Bug 1811757 - RBAC check incorrect for Home -> Overview nav item
Summary: RBAC check incorrect for Home -> Overview nav item
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Management Console
Version: 4.4
Hardware: Unspecified
OS: Unspecified
unspecified
high
Target Milestone: ---
: 4.5.0
Assignee: Samuel Padgett
QA Contact: Yadan Pei
URL:
Whiteboard:
Depends On:
Blocks: 1812506
TreeView+ depends on / blocked
 
Reported: 2020-03-09 17:09 UTC by Samuel Padgett
Modified: 2020-07-13 17:19 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Previously, the Home -> Overview nav item would be hidden from users who could not list namespaces, but otherwise had authority to see metrics. The nav item now appears for all users who have authority to see cluster metrics.
Clone Of:
: 1812506 (view as bug list)
Environment:
Version: 4.4.0-0.ci-2020-03-09-103610 Cluster ID: 409bf8c6-8338-44de-92aa-694c2b61aa26 Browser: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:73.0) Gecko/20100101 Firefox/73.0
Last Closed: 2020-07-13 17:19:06 UTC
Target Upstream Version:


Attachments (Terms of Use)
POST get namespace request on Overview page (369.97 KB, image/png)
2020-03-11 08:20 UTC, XiaochuanWang
no flags Details


Links
System ID Priority Status Summary Last Updated
Github openshift console pull 4698 None closed Bug 1811757: Fix access review for Home -> Overview page 2020-06-23 09:12:06 UTC
Red Hat Product Errata RHBA-2020:2409 None None None 2020-07-13 17:19:41 UTC

Description Samuel Padgett 2020-03-09 17:09:26 UTC
The RBAC check we have is whether the user can list namespaces. The correct check is whether the user can *get* namespaces.

Comment 4 XiaochuanWang 2020-03-11 08:20:19 UTC
Created attachment 1669191 [details]
POST get namespace request on Overview page

Comment 5 XiaochuanWang 2020-03-11 08:23:21 UTC
Home -> Overview page now POST a request to get namespace by api/kubernetes/apis/authorization.k8s.io/v1/selfsubjectaccessreviews and reture 201 without issue.

Now this could be Verified.
Checked on 4.5.0-0.ci-2020-03-10-225406

Comment 7 errata-xmlrpc 2020-07-13 17:19:06 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:2409


Note You need to log in before you can comment on or make changes to this bug.