docs(buglog): log bug-1934 (self_ug job scope acts as all) and bug-1935 (project_name filter rejected)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
parent
54c8b29ea7
commit
6114f16dac
GPG key ID:
80533536B0EB651C
3 changed files with 204 additions and 0 deletions
|
|
@ -17750,6 +17750,56 @@
|
|||
"6ecd418d"
|
||||
],
|
||||
"record": ".wolf/bugs/bug-1933.md"
|
||||
},
|
||||
{
|
||||
"id": "bug-1934",
|
||||
"status": "open",
|
||||
"status_updated": "2026-10-10",
|
||||
"status_note": "newly logged",
|
||||
"component": "apiserver",
|
||||
"severity": "security",
|
||||
"timestamp": "2026-10-10T04:31:25Z",
|
||||
"last_seen": "2026-10-10T04:31:25Z",
|
||||
"occurrences": 1,
|
||||
"error_message": "apiserver treats a job:view grant scoped only to self_ug as all: user sees every user's jobs\n\n**Observed:** (source reading, not yet run) a role whose `job:view` grant is\nscoped only to `self_ug` can see every user's jobs. The job-list handler\n(`src/frontend/apiserver/controllers/jobs.go`) only distinguishes\n`DomainType == self`:\n```go\nif permission.DomainType != models.DomainTypeSelf {\n submitUser = filter.Value // jobs.go:178, caller-chosen user\n}\n...\nif !specify_user || permission.DomainType == models.DomainTypeSelf { // :187\n...\nif jobPermission.DomainType == models.DomainTypeSelf { // :762, per-row owner filter\n```\nso `self_ug` falls through every check like `all`: a `submit_user` filter\nnaming any user (or `all`) is honoured and no row is removed.\n`GetRequireResourcePermission()` (`controllers/rbac_check.go:323-346`)\nreturns only the first grant matching the permission, so for the default\n`basic_user` (`config/rbac.yaml:37-40`, `job:view` with `self` then\n`self_ug`) the `self` entry wins and `self_ug` is silently ignored.\n`self_ug` is accepted by role validation (`controllers/roles.go:697-700`)\nand listed as a supported job scope (`models/roles.go:70`), but nothing\nresolves the user's user groups for it.\n\n**Expected:** a `self_ug` job grant covers exactly the jobs whose owner shares\na user group with the requester; a grant list with several scopes covers the\nunion of them; anything else is rejected or filtered out.\n**Impact:** security (authorization bypass). Any role an admin creates with\n`job:view` (or another job permission, unchecked) scoped to `self_ug` grants\nvisibility of all users' jobs. The default `basic_user` is not exposed (its\n`self` grant is matched first) but never gets the group visibility its\nconfig promises. Other job permissions using the same single-grant lookup\nwere not checked yet.\n**Found by:** review, during `/kiro-spec-requirements project-config`\n(2026-10-10, RBAC survey for project-scoped job permissions).",
|
||||
"file": "src/frontend/apiserver/controllers/jobs.go, src/frontend/apiserver/controllers/rbac_check.go, src/frontend/apiserver/models/roles.go, src/frontend/apiserver/config/rbac.yaml",
|
||||
"root_cause": "TODO: required for fixed/partial",
|
||||
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
|
||||
"tags": [
|
||||
"apiserver",
|
||||
"rbac",
|
||||
"security",
|
||||
"self_ug"
|
||||
],
|
||||
"related_bugs": [
|
||||
"bug-1935"
|
||||
],
|
||||
"fix_commits": [],
|
||||
"record": ".wolf/bugs/bug-1934.md"
|
||||
},
|
||||
{
|
||||
"id": "bug-1935",
|
||||
"status": "open",
|
||||
"status_updated": "2026-10-10",
|
||||
"status_note": "newly logged",
|
||||
"component": "apiserver",
|
||||
"severity": "wrong-result",
|
||||
"timestamp": "2026-10-10T04:31:27Z",
|
||||
"last_seen": "2026-10-10T04:31:27Z",
|
||||
"occurrences": 1,
|
||||
"error_message": "xcecli jobs list -P <project> fails: apiserver rejects project_name filter (unsupported filter)\n\n**Observed:** `xcecli jobs list -P <project>` (`-P/--project`,\n`src/frontend/xcecli/cmd/jobs/list.go:356`) sends the filter\n`{project_name:eq:<project>}` (`xcecli/filters/job_filter.go:108-109`), but\n`project_name` is commented out of the apiserver's `JOB_SUPPORT_FILTERS`\n(`src/frontend/apiserver/models/jobs.go:178`), so `validateJobQueryFilters()`\n(`controllers/jobs.go:470-483`) rejects the request:\n```\nunsupported filter: project_name\n```\n(HTTP 400, INVALID_PARAMS). The same holds for `license_project`\n(`models/jobs.go:179`, `job_filter.go:112-113`). Found by source reading; not\nyet run against a live apiserver.\n\n**Expected:** `xcecli jobs list -P eng` lists the caller's visible jobs whose\nproject is `eng`.\n**Impact:** wrong result: the documented `-P` (and license-project) filter of\n`xcecli jobs list` always fails with an error; users cannot list jobs by\nproject. No data is affected.\n**Found by:** review, during `/kiro-spec-requirements project-config`\n(2026-10-10); `project-config` Requirement 7.5 needs this filter.",
|
||||
"file": "src/frontend/apiserver/models/jobs.go, src/frontend/apiserver/controllers/jobs.go, src/frontend/xcecli/filters/job_filter.go",
|
||||
"root_cause": "TODO: required for fixed/partial",
|
||||
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
|
||||
"tags": [
|
||||
"apiserver",
|
||||
"xcecli",
|
||||
"filter",
|
||||
"project"
|
||||
],
|
||||
"related_bugs": [],
|
||||
"fix_commits": [],
|
||||
"record": ".wolf/bugs/bug-1935.md"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
|
|||
85
.wolf/bugs/bug-1934.md
Normal file
85
.wolf/bugs/bug-1934.md
Normal file
|
|
@ -0,0 +1,85 @@
|
|||
---
|
||||
id: "bug-1934"
|
||||
status: "open"
|
||||
status_updated: "2026-10-10"
|
||||
status_note: "newly logged"
|
||||
component: "apiserver"
|
||||
severity: "security"
|
||||
timestamp: "2026-10-10T04:31:25Z"
|
||||
last_seen: "2026-10-10T04:31:25Z"
|
||||
occurrences: 1
|
||||
files: ["src/frontend/apiserver/controllers/jobs.go", "src/frontend/apiserver/controllers/rbac_check.go", "src/frontend/apiserver/models/roles.go", "src/frontend/apiserver/config/rbac.yaml"]
|
||||
tags: ["apiserver", "rbac", "security", "self_ug"]
|
||||
related: ["bug-1935"]
|
||||
---
|
||||
|
||||
# bug-1934: apiserver treats a job:view grant scoped only to self_ug as all: user sees every user's jobs
|
||||
|
||||
## Description
|
||||
**Observed:** (source reading, not yet run) a role whose `job:view` grant is
|
||||
scoped only to `self_ug` can see every user's jobs. The job-list handler
|
||||
(`src/frontend/apiserver/controllers/jobs.go`) only distinguishes
|
||||
`DomainType == self`:
|
||||
```go
|
||||
if permission.DomainType != models.DomainTypeSelf {
|
||||
submitUser = filter.Value // jobs.go:178, caller-chosen user
|
||||
}
|
||||
...
|
||||
if !specify_user || permission.DomainType == models.DomainTypeSelf { // :187
|
||||
...
|
||||
if jobPermission.DomainType == models.DomainTypeSelf { // :762, per-row owner filter
|
||||
```
|
||||
so `self_ug` falls through every check like `all`: a `submit_user` filter
|
||||
naming any user (or `all`) is honoured and no row is removed.
|
||||
`GetRequireResourcePermission()` (`controllers/rbac_check.go:323-346`)
|
||||
returns only the first grant matching the permission, so for the default
|
||||
`basic_user` (`config/rbac.yaml:37-40`, `job:view` with `self` then
|
||||
`self_ug`) the `self` entry wins and `self_ug` is silently ignored.
|
||||
`self_ug` is accepted by role validation (`controllers/roles.go:697-700`)
|
||||
and listed as a supported job scope (`models/roles.go:70`), but nothing
|
||||
resolves the user's user groups for it.
|
||||
|
||||
**Expected:** a `self_ug` job grant covers exactly the jobs whose owner shares
|
||||
a user group with the requester; a grant list with several scopes covers the
|
||||
union of them; anything else is rejected or filtered out.
|
||||
**Impact:** security (authorization bypass). Any role an admin creates with
|
||||
`job:view` (or another job permission, unchecked) scoped to `self_ug` grants
|
||||
visibility of all users' jobs. The default `basic_user` is not exposed (its
|
||||
`self` grant is matched first) but never gets the group visibility its
|
||||
config promises. Other job permissions using the same single-grant lookup
|
||||
were not checked yet.
|
||||
**Found by:** review, during `/kiro-spec-requirements project-config`
|
||||
(2026-10-10, RBAC survey for project-scoped job permissions).
|
||||
|
||||
## Environment
|
||||
- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
|
||||
- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2), from src/xce.build/frontend/apiserver/xce_apiserver
|
||||
- Toolchain: go1.25.5 linux/amd64 (nix dev shell); gcc (GCC) 15.2.0, meson 1.9.1
|
||||
- Build: asan (xce.build) binary exists at this commit; the bug was found by reading the source, not by running it
|
||||
- Code: scheduler-framework @ 54c8b29e
|
||||
- Deployment: any apiserver deployment (single or HA); not reproduced on a running cluster yet
|
||||
|
||||
## Reproduction
|
||||
1. Start an apiserver with a role `ug_viewer` granting `job:view` with only
|
||||
`- type: self_ug`, plus `queue:view` on `all`, assigned to user `alice`;
|
||||
submit a job as user `bob`.
|
||||
2. As `alice`: `xcecli jobs list -u bob` (or `-u all`), or
|
||||
`GET /api/v1/jobs?filters={submit_user:eq:bob}`.
|
||||
3. Expected: rejected or empty (unless alice and bob share a user group);
|
||||
per the source reading, bob's job is returned.
|
||||
- Frequency: deterministic by code reading; not yet executed.
|
||||
- Evidence: the code lines quoted in Description; no logs.
|
||||
|
||||
## Root cause
|
||||
TODO: required for fixed/partial
|
||||
|
||||
## Fix
|
||||
TODO: required for fixed/partial
|
||||
|
||||
## Verification
|
||||
- Test: TODO: name + file; RED before the fix, GREEN after
|
||||
- Suites: TODO: suite results and build profile
|
||||
- Live: TODO: soak/deploy run, or n/a and why
|
||||
|
||||
## References
|
||||
- Related: none
|
||||
69
.wolf/bugs/bug-1935.md
Normal file
69
.wolf/bugs/bug-1935.md
Normal file
|
|
@ -0,0 +1,69 @@
|
|||
---
|
||||
id: "bug-1935"
|
||||
status: "open"
|
||||
status_updated: "2026-10-10"
|
||||
status_note: "newly logged"
|
||||
component: "apiserver"
|
||||
severity: "wrong-result"
|
||||
timestamp: "2026-10-10T04:31:27Z"
|
||||
last_seen: "2026-10-10T04:31:27Z"
|
||||
occurrences: 1
|
||||
files: ["src/frontend/apiserver/models/jobs.go", "src/frontend/apiserver/controllers/jobs.go", "src/frontend/xcecli/filters/job_filter.go"]
|
||||
tags: ["apiserver", "xcecli", "filter", "project"]
|
||||
related: []
|
||||
---
|
||||
|
||||
# bug-1935: xcecli jobs list -P <project> fails: apiserver rejects project_name filter (unsupported filter)
|
||||
|
||||
## Description
|
||||
**Observed:** `xcecli jobs list -P <project>` (`-P/--project`,
|
||||
`src/frontend/xcecli/cmd/jobs/list.go:356`) sends the filter
|
||||
`{project_name:eq:<project>}` (`xcecli/filters/job_filter.go:108-109`), but
|
||||
`project_name` is commented out of the apiserver's `JOB_SUPPORT_FILTERS`
|
||||
(`src/frontend/apiserver/models/jobs.go:178`), so `validateJobQueryFilters()`
|
||||
(`controllers/jobs.go:470-483`) rejects the request:
|
||||
```
|
||||
unsupported filter: project_name
|
||||
```
|
||||
(HTTP 400, INVALID_PARAMS). The same holds for `license_project`
|
||||
(`models/jobs.go:179`, `job_filter.go:112-113`). Found by source reading; not
|
||||
yet run against a live apiserver.
|
||||
|
||||
**Expected:** `xcecli jobs list -P eng` lists the caller's visible jobs whose
|
||||
project is `eng`.
|
||||
**Impact:** wrong result: the documented `-P` (and license-project) filter of
|
||||
`xcecli jobs list` always fails with an error; users cannot list jobs by
|
||||
project. No data is affected.
|
||||
**Found by:** review, during `/kiro-spec-requirements project-config`
|
||||
(2026-10-10); `project-config` Requirement 7.5 needs this filter.
|
||||
|
||||
## Environment
|
||||
- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
|
||||
- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2), from src/xce.build/frontend/apiserver/xce_apiserver
|
||||
- Toolchain: go1.25.5 linux/amd64 (nix dev shell); gcc (GCC) 15.2.0, meson 1.9.1
|
||||
- Build: asan (xce.build) binary exists at this commit; the bug was found by reading the source, not by running it
|
||||
- Code: scheduler-framework @ 54c8b29e
|
||||
- Deployment: any apiserver deployment (single or HA); not reproduced on a running cluster yet
|
||||
|
||||
## Reproduction
|
||||
1. Start an apiserver (any deployment) and submit a job with
|
||||
`xcecli jobs submit -P eng sleep 1`.
|
||||
2. `xcecli jobs list -P eng`
|
||||
3. Expected: the job is listed; per the source, the apiserver replies HTTP 400
|
||||
`unsupported filter: project_name`.
|
||||
- Frequency: deterministic by code reading; not yet executed.
|
||||
- Evidence: the code lines quoted in Description; no logs.
|
||||
|
||||
## Root cause
|
||||
TODO: required for fixed/partial
|
||||
|
||||
## Fix
|
||||
TODO: required for fixed/partial
|
||||
|
||||
## Verification
|
||||
- Test: TODO: name + file; RED before the fix, GREEN after
|
||||
- Suites: TODO: suite results and build profile
|
||||
- Live: TODO: soak/deploy run, or n/a and why
|
||||
|
||||
## References
|
||||
- Related: none
|
||||
Loading…
Add table
Add a link
Reference in a new issue