mirror of
https://github.com/gravitational/teleport
synced 2024-10-21 09:44:51 +00:00
70a73355c9
* Properly handle empty list of role requests Currently, an empty list of role requests results in an ambiguous situation: we usually use the presence of role requests to determine whether or not we'd return impersonated certs or not. An empty list of role requests returns a fresh set of non-impersonated certs (possibly renewed if allowed), while a non-empty list of role requests returns certs with just those roles. However, if a client _intends_ to request impersonated certs but provides an empty list of role requests it will instead receive non-impersonated (possibly renewable) certs with the full permissions of the original user. This could theoretically result in privilege escalation if a Machine ID bot: (a) had any worthwhile permissions of its own, which is not the case unless the bot role was manually modified and (b) accidentally handed certs off to an attacker. In practice this bug is fairly difficult to hit: `tbot` always auto-fills all requestable roles if they are otherwise unset, and `tctl bots add` requires `--roles=` to be passed. An empty string here can trigger the bug however it is unlikely a user would pass this by accident. Moreover, a bot without requestable roles cannot accomplish much of anything, so this is exceedingly unlikely to be intended behavior. Additionally, certificate generation checks help to mitigate the issue: bots currently lock themselves by accident after the first renewal when this bug is triggered as they don't explicitly handle receiving renewable certs when impersonated certs are expected. If an attacker were to attempt a renewal, the generation counter would similarly limit access, and as noted previously, the bot role grants only minimal read-only access anyway. --- To resolve the issue, this adds a new `RoleRequestsOnly` flag to `UserCertsRequest` that allows clients to unambiguously specify if they wish to receive a non-impersonated, possibly renewable, cert with all the original user's roles and permissions, or if they wish to receive only role-impersonated certs (or an error if roles are empty). Machine ID passes this flag in all situations where an impersonated cert is desired. Additionally, we also now ensure users add at least one role in `CreateBot()` (called by `tctl bots add`) as this is almost certainly an unintended situation. Fixes #13411 * Address review feedback, rename flag to UseRoleRequests * Return a local error if no roles are specified |
||
---|---|---|
.. | ||
botfs | ||
config | ||
destination | ||
identity | ||
testhelpers | ||
tshwrap | ||
configtemplate_test.go | ||
identity_test.go | ||
renew.go | ||
renew_test.go | ||
tbot.go |