The allocations endpoint with namespace=* does not interact with ACLs as expected

[DingoEatingFuzz]

Nomad version

1.0.0-beta2

Issue

When ACLs are enabled and a token has permissions to namespaces individually but no permissions for *, requesting /v1/allocations?namespace=* results in a 403 Forbidden.

I expected to get all allocations across all namespaces I have permissions for.

Reproduction steps

1. Create some namespaces
2. Create policies that grant read access to namespaces individually
3. Create a token using those policies
4. Run http localhost:4646/v1/allocations?namespace=* -- X-Nomad-Token:<token> or similar

[DingoEatingFuzz]

Policy for reference.

namespace "default" {
  policy = "read"
}

namespace "other-ns" {
  policy = "read"
  capabilities = ["list-jobs", "read-job"]
}

agent {
  policy = "read"
}

node {
  policy = "read"
}

[cgbaker]

i suspect it's a bad check early in the RPC call, which doesn't account for the sentinel:
https://github.com/hashicorp/nomad/blame/v1.0.0-beta2/nomad/alloc_endpoint.go#L36

this code should probably be updated to reflect the pattern in job listing:
https://github.com/hashicorp/nomad/blame/v1.0.0-beta2/nomad/job_endpoint.go#L1301

also, while we're fixing bugs... it looks like the filtering on this line is backwards:
https://github.com/hashicorp/nomad/blob/master/nomad/state/state_store.go#L3356

and the allow check (in the latest version) is wrong as well (list-jobs instead of read-job):
https://github.com/hashicorp/nomad/blame/ba17e2191ba3a0dbf479b51430b9d4815a0bc112/nomad/alloc_endpoint.go#L41

[yitbarek123]

@cgbaker , I'm also facing this issue with the latest nomad version 1.1.6 .

Thanks.

[cgbaker]

Hi @yitbarek123 , please file a new issue with the pertinent details and someone from Nomad will triage it. Thank you!

[yitbarek123]

OK, @cgbaker . Thanks again.

[github-actions]

I'm going to lock this issue because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.