[PR] fix(config): restrict config:install to the admin role [karaf]

["jbonofre (via GitHub)" <gi...@apache.org>]

jbonofre opened a new pull request, #2861:
URL: https://github.com/apache/karaf/pull/2861

   ## Problem
   
   `config:install <url> <finalname>` downloads a file from an arbitrary URL and writes it into `${karaf.etc}` (the `-o`/`--override` option lets it overwrite an existing file). That folder also holds `users.properties`, `keys.properties`, `host.key` and every `org.apache.karaf.*.acl.*` file.
   
   The command has **no entry** in `org.apache.karaf.command.acl.config`. `SecuredSessionFactoryImpl.checkSecurity()` treats an unmatched command as allowed (`Specificity.NO_MATCH` → `passCheck = true`), and `karaf.secured.command.compulsory.roles` ships commented out, so **any authenticated shell/SSH user** — including a `viewer` — can run `config:install` and overwrite, for example, the command ACL files or `users.properties`.
   
   By contrast `bundle:install`, `feature:install` and `kar:install` are all `admin`-only in their own ACLs, and `config:delete` is `admin` in this same ACL.
   
   ## Fix
   
   Add `install = admin` to the `config` command ACL, in both shipped locations:
   
   - `assemblies/features/standard/src/main/feature/feature.xml` (`<config>` block)
   - `instance/.../etc/org.apache.karaf.command.acl.config.cfg` (instance template)
   
   and to the itest etc fixture (`itests/test/src/test/filtered-resources/etc/feature.xml`).
   
   ## Test
   
   `ConfigSshCommandSecurityTest#testConfigInstallCommandSecurityViaSsh` — a `viewer` and a `manager` get `Command not found`; an `admin` can run it.
   
   ## Note
   
   The underlying fail-open behaviour (unmatched command → allowed, with `karaf.secured.command.compulsory.roles` disabled by default) is a broader hardening question tracked separately; this PR only closes the `config:install` gap.
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@karaf.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(config): restrict config:install to the admin role [karaf]

["jbonofre (via GitHub)" <gi...@apache.org>]

jbonofre merged PR #2861:
URL: https://github.com/apache/karaf/pull/2861


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@karaf.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(config): restrict config:install to the admin role [karaf]

["github-actions[bot] (via GitHub)" <gi...@apache.org>]

github-actions[bot] commented on PR #2861:
URL: https://github.com/apache/karaf/pull/2861#issuecomment-5589283234

   ## Test Results
     705 files  ±0    705 suites  ±0   1h 16m 54s ⏱️ -53s
     947 tests +1    899 ✅ +1   48 💤 ±0  0 ❌ ±0 
   2 841 runs  +3  2 697 ✅ +3  144 💤 ±0  0 ❌ ±0 
   
   Results for commit a34b627f. ± Comparison against base commit 6e404756.
   
   [test-results]:data:application/gzip;base64,H4sIAGxHoGoC/03MyQ7CIBDG8VdpOHsAZmTxZQxLSYhdDMvJ+O5SLbXH/28y34uEOI2Z3AZJr5eB5BrLKX1NpsR1aYCCYZN2Ldtdo+x1z9W5RkrrPz3ic3tShwQTpyb0gDGlNe2S6rKNcoVsrz7KhZYH/UYZYpfT6LfPm26d51haEANoBZcBFNpALfogACmgBxDWeOOYY1oqRt4f3jZSGQ8BAAA=
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@karaf.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org