Skip to content

Controller should check authorization for /debug/pprof #12907

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Feb 13, 2017
Merged

Controller should check authorization for /debug/pprof #12907

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
44523b2
Move quasi-generic handlers out so controller can reuse them
smarterclayton Feb 10, 2017
284abfd
Add Path and IsNonResourceURL to SAR (like upstream)
smarterclayton Feb 10, 2017
50fa90e
Enforce authz(n) on controller
smarterclayton Feb 10, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions api/protobuf-spec/github_com_openshift_origin_pkg_authorization_api_v1.proto
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

44 changes: 42 additions & 2 deletions api/swagger-spec/oapi-v1.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27586,7 +27586,9 @@
"resourceAPIGroup",
"resourceAPIVersion",
"resource",
"resourceName"
"resourceName",
"path",
"isNonResourceURL"
],
"properties": {
"kind": {
Expand Down Expand Up @@ -27621,6 +27623,14 @@
"type": "string",
"description": "ResourceName is the name of the resource being requested for a \"get\" or deleted for a \"delete\""
},
"path": {
"type": "string",
"description": "Path is the path of a non resource URL"
},
"isNonResourceURL": {
"type": "boolean",
"description": "IsNonResourceURL is true if this is a request for a non-resource URL (outside of the resource hieraarchy)"
},
"content": {
"type": "string",
"description": "Content is the actual content of the request for create and update"
Expand All @@ -27637,6 +27647,8 @@
"resourceAPIVersion",
"resource",
"resourceName",
"path",
"isNonResourceURL",
"user",
"groups",
"scopes"
Expand Down Expand Up @@ -27674,6 +27686,14 @@
"type": "string",
"description": "ResourceName is the name of the resource being requested for a \"get\" or deleted for a \"delete\""
},
"path": {
"type": "string",
"description": "Path is the path of a non resource URL"
},
"isNonResourceURL": {
"type": "boolean",
"description": "IsNonResourceURL is true if this is a request for a non-resource URL (outside of the resource hieraarchy)"
},
"content": {
"type": "string",
"description": "Content is the actual content of the request for create and update"
Expand Down Expand Up @@ -28746,7 +28766,9 @@
"resourceAPIGroup",
"resourceAPIVersion",
"resource",
"resourceName"
"resourceName",
"path",
"isNonResourceURL"
],
"properties": {
"kind": {
Expand Down Expand Up @@ -28781,6 +28803,14 @@
"type": "string",
"description": "ResourceName is the name of the resource being requested for a \"get\" or deleted for a \"delete\""
},
"path": {
"type": "string",
"description": "Path is the path of a non resource URL"
},
"isNonResourceURL": {
"type": "boolean",
"description": "IsNonResourceURL is true if this is a request for a non-resource URL (outside of the resource hieraarchy)"
},
"content": {
"type": "string",
"description": "Content is the actual content of the request for create and update"
Expand Down Expand Up @@ -29333,6 +29363,8 @@
"resourceAPIVersion",
"resource",
"resourceName",
"path",
"isNonResourceURL",
"user",
"groups",
"scopes"
Expand Down Expand Up @@ -29370,6 +29402,14 @@
"type": "string",
"description": "ResourceName is the name of the resource being requested for a \"get\" or deleted for a \"delete\""
},
"path": {
"type": "string",
"description": "Path is the path of a non resource URL"
},
"isNonResourceURL": {
"type": "boolean",
"description": "IsNonResourceURL is true if this is a request for a non-resource URL (outside of the resource hieraarchy)"
},
"content": {
"type": "string",
"description": "Content is the actual content of the request for create and update"
Expand Down
44 changes: 42 additions & 2 deletions api/swagger-spec/openshift-openapi-spec.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51992,7 +51992,9 @@
"resourceAPIGroup",
"resourceAPIVersion",
"resource",
"resourceName"
"resourceName",
"path",
"isNonResourceURL"
],
"properties": {
"apiVersion": {
Expand All @@ -52003,6 +52005,10 @@
"description": "Content is the actual content of the request for create and update",
"$ref": "#/definitions/runtime.RawExtension"
},
"isNonResourceURL": {
"description": "IsNonResourceURL is true if this is a request for a non-resource URL (outside of the resource hieraarchy)",
"type": "boolean"
},
"kind": {
"description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#types-kinds",
"type": "string"
Expand All @@ -52011,6 +52017,10 @@
"description": "Namespace is the namespace of the action being requested. Currently, there is no distinction between no namespace and all namespaces",
"type": "string"
},
"path": {
"description": "Path is the path of a non resource URL",
"type": "string"
},
"resource": {
"description": "Resource is one of the existing resource types",
"type": "string"
Expand Down Expand Up @@ -52042,6 +52052,8 @@
"resourceAPIVersion",
"resource",
"resourceName",
"path",
"isNonResourceURL",
"user",
"groups",
"scopes"
Expand All @@ -52062,6 +52074,10 @@
"type": "string"
}
},
"isNonResourceURL": {
"description": "IsNonResourceURL is true if this is a request for a non-resource URL (outside of the resource hieraarchy)",
"type": "boolean"
},
"kind": {
"description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#types-kinds",
"type": "string"
Expand All @@ -52070,6 +52086,10 @@
"description": "Namespace is the namespace of the action being requested. Currently, there is no distinction between no namespace and all namespaces",
"type": "string"
},
"path": {
"description": "Path is the path of a non resource URL",
"type": "string"
},
"resource": {
"description": "Resource is one of the existing resource types",
"type": "string"
Expand Down Expand Up @@ -54480,7 +54500,9 @@
"resourceAPIGroup",
"resourceAPIVersion",
"resource",
"resourceName"
"resourceName",
"path",
"isNonResourceURL"
],
"properties": {
"apiVersion": {
Expand All @@ -54491,6 +54513,10 @@
"description": "Content is the actual content of the request for create and update",
"$ref": "#/definitions/runtime.RawExtension"
},
"isNonResourceURL": {
"description": "IsNonResourceURL is true if this is a request for a non-resource URL (outside of the resource hieraarchy)",
"type": "boolean"
},
"kind": {
"description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#types-kinds",
"type": "string"
Expand All @@ -54499,6 +54525,10 @@
"description": "Namespace is the namespace of the action being requested. Currently, there is no distinction between no namespace and all namespaces",
"type": "string"
},
"path": {
"description": "Path is the path of a non resource URL",
"type": "string"
},
"resource": {
"description": "Resource is one of the existing resource types",
"type": "string"
Expand Down Expand Up @@ -56019,6 +56049,8 @@
"resourceAPIVersion",
"resource",
"resourceName",
"path",
"isNonResourceURL",
"user",
"groups",
"scopes"
Expand All @@ -56039,6 +56071,10 @@
"type": "string"
}
},
"isNonResourceURL": {
"description": "IsNonResourceURL is true if this is a request for a non-resource URL (outside of the resource hieraarchy)",
"type": "boolean"
},
"kind": {
"description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#types-kinds",
"type": "string"
Expand All @@ -56047,6 +56083,10 @@
"description": "Namespace is the namespace of the action being requested. Currently, there is no distinction between no namespace and all namespaces",
"type": "string"
},
"path": {
"description": "Path is the path of a non resource URL",
"type": "string"
},
"resource": {
"description": "Resource is one of the existing resource types",
"type": "string"
Expand Down
4 changes: 4 additions & 0 deletions pkg/authorization/api/types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -291,6 +291,10 @@ type Action struct {
Resource string
// ResourceName is the name of the resource being requested for a "get" or deleted for a "delete"
ResourceName string
// Path is the path of a non resource URL
Path string
// IsNonResourceURL is true if this is a request for a non-resource URL (outside of the resource hieraarchy)
IsNonResourceURL bool
// Content is the actual content of the request for create and update
Content kruntime.Object
}
Expand Down
Loading