabled;
+    const { endpointRbacEnabled, endpointRbacV1Enabled } = this.experimentalFeatures;
 
     let endpointPermissions = defaultEndpointPermissions();
     if (this.security) {
@@ -185,7 +185,7 @@ export class EndpointAppContextService {
       this.getLicenseService(),
       fleetAuthz,
       userRoles,
-      isEndpointRbacEnabled,
+      endpointRbacEnabled || endpointRbacV1Enabled,
       endpointPermissions
     );
   }