You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@solr.apache.org by "Houston Putman (Jira)" <ji...@apache.org> on 2023/02/17 19:55:00 UTC
[jira] [Created] (SOLR-16671) Explicitly call out library permissions for config-edit
Houston Putman created SOLR-16671:
-------------------------------------
Summary: Explicitly call out library permissions for config-edit
Key: SOLR-16671
URL: https://issues.apache.org/jira/browse/SOLR-16671
Project: Solr
Issue Type: Improvement
Security Level: Public (Default Security Level. Issues are Public)
Components: Authorization, documentation, security
Reporter: Houston Putman
A lot of security questions arise from various options to add custom libraries via a {{{}solrconfig.xml{}}}. When using the recommended solr auth plugin, a user requires the {{config-edit}} permission to edit this file. And custom libraries will only be used when the solrconfig is trusted by Solr.
Right now the [config-edit permission documentation|https://solr.apache.org/guide/solr/latest/deployment-guide/rule-based-authorization-plugin.html#predefined-permissions] does not explicitly spell out that the permission gives users the ability to install any custom library to Solr. We should fix this to reduce confusion around RCEs.
With our antora docs, I suggest we backport this documentation change to 9.0 and 9.1, and also update 8.11 for the next patch release.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org