docs(buglog): log bug-1934 (self_ug job scope acts as all) and bug-1935 (project_name filter rejected)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-10-10 04:32:32 +00:00

3.9 KiB

Raw Blame History

status

status_updated

status_note

component

severity

timestamp

last_seen

occurrences

files

bug-1934: apiserver treats a job:view grant scoped only to self_ug as all: user sees every user's jobs

Description

Observed: (source reading, not yet run) a role whose job:view grant is scoped only to self_ug can see every user's jobs. The job-list handler (src/frontend/apiserver/controllers/jobs.go) only distinguishes DomainType == self:

if permission.DomainType != models.DomainTypeSelf {
    submitUser = filter.Value            // jobs.go:178, caller-chosen user
}
...
if !specify_user || permission.DomainType == models.DomainTypeSelf {   // :187
...
if jobPermission.DomainType == models.DomainTypeSelf {   // :762, per-row owner filter

so self_ug falls through every check like all: a submit_user filter naming any user (or all) is honoured and no row is removed. GetRequireResourcePermission() (controllers/rbac_check.go:323-346) returns only the first grant matching the permission, so for the default basic_user (config/rbac.yaml:37-40, job:view with self then self_ug) the self entry wins and self_ug is silently ignored. self_ug is accepted by role validation (controllers/roles.go:697-700) and listed as a supported job scope (models/roles.go:70), but nothing resolves the user's user groups for it.

Expected: a self_ug job grant covers exactly the jobs whose owner shares a user group with the requester; a grant list with several scopes covers the union of them; anything else is rejected or filtered out. Impact: security (authorization bypass). Any role an admin creates with job:view (or another job permission, unchecked) scoped to self_ug grants visibility of all users' jobs. The default basic_user is not exposed (its self grant is matched first) but never gets the group visibility its config promises. Other job permissions using the same single-grant lookup were not checked yet. Found by: review, during /kiro-spec-requirements project-config (2026-10-10, RBAC survey for project-scoped job permissions).

Environment

OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2), from src/xce.build/frontend/apiserver/xce_apiserver
Toolchain: go1.25.5 linux/amd64 (nix dev shell); gcc (GCC) 15.2.0, meson 1.9.1
Build: asan (xce.build) binary exists at this commit; the bug was found by reading the source, not by running it
Code: scheduler-framework @ 54c8b29e
Deployment: any apiserver deployment (single or HA); not reproduced on a running cluster yet

Reproduction

Start an apiserver with a role ug_viewer granting job:view with only - type: self_ug, plus queue:view on all, assigned to user alice; submit a job as user bob.
As alice: xcecli jobs list -u bob (or -u all), or GET /api/v1/jobs?filters={submit_user:eq:bob}.
Expected: rejected or empty (unless alice and bob share a user group); per the source reading, bob's job is returned.

Frequency: deterministic by code reading; not yet executed.
Evidence: the code lines quoted in Description; no logs.

Root cause

TODO: required for fixed/partial

Fix