add cluster:admin/scripts/painless/execute to kibana_system

[mattkime]

as discussed #48856 (comment)

[elasticmachine]

Pinging @elastic/es-security (Team:Security)

[bytebilly]

Thanks for opening this @mattkime.

I think that — even if the change is not that complex — we should evaluate from a security perspective how it will be used by Kibana to handle the Runtime Fields authoring use case. We should avoid any scenario where users can leverage it to perform any data exfiltration or privilege escalation. Once assessed that, I'm supportive to proceed.

[sixstringcode]

@bytebilly is that something that we can evaluate in the near term?

[bytebilly]

@sixstringcode we need get the approach validated, still under discussion in #48856. This issue may or may not be done based on its outcome.

[javanna]

I discussed this with @tvernum and @rjernst and we've agreed that adding cluster:admin/scripts/painless/execute privilege to kibana_system is not the right solution. What we'd like to do instead is require a different privilege for executing painless execute when an index is specified, given that users can already execute scripts as part of the search API which requires data read permissions only. I opened #85512 with a proposed solution for this that I hope can unblock things.