diff --git a/.wolf/buglog.json b/.wolf/buglog.json index 1d6223d7..f2c095b8 100644 --- a/.wolf/buglog.json +++ b/.wolf/buglog.json @@ -17750,6 +17750,56 @@ "6ecd418d" ], "record": ".wolf/bugs/bug-1933.md" + }, + { + "id": "bug-1934", + "status": "open", + "status_updated": "2026-10-10", + "status_note": "newly logged", + "component": "apiserver", + "severity": "security", + "timestamp": "2026-10-10T04:31:25Z", + "last_seen": "2026-10-10T04:31:25Z", + "occurrences": 1, + "error_message": "apiserver treats a job:view grant scoped only to self_ug as all: user sees every user's jobs\n\n**Observed:** (source reading, not yet run) a role whose `job:view` grant is\nscoped only to `self_ug` can see every user's jobs. The job-list handler\n(`src/frontend/apiserver/controllers/jobs.go`) only distinguishes\n`DomainType == self`:\n```go\nif permission.DomainType != models.DomainTypeSelf {\n submitUser = filter.Value // jobs.go:178, caller-chosen user\n}\n...\nif !specify_user || permission.DomainType == models.DomainTypeSelf { // :187\n...\nif jobPermission.DomainType == models.DomainTypeSelf { // :762, per-row owner filter\n```\nso `self_ug` falls through every check like `all`: a `submit_user` filter\nnaming any user (or `all`) is honoured and no row is removed.\n`GetRequireResourcePermission()` (`controllers/rbac_check.go:323-346`)\nreturns only the first grant matching the permission, so for the default\n`basic_user` (`config/rbac.yaml:37-40`, `job:view` with `self` then\n`self_ug`) the `self` entry wins and `self_ug` is silently ignored.\n`self_ug` is accepted by role validation (`controllers/roles.go:697-700`)\nand listed as a supported job scope (`models/roles.go:70`), but nothing\nresolves the user's user groups for it.\n\n**Expected:** a `self_ug` job grant covers exactly the jobs whose owner shares\na user group with the requester; a grant list with several scopes covers the\nunion of them; anything else is rejected or filtered out.\n**Impact:** security (authorization bypass). Any role an admin creates with\n`job:view` (or another job permission, unchecked) scoped to `self_ug` grants\nvisibility of all users' jobs. The default `basic_user` is not exposed (its\n`self` grant is matched first) but never gets the group visibility its\nconfig promises. Other job permissions using the same single-grant lookup\nwere not checked yet.\n**Found by:** review, during `/kiro-spec-requirements project-config`\n(2026-10-10, RBAC survey for project-scoped job permissions).", + "file": "src/frontend/apiserver/controllers/jobs.go, src/frontend/apiserver/controllers/rbac_check.go, src/frontend/apiserver/models/roles.go, src/frontend/apiserver/config/rbac.yaml", + "root_cause": "TODO: required for fixed/partial", + "fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why", + "tags": [ + "apiserver", + "rbac", + "security", + "self_ug" + ], + "related_bugs": [ + "bug-1935" + ], + "fix_commits": [], + "record": ".wolf/bugs/bug-1934.md" + }, + { + "id": "bug-1935", + "status": "open", + "status_updated": "2026-10-10", + "status_note": "newly logged", + "component": "apiserver", + "severity": "wrong-result", + "timestamp": "2026-10-10T04:31:27Z", + "last_seen": "2026-10-10T04:31:27Z", + "occurrences": 1, + "error_message": "xcecli jobs list -P fails: apiserver rejects project_name filter (unsupported filter)\n\n**Observed:** `xcecli jobs list -P ` (`-P/--project`,\n`src/frontend/xcecli/cmd/jobs/list.go:356`) sends the filter\n`{project_name:eq:}` (`xcecli/filters/job_filter.go:108-109`), but\n`project_name` is commented out of the apiserver's `JOB_SUPPORT_FILTERS`\n(`src/frontend/apiserver/models/jobs.go:178`), so `validateJobQueryFilters()`\n(`controllers/jobs.go:470-483`) rejects the request:\n```\nunsupported filter: project_name\n```\n(HTTP 400, INVALID_PARAMS). The same holds for `license_project`\n(`models/jobs.go:179`, `job_filter.go:112-113`). Found by source reading; not\nyet run against a live apiserver.\n\n**Expected:** `xcecli jobs list -P eng` lists the caller's visible jobs whose\nproject is `eng`.\n**Impact:** wrong result: the documented `-P` (and license-project) filter of\n`xcecli jobs list` always fails with an error; users cannot list jobs by\nproject. No data is affected.\n**Found by:** review, during `/kiro-spec-requirements project-config`\n(2026-10-10); `project-config` Requirement 7.5 needs this filter.", + "file": "src/frontend/apiserver/models/jobs.go, src/frontend/apiserver/controllers/jobs.go, src/frontend/xcecli/filters/job_filter.go", + "root_cause": "TODO: required for fixed/partial", + "fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why", + "tags": [ + "apiserver", + "xcecli", + "filter", + "project" + ], + "related_bugs": [], + "fix_commits": [], + "record": ".wolf/bugs/bug-1935.md" } ] } diff --git a/.wolf/bugs/bug-1934.md b/.wolf/bugs/bug-1934.md new file mode 100644 index 00000000..7573375d --- /dev/null +++ b/.wolf/bugs/bug-1934.md @@ -0,0 +1,85 @@ +--- +id: "bug-1934" +status: "open" +status_updated: "2026-10-10" +status_note: "newly logged" +component: "apiserver" +severity: "security" +timestamp: "2026-10-10T04:31:25Z" +last_seen: "2026-10-10T04:31:25Z" +occurrences: 1 +files: ["src/frontend/apiserver/controllers/jobs.go", "src/frontend/apiserver/controllers/rbac_check.go", "src/frontend/apiserver/models/roles.go", "src/frontend/apiserver/config/rbac.yaml"] +tags: ["apiserver", "rbac", "security", "self_ug"] +related: ["bug-1935"] +--- + +# bug-1934: apiserver treats a job:view grant scoped only to self_ug as all: user sees every user's jobs + +## Description +**Observed:** (source reading, not yet run) a role whose `job:view` grant is +scoped only to `self_ug` can see every user's jobs. The job-list handler +(`src/frontend/apiserver/controllers/jobs.go`) only distinguishes +`DomainType == self`: +```go +if permission.DomainType != models.DomainTypeSelf { + submitUser = filter.Value // jobs.go:178, caller-chosen user +} +... +if !specify_user || permission.DomainType == models.DomainTypeSelf { // :187 +... +if jobPermission.DomainType == models.DomainTypeSelf { // :762, per-row owner filter +``` +so `self_ug` falls through every check like `all`: a `submit_user` filter +naming any user (or `all`) is honoured and no row is removed. +`GetRequireResourcePermission()` (`controllers/rbac_check.go:323-346`) +returns only the first grant matching the permission, so for the default +`basic_user` (`config/rbac.yaml:37-40`, `job:view` with `self` then +`self_ug`) the `self` entry wins and `self_ug` is silently ignored. +`self_ug` is accepted by role validation (`controllers/roles.go:697-700`) +and listed as a supported job scope (`models/roles.go:70`), but nothing +resolves the user's user groups for it. + +**Expected:** a `self_ug` job grant covers exactly the jobs whose owner shares +a user group with the requester; a grant list with several scopes covers the +union of them; anything else is rejected or filtered out. +**Impact:** security (authorization bypass). Any role an admin creates with +`job:view` (or another job permission, unchecked) scoped to `self_ug` grants +visibility of all users' jobs. The default `basic_user` is not exposed (its +`self` grant is matched first) but never gets the group visibility its +config promises. Other job permissions using the same single-grant lookup +were not checked yet. +**Found by:** review, during `/kiro-spec-requirements project-config` +(2026-10-10, RBAC survey for project-scoped job permissions). + +## Environment +- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64 +- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2), from src/xce.build/frontend/apiserver/xce_apiserver +- Toolchain: go1.25.5 linux/amd64 (nix dev shell); gcc (GCC) 15.2.0, meson 1.9.1 +- Build: asan (xce.build) binary exists at this commit; the bug was found by reading the source, not by running it +- Code: scheduler-framework @ 54c8b29e +- Deployment: any apiserver deployment (single or HA); not reproduced on a running cluster yet + +## Reproduction +1. Start an apiserver with a role `ug_viewer` granting `job:view` with only + `- type: self_ug`, plus `queue:view` on `all`, assigned to user `alice`; + submit a job as user `bob`. +2. As `alice`: `xcecli jobs list -u bob` (or `-u all`), or + `GET /api/v1/jobs?filters={submit_user:eq:bob}`. +3. Expected: rejected or empty (unless alice and bob share a user group); + per the source reading, bob's job is returned. +- Frequency: deterministic by code reading; not yet executed. +- Evidence: the code lines quoted in Description; no logs. + +## Root cause +TODO: required for fixed/partial + +## Fix +TODO: required for fixed/partial + +## Verification +- Test: TODO: name + file; RED before the fix, GREEN after +- Suites: TODO: suite results and build profile +- Live: TODO: soak/deploy run, or n/a and why + +## References +- Related: none diff --git a/.wolf/bugs/bug-1935.md b/.wolf/bugs/bug-1935.md new file mode 100644 index 00000000..ed61f40d --- /dev/null +++ b/.wolf/bugs/bug-1935.md @@ -0,0 +1,69 @@ +--- +id: "bug-1935" +status: "open" +status_updated: "2026-10-10" +status_note: "newly logged" +component: "apiserver" +severity: "wrong-result" +timestamp: "2026-10-10T04:31:27Z" +last_seen: "2026-10-10T04:31:27Z" +occurrences: 1 +files: ["src/frontend/apiserver/models/jobs.go", "src/frontend/apiserver/controllers/jobs.go", "src/frontend/xcecli/filters/job_filter.go"] +tags: ["apiserver", "xcecli", "filter", "project"] +related: [] +--- + +# bug-1935: xcecli jobs list -P fails: apiserver rejects project_name filter (unsupported filter) + +## Description +**Observed:** `xcecli jobs list -P ` (`-P/--project`, +`src/frontend/xcecli/cmd/jobs/list.go:356`) sends the filter +`{project_name:eq:}` (`xcecli/filters/job_filter.go:108-109`), but +`project_name` is commented out of the apiserver's `JOB_SUPPORT_FILTERS` +(`src/frontend/apiserver/models/jobs.go:178`), so `validateJobQueryFilters()` +(`controllers/jobs.go:470-483`) rejects the request: +``` +unsupported filter: project_name +``` +(HTTP 400, INVALID_PARAMS). The same holds for `license_project` +(`models/jobs.go:179`, `job_filter.go:112-113`). Found by source reading; not +yet run against a live apiserver. + +**Expected:** `xcecli jobs list -P eng` lists the caller's visible jobs whose +project is `eng`. +**Impact:** wrong result: the documented `-P` (and license-project) filter of +`xcecli jobs list` always fails with an error; users cannot list jobs by +project. No data is affected. +**Found by:** review, during `/kiro-spec-requirements project-config` +(2026-10-10); `project-config` Requirement 7.5 needs this filter. + +## Environment +- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64 +- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2), from src/xce.build/frontend/apiserver/xce_apiserver +- Toolchain: go1.25.5 linux/amd64 (nix dev shell); gcc (GCC) 15.2.0, meson 1.9.1 +- Build: asan (xce.build) binary exists at this commit; the bug was found by reading the source, not by running it +- Code: scheduler-framework @ 54c8b29e +- Deployment: any apiserver deployment (single or HA); not reproduced on a running cluster yet + +## Reproduction +1. Start an apiserver (any deployment) and submit a job with + `xcecli jobs submit -P eng sleep 1`. +2. `xcecli jobs list -P eng` +3. Expected: the job is listed; per the source, the apiserver replies HTTP 400 + `unsupported filter: project_name`. +- Frequency: deterministic by code reading; not yet executed. +- Evidence: the code lines quoted in Description; no logs. + +## Root cause +TODO: required for fixed/partial + +## Fix +TODO: required for fixed/partial + +## Verification +- Test: TODO: name + file; RED before the fix, GREEN after +- Suites: TODO: suite results and build profile +- Live: TODO: soak/deploy run, or n/a and why + +## References +- Related: none