Bug 1889343

Summary: CVE-2020-10747 Clarification that roles are not meant for privilege escalation
Product: Red Hat Enterprise Linux 7 Reporter: Florian Delehaye <fdelehay>
Component: doc-Linux_Domain_Identity_Management_GuideAssignee: Florian Delehaye <fdelehay>
Status: CLOSED CURRENTRELEASE QA Contact: ipa-qe <ipa-qe>
Severity: unspecified Docs Contact: Florian Delehaye <fdelehay>
Priority: medium    
Version: 7.9CC: rhel-docs
Target Milestone: rcKeywords: Documentation
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-10-19 13:51:35 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Florian Delehaye 2020-10-19 12:32:54 UTC 
Document URL: 
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/linux_domain_identity_authentication_and_policy_guide/defining-roles

Section Number and Name: 
10.4. Defining Role-Based Access Controls

Describe the issue: 
We recently had a CVE-2020-10747 that was retracted. However, as a part
of the analysis for that retraction we identified that documentation is
not clear about the state of privileges in FreeIPA.
Ideally, we need a 'Note'
in https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/linux_domain_identity_authentication_and_policy_guide/defining-roles
be modified to very clearly state what Simo proposed.

Suggestions for improvement: 
"Roles are used to classify permitted actions but are not used as a tool to
implement privilege separation or to protect from privilege escalation"