Disable the sys/raw endpoint by default

vault/logical_system.go

@@ -854,7 +854,7 @@ func NewSystemBackend(core *Core) *SystemBackend {
 
 	if core.rawEnabled {
 		b.Backend.Paths = append(b.Backend.Paths, &framework.Path{
-			Pattern: "raw/(?P<path>.+)",
+			Pattern: "(raw/?$|raw/(?P<path>.+))",
 
 			Fields: map[string]*framework.FieldSchema{
 				"path": &framework.FieldSchema{
@@ -869,6 +869,7 @@ func NewSystemBackend(core *Core) *SystemBackend {
 				logical.ReadOperation:   b.handleRawRead,
 				logical.UpdateOperation: b.handleRawWrite,
 				logical.DeleteOperation: b.handleRawDelete,
+				logical.ListOperation:   b.handleRawList,
 			},
 		})
 	}
@@ -2145,6 +2146,29 @@ func (b *SystemBackend) handleRawDelete(
 	return nil, nil
 }
 
+// handleRawList is used to list directly from the barrier
+func (b *SystemBackend) handleRawList(
+	req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
+	path := data.Get("path").(string)
+	if path != "" && !strings.HasSuffix(path, "/") {
+		path = path + "/"
+	}
+
+	// Prevent access of protected paths
+	for _, p := range protectedPaths {
+		if strings.HasPrefix(path, p) {
+			err := fmt.Sprintf("cannot list '%s'", path)
+			return logical.ErrorResponse(err), logical.ErrInvalidRequest
+		}
+	}
+
+	keys, err := b.Core.barrier.List(path)
+	if err != nil {
+		return handleError(err)
+	}
+	return logical.ListResponse(keys), nil
+}
+
 // handleKeyStatus returns status information about the backend key
 func (b *SystemBackend) handleKeyStatus(
 	req *logical.Request, data *framework.FieldData) (*logical.Response, error) {

website/source/api/system/raw.html.md

@@ -80,6 +80,41 @@ $ curl \
     https://vault.rocks/v1/sys/raw/secret/foo
 ```
 
+## List Raw
+
+This endpoint returns a list keys for a given path prefix.
+
+**This endpoint requires 'sudo' capability.**
+
+| Method   | Path                         | Produces               |
+| :------- | :--------------------------- | :--------------------- |
+| `LIST`   | `/sys/raw/:prefix` | `200 application/json` |
+| `GET`   | `/sys/raw/:prefix?list=true` | `200 application/json` |
+
+
+### Sample Request
+
+```
+$ curl \
+    --header "X-Vault-Token: ..." \
+    --request LIST \
+    https://vault.rocks/v1/sys/raw/logical
+```
+
+### Sample Response
+
+```json
+{
+  "data":{
+    "keys":[
+      "abcd-1234...",
+      "efgh-1234...",
+      "ijkl-1234..."
+    ]
+  }
+}
+```
+
 ## Delete Raw
 
 This endpoint deletes the key with given path. This is the raw path in the