Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Resolve permissions issue with cluster:admin/scripts/painless/execute #86428

Closed
mattkime opened this issue May 4, 2022 · 1 comment · Fixed by #85512
Closed

Resolve permissions issue with cluster:admin/scripts/painless/execute #86428

mattkime opened this issue May 4, 2022 · 1 comment · Fixed by #85512
Labels
>bug :Security/Authorization Roles, Privileges, DLS/FLS, RBAC/ABAC Team:Security Meta label for security team

Comments

@mattkime
Copy link

mattkime commented May 4, 2022

2nd attempt at #84591

references #48856 (comment)

tldr; the permission structure for the endpoint isn't useful for most users. If users can create runtime fields they should have access to this api, they shouldn't need a specific permission set.
@mattkime mattkime added blocker :Security/Authorization Roles, Privileges, DLS/FLS, RBAC/ABAC Team:Security Meta label for security team labels May 4, 2022
@elasticmachine
Copy link
Collaborator

Pinging @elastic/es-security (Team:Security)

@mattkime mattkime mentioned this issue May 4, 2022
Merged
@javanna javanna added >bug and removed blocker labels May 17, 2022
javanna added a commit that referenced this issue May 17, 2022
@javanna
Authorize painless execute as index action when an index is specified (…
a48965d 
…#85512)

Painless execute allows users to validate their scripts. Some of the supported script contexts
support providing a sample document as well as an index to pull the mappings from.

The painless execute API requires cluster admin privileges today and while that's ok for the contexts that
don't support providing an index, it is not ideal when an index is provided. In fact users can run scripts
as part of the search API, which requires only the indices/read privilege on the indices that the users
is reading from.

This commit maps the painless execute action to an indices/read action when an index is specified, so that in
that case the same privileges as a search action will be requested to run painless execute.

Relates to #48856
Closes #86428
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
>bug :Security/Authorization Roles, Privileges, DLS/FLS, RBAC/ABAC Team:Security Meta label for security team
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Authorize painless execute as index action when an index is specified javanna/elasticsearch
3 participants
@mattkime @javanna @elasticmachine