Bug 1207621 - pacemaker (1.1.12-4.el6.x86_64) acl read-only access allow role assignment
Summary: pacemaker (1.1.12-4.el6.x86_64) acl read-only access allow role assignment
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: pacemaker
Version: 6.7
Hardware: All
OS: Linux
Target Milestone: rc
: ---
Assignee: Andrew Beekhof
QA Contact: cluster-qe@redhat.com
Depends On:
Blocks: CVE-2015-1867
TreeView+ depends on / blocked
Reported: 2015-03-31 10:30 UTC by Franck Grosjean
Modified: 2015-07-22 14:44 UTC (History)
5 users (show)

Fixed In Version: pacemaker-1.1.12-6.el6
Doc Type: Release Note
Doc Text:
Clone Of:
Last Closed: 2015-07-22 07:44:06 UTC

Attachments (Terms of Use)

System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:1424 normal SHIPPED_LIVE Moderate: pacemaker security and bug fix update 2015-07-20 18:06:24 UTC

Description Franck Grosjean 2015-03-31 10:30:59 UTC
Description of problem:
acl definitions are not enforced and could be bypassed by a user without write access to the cib

Version-Release number of selected component (if applicable):
RedHat Enterprise Linux 6.6
pcs --version = 0.9.123
pacemakerd --version = Pacemaker 1.1.11

How reproducible:
a user with a read-only role can assign any other existing roles to himself and then gain any kind of access from any role (rw access to the cib if this kind of role exist).

Steps to Reproduce:
1. create a role read-only
   pcs acl role create read-only description="Read only access" read xpath /cib
2. create a role admin
   pcs acl role create admin description="Admin access" write xpath /cib
3. create an account (local + pcs)
4. open a session with this roaccount account
5. add admin role to your account
   pcs acl role assign admin to rocluster
6. check new acl pushed as a read-only user
   pcs acl
  User: rocluster
    Roles: read-only admin
  Role: read-only
    Description: Read only access
    Permission: read xpath /cib (read-only-read)
  Role: admin
    Description: Admin access
    Permission: write xpath /cib (admin-write)
7. add/delete/modify anything

Actual results:
obtain rw access to the cib

Expected results:
must not be possible with read-only access to the cib to assign a role

Additional info:

Comment 2 Andrew Beekhof 2015-04-07 00:17:07 UTC
Good catch!

Introduced in: https://github.com/ClusterLabs/pacemaker/commit/f242c1ef
Fixed in:      https://github.com/ClusterLabs/pacemaker/commit/84ac07c

Comment 6 errata-xmlrpc 2015-07-22 07:44:06 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.