You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudstack.apache.org by "nvazquez (via GitHub)" <gi...@apache.org> on 2026/10/18 02:19:20 UTC
[PR] Additional fixes for checkRoleEscalation [cloudstack]
nvazquez opened a new pull request, #14433:
URL: https://github.com/apache/cloudstack/pull/14433
### Description
This PR extends the fixes introduced in PR https://github.com/apache/cloudstack/pull/12973 to address the following issues (reported by @RosiKyu):
1. Revoking a permission does not take effect until the cache expires
Only happens when `dynamic.apichecker.cache.period` is greater than 0. The default is 0, so default installations are not affected.
After a permission is revoked from a role, account creation carries on using the remembered copy. A restricted Domain Admin can create an account that still has the revoked permission, for as long as the cache period lasts. The window is temporary but the account created in it is permanent, so this reopens #5781 for that period.
Steps to reproduce, with `cache.period=300` and the management server restarted so nothing is remembered yet:
- SD
- Grant `createServiceOffering` to the restricted user's role (a copy of Domain Admin with that one rule denied)
- Check in the database that the rule reads `ALLOW`
- As that user, create an account with the default Domain Admin role. This is allowed at this point, and it is the call that puts the permission into the cache
- Revoke `createServiceOffering` from the restricted user's role
- Check in the database that the rule now reads `DENY`
- Immediately create another account with the default Domain Admin role
Step 6 should be refused with `Escalated APIs: [createServiceOffering]`. (**It succeeds instead.**)
Steps 3 to 6 have to be done within the cache period, counted from step 3, because step 3 is what puts the permission into memory. If that time runs out in between, the database is read again correctly and the problem does not show.
#### 2) A long list of escalated APIs makes the API return HTTP 500 with an empty response
Steps to reproduce, no special configuration needed:
- Create a Domain Admin role with only a few rules allowed (`listApis`, `listAccounts`, `listDomains`, `createAccount`, `createUser`, `listUsers`, `listConfigurations`). An account on that role can see about 140 APIs.
- Create an account with that role and generate API keys for it.
- As that user, run `createAccount` with a much more privileged role. Using the default Domain Admin role gives 326 escalated APIs and returns a proper error. Using a role with a `*` ALLOW rule gives 786 and returns `500` with an empty response.
cmk shows the failing case as:
```
(tpr_minimal) 🐱 > create account accounttype=2 username=tc-chk-c password=Password123456 firstname=T lastname=T email=c@test.local domainid=2a43e16e-f8b6-4a93-ba87-74ed1a5ecd9f roleid=5c7e8978-d79c-43f8-b2a2-5201e7192d08
🙈 Error: failed to decode response
```
### Types of changes
- [ ] Breaking change (fix or feature that would cause existing functionality to change)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] Enhancement (improves an existing feature and functionality)
- [ ] Cleanup (Code refactoring and cleanup, that may add test cases)
- [ ] Build/CI
- [ ] Test (unit or integration test code)
### Feature/Enhancement Scale or Bug Severity
#### Feature/Enhancement Scale
- [ ] Major
- [ ] Minor
#### Bug Severity
- [ ] BLOCKER
- [ ] Critical
- [ ] Major
- [ ] Minor
- [ ] Trivial
### Screenshots (if appropriate):
### How Has This Been Tested?
<!-- Please describe in detail how you tested your changes. -->
<!-- Include details of your testing environment, and the tests you ran to -->
#### How did you try to break this feature and the system with this change?
<!-- see how your change affects other areas of the code, etc. -->
<!-- Please read the [CONTRIBUTING](https://github.com/apache/cloudstack/blob/main/CONTRIBUTING.md) document -->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Additional fixes for checkRoleEscalation [cloudstack]
Posted by "nvazquez (via GitHub)" <gi...@apache.org>.
nvazquez commented on PR #14433:
URL: https://github.com/apache/cloudstack/pull/14433#issuecomment-6255954745
@blueorangutan test
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Additional fixes for checkRoleEscalation [cloudstack]
Posted by "nvazquez (via GitHub)" <gi...@apache.org>.
nvazquez commented on PR #14433:
URL: https://github.com/apache/cloudstack/pull/14433#issuecomment-6244671646
@blueorangutan package
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Additional fixes for checkRoleEscalation [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #14433:
URL: https://github.com/apache/cloudstack/pull/14433#issuecomment-6267686761
<b>[SF] Trillian test result (tid-17153)</b>
Environment: kvm-ol8 (x2), zone: Advanced Networking with Mgmt server ol8
Total time taken: 48187 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr14433-t17153-kvm-ol8.zip
Smoke tests completed. 148 look OK, 1 have errors, 0 did not run
Only failed and skipped tests results shown below:
Test | Result | Time (s) | Test File
--- | --- | --- | ---
ContextSuite context=TestClusterDRS>:setup | `Error` | 0.00 | test_cluster_drs.py
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Additional fixes for checkRoleEscalation [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #14433:
URL: https://github.com/apache/cloudstack/pull/14433#issuecomment-6246027608
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✖️ suse15. SL-JID 19592
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Additional fixes for checkRoleEscalation [cloudstack]
Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #14433:
URL: https://github.com/apache/cloudstack/pull/14433#issuecomment-6244725981
## [Codecov](https://app.codecov.io/gh/apache/cloudstack/pull/14433?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:white_check_mark: All modified and coverable lines are covered by tests.
:white_check_mark: Project coverage is 4.04%. Comparing base ([`c7667d8`](https://app.codecov.io/gh/apache/cloudstack/commit/c7667d8c1fb8ceb4ef5ee687fd85cc84a545c275?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`476d43e`](https://app.codecov.io/gh/apache/cloudstack/commit/476d43ee558cb84bf0c03cb834309389b49a72a3?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
> :exclamation: There is a different number of reports uploaded between BASE (c7667d8) and HEAD (476d43e). Click for more details.
>
> <details><summary>HEAD has 1 upload less than BASE</summary>
>
>| Flag | BASE (c7667d8) | HEAD (476d43e) |
>|------|------|------|
>|unittests|1|0|
></details>
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## 4.22 #14433 +/- ##
=============================================
- Coverage 18.03% 4.04% -14.00%
=============================================
Files 5937 449 -5488
Lines 536771 38283 -498488
Branches 65782 7082 -58700
=============================================
- Hits 96787 1547 -95240
+ Misses 428932 36521 -392411
+ Partials 11052 215 -10837
```
| [Flag](https://app.codecov.io/gh/apache/cloudstack/pull/14433/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [uitests](https://app.codecov.io/gh/apache/cloudstack/pull/14433/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `4.04% <ø> (ø)` | |
| [unittests](https://app.codecov.io/gh/apache/cloudstack/pull/14433/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#carryforward-flags-in-the-pull-request-comment) to find out more.
</details>
[:umbrella: View full report in Codecov by Harness](https://app.codecov.io/gh/apache/cloudstack/pull/14433?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Additional fixes for checkRoleEscalation [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #14433:
URL: https://github.com/apache/cloudstack/pull/14433#issuecomment-6244677363
@nvazquez a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Additional fixes for checkRoleEscalation [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #14433:
URL: https://github.com/apache/cloudstack/pull/14433#issuecomment-6255979647
@nvazquez a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org