Skip to content

VAULT-3825: Wildcard ACL policies without a trailing slash should match LIST operations#23874

Merged
miagilepner merged 2 commits intomainfrom
miagilepner/VAULT-3825-wildcard-policy
Oct 27, 2023
Merged

VAULT-3825: Wildcard ACL policies without a trailing slash should match LIST operations#23874
miagilepner merged 2 commits intomainfrom
miagilepner/VAULT-3825-wildcard-policy

Conversation

@miagilepner
Copy link
Collaborator

@miagilepner miagilepner commented Oct 27, 2023

When a LIST operation is executed on namespace foo, both of the following policies will independently allow the operation:

path "foo/sys/policies/acl" {
	capabilities = ["list"]
}

and

path "foo/sys/policies/acl/" {
	capabilities = ["list"]
}

both work 👍

However, when we use a wildcard in the policy path, we get different behavior:

path "+/sys/policies/acl" {
	capabilities = ["list"]
}

^ this fails

path "+/sys/policies/acl/" {
	capabilities = ["list"]
}

but ^ this succeeds.

This PR fixes the behavior so that it's the same for a wildcard versus no wildcard.

I considered stripping the trailing slash earlier in the request flow, but that would mean that any users that had written rules assuming that there was a trailing slash would need to update their policies after this change.

Tests for this are in enterprise.

@github-actions github-actions bot added the hashicorp-contributed-pr If the PR is HashiCorp (i.e. not-community) contributed label Oct 27, 2023
@miagilepner miagilepner modified the milestones: 1.13.10, 1.16.0-rc1 Oct 27, 2023
@miagilepner miagilepner marked this pull request as ready for review October 27, 2023 13:30
@github-actions
Copy link

Build Results:
All builds succeeded! ✅

@github-actions
Copy link

CI Results:
All Go tests succeeded! ✅

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

hashicorp-contributed-pr If the PR is HashiCorp (i.e. not-community) contributed

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants