diff --git a/barbican/common/policies/secrets.py b/barbican/common/policies/secrets.py index 622a930bc..17e24aacf 100644 --- a/barbican/common/policies/secrets.py +++ b/barbican/common/policies/secrets.py @@ -13,13 +13,23 @@ from oslo_policy import policy +_READER = "role:reader" +_MEMBER = "role:member" +_ADMIN = "role:admin" +_PROJECT_MEMBER = f"{_MEMBER} and project_id:%(target.secret.project_id)s" +_PROJECT_ADMIN = f"{_ADMIN} and project_id:%(target.secret.project_id)s" +_SECRET_CREATOR = "user_id:%(target.secret.creator_id)s" +_SECRET_IS_NOT_PRIVATE = "True:%(target.secret.read_project_access)s" + rules = [ policy.DocumentedRuleDefault( name='secret:decrypt', check_str='rule:secret_decrypt_non_private_read or ' + 'rule:secret_project_creator or ' + - 'rule:secret_project_admin or rule:secret_acl_read', - scope_types=[], + 'rule:secret_project_admin or rule:secret_acl_read or ' + + f"({_PROJECT_MEMBER} and ({_SECRET_CREATOR} or " + + f"{_SECRET_IS_NOT_PRIVATE})) or {_PROJECT_ADMIN}", + scope_types=['project'], description='Retrieve a secrets payload.', operations=[ { @@ -32,8 +42,10 @@ rules = [ name='secret:get', check_str='rule:secret_non_private_read or ' + 'rule:secret_project_creator or ' + - 'rule:secret_project_admin or rule:secret_acl_read', - scope_types=[], + 'rule:secret_project_admin or rule:secret_acl_read or ' + + f"({_PROJECT_MEMBER} and ({_SECRET_CREATOR} or " + + f"{_SECRET_IS_NOT_PRIVATE})) or {_PROJECT_ADMIN}", + scope_types=['project'], description='Retrieves a secrets metadata.', operations=[ { @@ -44,8 +56,10 @@ rules = [ ), policy.DocumentedRuleDefault( name='secret:put', - check_str='rule:admin_or_creator and rule:secret_project_match', - scope_types=[], + check_str='rule:admin_or_creator and rule:secret_project_match or ' + + f"({_PROJECT_MEMBER} and ({_SECRET_CREATOR} or " + + f"{_SECRET_IS_NOT_PRIVATE})) or {_PROJECT_ADMIN}", + scope_types=['project'], description='Add the payload to an existing metadata-only secret.', operations=[ { @@ -57,8 +71,10 @@ rules = [ policy.DocumentedRuleDefault( name='secret:delete', check_str='rule:secret_project_admin or ' + - 'rule:secret_project_creator', - scope_types=[], + 'rule:secret_project_creator or ' + + f"({_PROJECT_MEMBER} and ({_SECRET_CREATOR} or " + + f"{_SECRET_IS_NOT_PRIVATE})) or {_PROJECT_ADMIN}", + scope_types=['project'], description='Delete a secret by uuid.', operations=[ { @@ -69,8 +85,8 @@ rules = [ ), policy.DocumentedRuleDefault( name='secrets:post', - check_str='rule:admin_or_creator', - scope_types=[], + check_str=f'rule:admin_or_creator or {_MEMBER}', + scope_types=['project'], description='Creates a Secret entity.', operations=[ { @@ -81,8 +97,8 @@ rules = [ ), policy.DocumentedRuleDefault( name='secrets:get', - check_str='rule:all_but_audit', - scope_types=[], + check_str=f'rule:all_but_audit or {_MEMBER}', + scope_types=['project'], description='Lists a projects secrets.', operations=[ { diff --git a/releasenotes/notes/secure-rbac-secrets-policy-61d49439a043f865.yaml b/releasenotes/notes/secure-rbac-secrets-policy-61d49439a043f865.yaml new file mode 100644 index 000000000..4085c79d7 --- /dev/null +++ b/releasenotes/notes/secure-rbac-secrets-policy-61d49439a043f865.yaml @@ -0,0 +1,13 @@ +--- +features: + - | + Implement secure-rbac for secrets resource. +security: + - | + The new secure-rbac policy allows for two-step secret creation to be done + by any member. This is a change from the previous policy that only allowed + step two to be performed by the creator. + - | + The new secure-rbac policy allows for secret deletion by members. This is + a change from the previous policy that only allowed deletion by the + creator or the project admin.