[Security Solution][Endpoint] Allow access to Endpoint Metadata for users that might only have READONLY access #106328

paul-tavares · 2021-07-20T20:43:55Z

Summary

Endpoint metadata API was modified to use an internal SavedObjects client when using Fleet service to retrieve data (Agent Policies, Agent). This will enable users with ReadOnly permissions to the indexes supporting Endpoint to access endpoint metadata api
Fleet: Changes Agent retrieval service methods so that the agent status is calculated here rather than in the API Route handler
Refactor: A new EndpointMetadataService was created and methods crated to support the GET metadata/{id} api

Testing:

For API testing:

The following indexes should be added to a role as read only:
- metrics-endpoint.metadata_current_*
- .fleet-agents*
- .fleet-actions*
Use credentials of a user whose role has only readonly permission to the above indexes and query the /api/endpoint/metadata/{id} api

For security solution UI testing:

Run the following scripts:

x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/t1_analyst/post_detections_role.sh
x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/t1_analyst/post_detections_user.sh

one will create a role (t1_analyst) and the other an associated user by the same name.

Change/reset the password on the t1_analyst
Login to the Kibana wiht the t1_analyst user and load some data (ex. run endpoint data loader)
Endpoint metadata information should be available in the UI under Alert Details flyout, Host Details and Cases

Checklist

Unit or functional tests were updated or added to match the most common scenarios

…tServices` (not used)

…ice to endpont context start contract

… supplemental data

… service

…iour as prior implementation

elasticmachine · 2021-07-21T20:54:19Z

Pinging @elastic/security-onboarding-and-lifecycle-mgt (Team:Onboarding and Lifecycle Mgt)

paul-tavares · 2021-07-21T20:56:20Z

x-pack/plugins/security_solution/server/endpoint/routes/metadata/handlers.ts

@@ -58,6 +62,33 @@ export const getLogger = (endpointAppContext: EndpointAppContext): Logger => {
  return endpointAppContext.logFactory.get('metadata');
 };

+const errorHandler = <E extends Error>(


Generic error handler for all metadata routes. Currently only being used in the GET single endpoint metadata api

elasticmachine · 2021-07-21T20:56:24Z

Pinging @elastic/fleet (Team:Fleet)

x-pack/plugins/security_solution/server/endpoint/services/metadata/endpoint_metadata_service.ts

…ow-metadata-api-with-readonly-user

…Refactored EndpointMetadataService to use it

paul-tavares · 2021-07-27T16:13:05Z

x-pack/plugins/security_solution/server/endpoint/utils/create_internal_readonly_so_client.ts

+
+type SavedObjectsClientContractKeys = keyof SavedObjectsClientContract;
+
+const RESTRICTED_METHODS: readonly SavedObjectsClientContractKeys[] = [


I initially wanted to do "allow" list rather than "deny" list, but found that the SO client attempts to access other internal properties on the client that are not actually exposed via the SavedObjectsClientContract. Some of the methods below I don't even know what they do (openPointINTimeForType??), but since they sounded like to me that they might possibly be mutating type of methods, I block them.

paul-tavares · 2021-07-27T16:14:24Z

x-pack/plugins/security_solution/server/endpoint/services/metadata/endpoint_metadata_service.ts

+  ) {}
+
+  /**
+   * An INTERNAL Saved Object client that is effectively the system user and has all privileges and permissions and


Should i remove most of the "warning" around this comment now that we use a restricted so client?

nah keep it, so new people (or forgetful us in the future) don't accidentally make changes that strip back your read-only-ness. So it's not accidentally grabbed and used elsewhere. Security holes R no joke

x-pack/plugins/security_solution/server/endpoint/utils/create_internal_readonly_so_client.ts

pzl · 2021-07-27T18:21:11Z

x-pack/plugins/security_solution/server/endpoint/utils/create_internal_readonly_so_client.ts

+      methodName: SavedObjectsClientContractKeys,
+      receiver: unknown
+    ): unknown {
+      if (RESTRICTED_METHODS.includes(methodName)) {


cool. I think the remaining danger here you already realize is if new writable methods are added to SO client, we'll miss them here. Will just have to keep an eye on changes. Maybe another reason to keep the warning around in full

paul-tavares · 2021-07-27T19:45:03Z

@elasticmachine merge upstream

…only-user

paul-tavares · 2021-07-28T00:42:33Z

@elasticmachine merge upstream

…only-user

kibanamachine · 2021-07-28T03:03:38Z

💚 Build Succeeded

Metrics [docs]

✅ unchanged

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @paul-tavares

kibanamachine · 2021-07-28T12:45:04Z

💔 Backport failed

Status	Branch	Result
❌	7.x	Commit could not be cherrypicked due to conflicts

To backport manually run:
node scripts/backport --pr 106328

…sers that might only have READONLY access (elastic#106328) * Remove `getScopedSavedObjectsClient()` from server `EndpointAppContextServices` (not used) * new EndpointMetadataService service (handles GET of a single endpoint for now) * ensure `getFleetAgent()` sets the current status for the agent * Replace the Route handler for Get of single endpoint with new call to service * Fleet: change agent service to also calculate and return the agent status via calls from the agent service * Fleet agent generator changed to set a random status * generic `createInternalReadonlySoClient()` with runtime validation for non-readonly methods # Conflicts: # x-pack/plugins/security_solution/server/endpoint/endpoint_app_context_services.ts

…ta for users that might only have READONLY access (#106328)" This reverts commit b6e9d8d.

jbudz · 2021-07-28T14:30:11Z

This was reverted with 3d33710. I suspect there was a timing conflict with #106110.

https://kibana-ci.elastic.co/job/elastic+kibana+master/15858/execution/node/398/log/

…sers that might only have READONLY access (elastic#106328) * Remove `getScopedSavedObjectsClient()` from server `EndpointAppContextServices` (not used) * new EndpointMetadataService service (handles GET of a single endpoint for now) * ensure `getFleetAgent()` sets the current status for the agent * Replace the Route handler for Get of single endpoint with new call to service * Fleet: change agent service to also calculate and return the agent status via calls from the agent service * Fleet agent generator changed to set a random status * generic `createInternalReadonlySoClient()` with runtime validation for non-readonly methods (cherry picked from commit b6e9d8d)

…sers that might only have READONLY access (elastic#106328) * Remove `getScopedSavedObjectsClient()` from server `EndpointAppContextServices` (not used) * new EndpointMetadataService service (handles GET of a single endpoint for now) * ensure `getFleetAgent()` sets the current status for the agent * Replace the Route handler for Get of single endpoint with new call to service * Fleet: change agent service to also calculate and return the agent status via calls from the agent service * Fleet agent generator changed to set a random status * generic `createInternalReadonlySoClient()` with runtime validation for non-readonly methods

…ta for users that might only have READONLY access (elastic#106328)" This reverts commit b6e9d8d.

paul-tavares added 2 commits July 20, 2021 14:42

Remove getScopedSavedObjectsClient() from server `EndpointAppContex…

267a8aa

…tServices` (not used)

Initial structure for an endpoint metadata service

cfc0404

paul-tavares added v8.0.0 release_note:skip Skip the PR/issue when compiling release notes Team:Defend Workflows “EDR Workflows” sub-team of Security Solution auto-backport Deprecated - use backport:version if exact versions are needed v7.15.0 labels Jul 20, 2021

paul-tavares self-assigned this Jul 20, 2021

paul-tavares added 9 commits July 20, 2021 18:02

Moved the older metadata.ts module + added new EndpointMetadataServ…

59a40ab

…ice to endpont context start contract

add EndpointMetadataService mock for endpoint start contract

bd9580d

add EndpointMetadataService mock for endpoint start contract

bbea688

EndpointMetadata service methods for getting Endpoint host along with…

d2d7a83

… supplemental data

ensure getFleetAgent() sets the current status for the agent

bb93184

Remove unused argument from EndpointAppContextService

ab10e65

Replace the Route handler for Get of single endpoint with new call to…

c6b9a72

… service

removed unnecessary includeHiddenTypes from so client creation

02080de

sync up current methods of EndpointMetadataService to have same behav…

6a79b1e

…iour as prior implementation

paul-tavares marked this pull request as ready for review July 21, 2021 20:54

paul-tavares requested review from a team as code owners July 21, 2021 20:54

paul-tavares requested review from pzl and joeypoon July 21, 2021 20:54

paul-tavares commented Jul 21, 2021

View reviewed changes

botelastic bot added the Team:Fleet Team label for Observability Data Collection Fleet team label Jul 21, 2021

paul-tavares commented Jul 21, 2021

View reviewed changes

x-pack/plugins/security_solution/server/endpoint/services/metadata/endpoint_metadata_service.ts Show resolved Hide resolved

paul-tavares added 2 commits July 22, 2021 11:52

Merge remote-tracking branch 'upstream/master' into task/olm-1504-all…

820d79d

…ow-metadata-api-with-readonly-user

Fix tests for metadata

4fc80e1

paul-tavares added 5 commits July 27, 2021 10:26

Fleet agent generator changed to set a random status

41f6ae1

Fix bug in EndpointMetadataService ++ Fix test

7fa6090

Merge remote-tracking branch 'upstream/master' into task/olm-1504-all…

cbc2ef6

…ow-metadata-api-with-readonly-user

Fix type

1cb508c

generic createInternalReadonlySoClient() with runtime validation + …

999503d

…Refactored EndpointMetadataService to use it

paul-tavares commented Jul 27, 2021

View reviewed changes

x-pack/plugins/security_solution/server/endpoint/utils/create_internal_readonly_so_client.ts Show resolved Hide resolved

paul-tavares requested a review from pzl July 27, 2021 16:30

Tests for createInternalReadonlySoClient()

ab0879f

pzl reviewed Jul 27, 2021

View reviewed changes

pzl approved these changes Jul 27, 2021

View reviewed changes

Merge branch 'master' into task/olm-1504-allow-metadata-api-with-read…

271fc9e

…only-user

Merge branch 'master' into task/olm-1504-allow-metadata-api-with-read…

377845b

…only-user

paul-tavares merged commit b6e9d8d into elastic:master Jul 28, 2021

paul-tavares deleted the task/olm-1504-allow-metadata-api-with-readonly-user branch July 28, 2021 12:42

paul-tavares mentioned this pull request Jul 28, 2021

[7.x] [Security Solution][Endpoint] Allow access to Endpoint Metadata for users that might only have READONLY access (#106328) #107011

Closed

mistic mentioned this pull request Jul 28, 2021

chore(NA): remove getScopedSavedObjectsClient from handlers test file #107022

Closed

jbudz added a commit that referenced this pull request Jul 28, 2021

Revert "[Security Solution][Endpoint] Allow access to Endpoint Metada…

3d33710

…ta for users that might only have READONLY access (#106328)" This reverts commit b6e9d8d.

spalger added the reverted label Jul 28, 2021

paul-tavares mentioned this pull request Jul 28, 2021

[Security Solution][Endpoint] Allow access to Endpoint Metadata for users that might only have readonly access #107050

Merged

streamich pushed a commit to vadimkibana/kibana that referenced this pull request Aug 8, 2021

Revert "[Security Solution][Endpoint] Allow access to Endpoint Metada…

44fb521

…ta for users that might only have READONLY access (elastic#106328)" This reverts commit b6e9d8d.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution][Endpoint] Allow access to Endpoint Metadata for users that might only have READONLY access #106328

[Security Solution][Endpoint] Allow access to Endpoint Metadata for users that might only have READONLY access #106328

paul-tavares commented Jul 20, 2021 •

edited

Loading

elasticmachine commented Jul 21, 2021

paul-tavares Jul 21, 2021

elasticmachine commented Jul 21, 2021

paul-tavares Jul 27, 2021

paul-tavares Jul 27, 2021

pzl Jul 27, 2021

pzl Jul 27, 2021

paul-tavares commented Jul 27, 2021

paul-tavares commented Jul 28, 2021

kibanamachine commented Jul 28, 2021

kibanamachine commented Jul 28, 2021

jbudz commented Jul 28, 2021 •

edited

Loading


		type SavedObjectsClientContractKeys = keyof SavedObjectsClientContract;

		const RESTRICTED_METHODS: readonly SavedObjectsClientContractKeys[] = [

[Security Solution][Endpoint] Allow access to Endpoint Metadata for users that might only have READONLY access #106328

[Security Solution][Endpoint] Allow access to Endpoint Metadata for users that might only have READONLY access #106328

Conversation

paul-tavares commented Jul 20, 2021 • edited Loading

Summary

Testing:

Checklist

elasticmachine commented Jul 21, 2021

paul-tavares Jul 21, 2021

Choose a reason for hiding this comment

elasticmachine commented Jul 21, 2021

paul-tavares Jul 27, 2021

Choose a reason for hiding this comment

paul-tavares Jul 27, 2021

Choose a reason for hiding this comment

pzl Jul 27, 2021

Choose a reason for hiding this comment

pzl Jul 27, 2021

Choose a reason for hiding this comment

paul-tavares commented Jul 27, 2021

paul-tavares commented Jul 28, 2021

kibanamachine commented Jul 28, 2021

💚 Build Succeeded

Metrics [docs]

History

kibanamachine commented Jul 28, 2021

💔 Backport failed

jbudz commented Jul 28, 2021 • edited Loading

paul-tavares commented Jul 20, 2021 •

edited

Loading

jbudz commented Jul 28, 2021 •

edited

Loading