From 1cd4647e554e49a36577bccbc90bd21f24392161 Mon Sep 17 00:00:00 2001 From: Ido Cohen Date: Thu, 24 Mar 2022 18:51:42 +0200 Subject: [PATCH 1/2] fix rebase errors --- .../authz/store/ReservedRolesStore.java | 11 ++++- .../authz/store/ReservedRolesStoreTests.java | 44 +++++++++++++++++++ 2 files changed, 54 insertions(+), 1 deletion(-) diff --git a/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStore.java b/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStore.java index 72b2e237d7702..554d34c031850 100644 --- a/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStore.java +++ b/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStore.java @@ -793,7 +793,16 @@ public static RoleDescriptor kibanaSystemRoleDescriptor(String name) { ".metrics-endpoint.metadata_united_default" ) .privileges("create_index", "delete_index", "read", "index") - .build(), }, + .build(), + // For src/dest indices of the CSP packages that ships a transform + RoleDescriptor.IndicesPrivileges.builder() + .indices("logs-cis_kubernetes_benchmark.findings-*") + .privileges("read", "view_index_metadata") + .build(), + RoleDescriptor.IndicesPrivileges.builder() + .indices("logs-cloud_security_posture.findings_latest-default", "logs-cloud_security_posture.scores-default") + .privileges("create_index", "read", "index", "delete") + .build() }, null, new ConfigurableClusterPrivilege[] { new ManageApplicationPrivileges(Set.of("kibana-*")), diff --git a/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java b/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java index 946a0ea10dba7..b8bab79e6c4d3 100644 --- a/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java +++ b/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java @@ -932,6 +932,50 @@ public void testKibanaSystemRole() { assertThat(kibanaRole.indices().allowedIndicesMatcher(RolloverAction.NAME).test(indexAbstraction), is(false)); }); + // read-only datastream for csp indices + Arrays.asList("logs-cis_kubernetes_benchmark.findings-" + randomAlphaOfLength(randomIntBetween(0, 13))).forEach((cspIndex) -> { + final IndexAbstraction indexAbstraction = mockIndexAbstraction(cspIndex); + assertThat(kibanaRole.indices().allowedIndicesMatcher("indices:foo").test(indexAbstraction), is(false)); + assertThat(kibanaRole.indices().allowedIndicesMatcher("indices:bar").test(indexAbstraction), is(false)); + assertThat(kibanaRole.indices().allowedIndicesMatcher(DeleteIndexAction.NAME).test(indexAbstraction), is(false)); + assertThat(kibanaRole.indices().allowedIndicesMatcher(GetIndexAction.NAME).test(indexAbstraction), is(true)); + assertThat(kibanaRole.indices().allowedIndicesMatcher(CreateIndexAction.NAME).test(indexAbstraction), is(false)); + assertThat(kibanaRole.indices().allowedIndicesMatcher(IndexAction.NAME).test(indexAbstraction), is(false)); + assertThat(kibanaRole.indices().allowedIndicesMatcher(DeleteAction.NAME).test(indexAbstraction), is(false)); + assertThat(kibanaRole.indices().allowedIndicesMatcher(SearchAction.NAME).test(indexAbstraction), is(true)); + assertThat(kibanaRole.indices().allowedIndicesMatcher(MultiSearchAction.NAME).test(indexAbstraction), is(true)); + assertThat(kibanaRole.indices().allowedIndicesMatcher(GetAction.NAME).test(indexAbstraction), is(true)); + assertThat(kibanaRole.indices().allowedIndicesMatcher(READ_CROSS_CLUSTER_NAME).test(indexAbstraction), is(false)); + assertThat(kibanaRole.indices().allowedIndicesMatcher(UpdateSettingsAction.NAME).test(indexAbstraction), is(true)); + assertThat(kibanaRole.indices().allowedIndicesMatcher(PutMappingAction.NAME).test(indexAbstraction), is(true)); + assertThat(kibanaRole.indices().allowedIndicesMatcher(RolloverAction.NAME).test(indexAbstraction), is(true)); + }); + + Arrays.asList("logs-cloud_security_posture.findings_latest-default", "logs-cloud_security_posture.scores-default") + .forEach(indexName -> { + logger.info("index name [{}]", indexName); + final IndexAbstraction indexAbstraction = mockIndexAbstraction(indexName); + // Allow indexing + assertThat(kibanaRole.indices().allowedIndicesMatcher(SearchAction.NAME).test(indexAbstraction), is(true)); + assertThat(kibanaRole.indices().allowedIndicesMatcher(GetAction.NAME).test(indexAbstraction), is(true)); + assertThat(kibanaRole.indices().allowedIndicesMatcher(IndexAction.NAME).test(indexAbstraction), is(true)); + assertThat(kibanaRole.indices().allowedIndicesMatcher(UpdateAction.NAME).test(indexAbstraction), is(true)); + assertThat(kibanaRole.indices().allowedIndicesMatcher(BulkAction.NAME).test(indexAbstraction), is(true)); + // Allow create and delete index + assertThat(kibanaRole.indices().allowedIndicesMatcher(CreateIndexAction.NAME).test(indexAbstraction), is(true)); + assertThat(kibanaRole.indices().allowedIndicesMatcher(AutoCreateAction.NAME).test(indexAbstraction), is(true)); + assertThat(kibanaRole.indices().allowedIndicesMatcher(CreateDataStreamAction.NAME).test(indexAbstraction), is(true)); + + // Implied by the overall view_index_metadata and monitor privilege + assertViewIndexMetadata(kibanaRole, indexName); + assertThat( + kibanaRole.indices() + .allowedIndicesMatcher("indices:monitor/" + randomAlphaOfLengthBetween(3, 8)) + .test(indexAbstraction), + is(true) + ); + }); + // Ensure privileges necessary for ILM policies in APM & Endpoint packages Arrays.asList( ".logs-endpoint.diagnostic.collection-" + randomAlphaOfLengthBetween(3, 8), From 090c8764d4233b43bc9b7cf51720b664c7659d0b Mon Sep 17 00:00:00 2001 From: Ido Cohen Date: Mon, 28 Mar 2022 12:50:17 +0300 Subject: [PATCH 2/2] update comment --- .../xpack/core/security/authz/store/ReservedRolesStore.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStore.java b/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStore.java index 554d34c031850..e2c2d03bf6364 100644 --- a/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStore.java +++ b/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStore.java @@ -794,7 +794,7 @@ public static RoleDescriptor kibanaSystemRoleDescriptor(String name) { ) .privileges("create_index", "delete_index", "read", "index") .build(), - // For src/dest indices of the CSP packages that ships a transform + // For src/dest indices of the Cloud Security Posture packages that ships a transform RoleDescriptor.IndicesPrivileges.builder() .indices("logs-cis_kubernetes_benchmark.findings-*") .privileges("read", "view_index_metadata")