From 66de22edfc72c7e93321bb6fedbed307f90054fb Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Thu, 24 Jun 2021 09:08:34 -0700 Subject: [PATCH 1/2] Avoid headings that don't work with docs theme --- .../admin-settings/rbac/default-custom-roles/_index.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/content/rancher/v2.5/en/admin-settings/rbac/default-custom-roles/_index.md b/content/rancher/v2.5/en/admin-settings/rbac/default-custom-roles/_index.md index 01764ad0ace..46eec0a0dca 100644 --- a/content/rancher/v2.5/en/admin-settings/rbac/default-custom-roles/_index.md +++ b/content/rancher/v2.5/en/admin-settings/rbac/default-custom-roles/_index.md @@ -17,14 +17,14 @@ This section covers the following topics: - [Deleting a custom global role](#deleting-a-custom-global-role) - [Assigning a custom global role to a group](#assigning-a-custom-global-role-to-a-group) -## Prerequisites +# Prerequisites To complete the tasks on this page, one of the following permissions are required: - [Administrator Global Permissions]({{}}/rancher/v2.5/en/admin-settings/rbac/global-permissions/). - [Custom Global Permissions]({{}}/rancher/v2.5/en/admin-settings/rbac/global-permissions/#custom-global-permissions) with the [Manage Roles]({{}}/rancher/v2.5/en/admin-settings/rbac/global-permissions/) role assigned. -## Creating A Custom Role for a Cluster or Project +# Creating A Custom Role for a Cluster or Project While Rancher comes out-of-the-box with a set of default user roles, you can also create default custom roles to provide users with very specific permissions within Rancher. @@ -57,7 +57,7 @@ The steps to add custom roles differ depending on the version of Rancher. 1. Click **Create**. -## Creating a Custom Global Role +# Creating a Custom Global Role ### Creating a Custom Global Role that Copies Rules from an Existing Role @@ -91,7 +91,7 @@ Custom global roles don't have to be based on existing roles. To create a custom 1. Click **Save.** -## Deleting a Custom Global Role +# Deleting a Custom Global Role When deleting a custom global role, all global role bindings with this custom role are deleted. @@ -105,7 +105,7 @@ To delete a custom global role, 2. On the **Global** tab, go to the custom global role that should be deleted and click **⋮ (…) > Delete.** 3. Click **Delete.** -## Assigning a Custom Global Role to a Group +# Assigning a Custom Global Role to a Group If you have a group of individuals that need the same level of access in Rancher, it can save time to create a custom global role. When the role is assigned to a group, the users in the group have the appropriate level of access the first time they sign into Rancher. From 01c818f04453e1055c3caceda09e23c832fd7577 Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Thu, 24 Jun 2021 09:24:11 -0700 Subject: [PATCH 2/2] Document privilege escalation through configure catalogs permission --- .../admin-settings/rbac/default-custom-roles/_index.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/content/rancher/v2.5/en/admin-settings/rbac/default-custom-roles/_index.md b/content/rancher/v2.5/en/admin-settings/rbac/default-custom-roles/_index.md index 46eec0a0dca..e1051f9ae5e 100644 --- a/content/rancher/v2.5/en/admin-settings/rbac/default-custom-roles/_index.md +++ b/content/rancher/v2.5/en/admin-settings/rbac/default-custom-roles/_index.md @@ -9,6 +9,8 @@ Within Rancher, _roles_ determine what actions a user can make within a cluster Note that _roles_ are different from _permissions_, which determine what clusters and projects you can access. +> It is possible for a custom role to enable privilege escalation. For details, see [this section.](#privilege-escalation) + This section covers the following topics: - [Prerequisites](#prerequisites) @@ -16,6 +18,7 @@ This section covers the following topics: - [Creating a custom global role](#creating-a-custom-global-role) - [Deleting a custom global role](#deleting-a-custom-global-role) - [Assigning a custom global role to a group](#assigning-a-custom-global-role-to-a-group) +- [Privilege escalation](#privilege-escalation) # Prerequisites @@ -129,3 +132,9 @@ To assign a custom global role to a group, follow these steps: 1. Click **Create.** **Result:** The custom global role will take effect when the users in the group log into Rancher. + +# Privilege Escalation + +The `Configure Catalogs` custom permission is powerful and should be used with caution. When an admin assigns the `Configure Catalogs` permission to a standard user, it could result in privilege escalation in which the user could give themselves admin access to Rancher provisioned clusters. + +For example, a standard user with the `Configure Catalogs` permission could fork the Rancher [system-charts repository](https://github.com/rancher/system-charts) and add a new version to `rancher-eks-operator` with a ClusterRoleBinding that assigns admin privileges to themselves. After editing the `system-library` catalog in Rancher to the forked version, the standard user would gain administrator access to new EKS clusters. \ No newline at end of file