public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-26 13:08:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Simplify guidance around configure catalogs permission

Browse Source
This commit is contained in:
Catherine Luse
2021-06-28 16:37:04 -07:00
parent 880d6f0dbc
commit 448eeaa136
1 changed files with 1 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/rancher/v2.5/en/admin-settings/rbac/default-custom-roles/_index.md
+1 -3
View File
@@ -135,6 +135,4 @@ To assign a custom global role to a group, follow these steps:
# Privilege Escalation
The `Configure Catalogs` custom permission is powerful and should be used with caution. When an admin assigns the `Configure Catalogs` permission to a standard user, it could result in privilege escalation in which the user could give themselves admin access to Rancher provisioned clusters.
For example, a standard user with the `Configure Catalogs` permission could fork the Rancher [system-charts repository](https://github.com/rancher/system-charts) and add a new version to `rancher-eks-operator` with a ClusterRoleBinding that assigns admin privileges to themselves. After editing the `system-library` catalog in Rancher to the forked version, the standard user would gain administrator access to new EKS clusters.
The `Configure Catalogs` custom permission is powerful and should be used with caution. When an admin assigns the `Configure Catalogs` permission to a standard user, it could result in privilege escalation in which the user could give themselves admin access to Rancher provisioned clusters. Anyone with this permission should be considered equivalent to an admin.