Bug 883866 - [RFE]: Access control for QMF functionality should be improved
Summary: [RFE]: Access control for QMF functionality should be improved
Alias: None
Product: Red Hat Enterprise MRG
Classification: Red Hat
Component: qpid-cpp
Version: 2.2
Hardware: All
OS: Linux
Target Milestone: 3.1
: ---
Assignee: Pavel Moravec
QA Contact: Zdenek Kraus
Depends On:
Blocks: 785156
TreeView+ depends on / blocked
Reported: 2012-12-05 13:16 UTC by Pavel Moravec
Modified: 2019-07-11 07:38 UTC (History)
10 users (show)

Fixed In Version: qpid-cpp-0.30-2
Doc Type: Enhancement
Doc Text:
Some QMF methods bypassed ACL authorization, allowing content in any queue to be manipulated by any user that was authorized to invoke QMF methods. Missing ACL actions together with their parameters have been added that permit or deny users the ability to purge, move, redirect and reroute messages from a queue.
Clone Of:
[Release Notes]
Last Closed: 2015-04-14 13:46:22 UTC
Target Upstream Version:

Attachments (Terms of Use)
patch proposal (inital draft) (14.99 KB, patch)
2014-05-27 12:11 UTC, Pavel Moravec
no flags Details | Diff
Patch proposal (21.51 KB, patch)
2014-06-04 10:27 UTC, Pavel Moravec
no flags Details | Diff

System ID Private Priority Status Summary Last Updated
Apache JIRA QPID-5817 0 None None None Never
Red Hat Bugzilla 1101533 0 medium CLOSED QMF opcode _query_request bypasses any ACL authorisation 2021-02-22 00:41:40 UTC
Red Hat Bugzilla 1173543 0 medium NEW ACL QMF engine resolves queueRedirect call before ACL application 2021-02-22 00:41:40 UTC
Red Hat Product Errata RHEA-2015:0805 0 normal SHIPPED_LIVE Red Hat Enterprise MRG Messaging 3.1 Release 2015-04-14 17:45:54 UTC

Internal Links: 1101533 1173543

Comment 2 Pavel Moravec 2012-12-05 13:24:59 UTC
qpid already has some support for QMF methods&queries authorization. Many (or maybe all?) QMF methods call:


bool Manageable::AuthorizeMethod(uint32_t, Args&, const std::string&)
    return true;

I suppose this is required:
- ensure the method is called by invoking any QMF method/query
- call ACL stuff from the AuthorizeMethod
- enhance ACLs according to QMF methods and its arguments

Comment 8 Pavel Moravec 2014-05-27 12:11:41 UTC
Created attachment 899491 [details]
patch proposal (inital draft)

Initial version of patch for the same.

What misses there:
- on ACL denial, provide better text than "Forbidden" (raise framing::UnauthorizedAccessException).
- add some automated tests

example acl file:

acl deny all purge queue name=q
acl deny all move queue name=q queuename=w
acl deny all redirect queue name=q queuename=w
acl deny all reroute queue name=q exchangename=amq.fanout
acl deny all delete queue name=q
acl allow all all

Chuck, would you be ok with this proposal, including naming? Thanks.

Comment 9 Chuck Rolke 2014-05-27 19:48:50 UTC
The code looks good to me; the names are ok.

The only thing it needs is a few tests added to qpid/cpp/src/tests/acl.py.

Comment 10 Pavel Moravec 2014-06-04 10:27:15 UTC
Created attachment 902128 [details]
Patch proposal

Patch proposal, including automated tests enhancement.

Automated tests depend on QPID-5797 / commit https://svn.apache.org/r1599221 (trivial change in qpid-tools). Fix in broker does _not_ depend on QPID-5797.

/me to post a patch for relevant 1101533 as well and send both to upstream for a review.

Comment 11 Pavel Moravec 2014-06-15 07:17:30 UTC
Upstream review request: https://reviews.apache.org/r/22606/

Comment 12 Pavel Moravec 2014-06-18 07:43:09 UTC
Committed as r1603364.

Comment 18 Zdenek Kraus 2014-12-17 16:31:49 UTC
The QMF methods mentioned by Comment 8 was tested on RHEL6 i686 and x86_64 with following packages:


ACL rules for above mentioned QMF methods works as expected, except following issues:
Bug 1173534
Bug 1173543


Comment 23 errata-xmlrpc 2015-04-14 13:46:22 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.