Mahmood Ali 4b2ba62e35 acl: check ACL against object namespace ... Fix a bug where a millicious user can access or manipulate an alloc in a namespace they don't have access to. The allocation endpoints perform ACL checks against the request namespace, not the allocation namespace, and performs the allocation lookup independently from namespaces. Here, we check that the requested can access the alloc namespace regardless of the declared request namespace. Ideally, we'd enforce that the declared request namespace matches the actual allocation namespace. Unfortunately, we haven't documented alloc endpoints as namespaced functions; we suspect starting to enforce this will be very disruptive and inappropriate for a nomad point release. As such, we maintain current behavior that doesn't require passing the proper namespace in request. A future major release may start enforcing checking declared namespace.		2019-10-08 12:59:22 -04:00
..
deploymentwatcher	add create and modify timestamps to evaluations (#5881)	2019-08-07 09:50:35 -07:00
drainer	add create and modify timestamps to evaluations (#5881)	2019-08-07 09:50:35 -07:00
mock	connect: add unix socket to proxy grpc for envoy (#6232)	2019-09-03 08:43:38 -07:00
state	Merge pull request #5791 from hashicorp/b-plan-snapshotindex	2019-07-17 09:25:00 -07:00
structs	acl: check ACL against object namespace	2019-10-08 12:59:22 -04:00
types
acl.go
acl_endpoint.go
acl_endpoint_test.go
acl_test.go
alloc_endpoint.go	acl: check ACL against object namespace	2019-10-08 12:59:22 -04:00
alloc_endpoint_test.go	acl: check ACL against object namespace	2019-10-08 12:59:22 -04:00
autopilot.go
autopilot_test.go	tests: give up on TestAutopilot_CleanupStaleRaftServer for now	2019-09-04 09:10:53 -04:00
blocked_evals.go	blocked_evals reset system evals on Flush	2019-07-18 10:32:13 -04:00
blocked_evals_system.go	blocked_evals system evals indexed by job and node	2019-07-18 10:32:12 -04:00
blocked_evals_test.go	blocked_evals_test disable calls Flush	2019-07-18 10:32:13 -04:00
client_alloc_endpoint.go	acl: check ACL against object namespace	2019-10-08 12:59:22 -04:00
client_alloc_endpoint_test.go	acl: check ACL against object namespace	2019-10-08 12:59:22 -04:00
client_fs_endpoint.go	acl: check ACL against object namespace	2019-10-08 12:59:22 -04:00
client_fs_endpoint_test.go	acl: check ACL against object namespace	2019-10-08 12:59:22 -04:00
client_rpc.go
client_rpc_test.go	tests: update time sensitive tests	2019-09-04 08:45:25 -04:00
client_stats_endpoint.go
client_stats_endpoint_test.go
config.go	default raft protocol v2	2019-09-24 14:37:55 -04:00
core_sched.go	core_sched add compat comment for later removal	2019-07-10 13:56:20 -04:00
core_sched_test.go
deployment_endpoint.go	acl: check ACL against object namespace	2019-10-08 12:59:22 -04:00
deployment_endpoint_test.go
deployment_watcher_shims.go
drainer_int_test.go
drainer_shims.go
endpoints_oss.go
eval_broker.go
eval_broker_test.go
eval_endpoint.go	acl: check ACL against object namespace	2019-10-08 12:59:22 -04:00
eval_endpoint_test.go
fsm.go	fsm attach UnblockNode on node updates	2019-07-18 10:32:12 -04:00
fsm_not_ent.go
fsm_registry_oss.go
fsm_test.go	NodeDeregisterBatch -> NodeBatchDeregister match JobBatch pattern	2019-07-10 13:56:20 -04:00
heartbeat.go
heartbeat_test.go	Fix raft tests	2019-09-03 14:53:29 -04:00
job_endpoint.go	use RequestNamespace(), the canonical way to get namespace	2019-09-27 07:40:58 -04:00
job_endpoint_hook_connect.go	connect: add unix socket to proxy grpc for envoy (#6232)	2019-09-03 08:43:38 -07:00
job_endpoint_hook_connect_test.go	Builtin Admission Controller Framework (#6116)	2019-08-15 11:22:37 -04:00
job_endpoint_hooks.go	Builtin Admission Controller Framework (#6116)	2019-08-15 11:22:37 -04:00
job_endpoint_oss.go
job_endpoint_test.go	nomad: defensive check for namespaces in job registration call	2019-09-26 17:02:47 -04:00
leader.go	Merge pull request #5911 from hashicorp/b-rpc-consistent-reads	2019-08-20 09:29:37 -04:00
leader_oss.go
leader_test.go	Fix raft tests	2019-09-03 14:53:29 -04:00
merge.go
node_endpoint.go	add create and modify timestamps to evaluations (#5881)	2019-08-07 09:50:35 -07:00
node_endpoint_test.go	add create and modify timestamps to evaluations (#5881)	2019-08-07 09:50:35 -07:00
operator_endpoint.go
operator_endpoint_test.go	update tests to run with v2	2019-08-28 16:42:08 -04:00
periodic.go	add create and modify timestamps to evaluations (#5881)	2019-08-07 09:50:35 -07:00
periodic_endpoint.go
periodic_endpoint_test.go
periodic_test.go
plan_apply.go	add create and modify timestamps to evaluations (#5881)	2019-08-07 09:50:35 -07:00
plan_apply_not_ent.go
plan_apply_pool.go
plan_apply_pool_test.go
plan_apply_test.go	tests: update time sensitive tests	2019-09-04 08:45:25 -04:00
plan_endpoint.go
plan_endpoint_test.go
plan_normalization_test.go
plan_queue.go
plan_queue_test.go
raft_rpc.go
regions_endpoint.go
regions_endpoint_test.go
rpc.go	Merge pull request #5911 from hashicorp/b-rpc-consistent-reads	2019-08-20 09:29:37 -04:00
rpc_test.go	Merge pull request #5911 from hashicorp/b-rpc-consistent-reads	2019-08-20 09:29:37 -04:00
search_endpoint.go
search_endpoint_oss.go
search_endpoint_test.go
serf.go
serf_test.go
server.go	nomad/server comments	2019-09-24 14:36:18 -04:00
server_setup_oss.go
server_test.go
stats_fetcher.go
stats_fetcher_test.go
status_endpoint.go
status_endpoint_test.go
system_endpoint.go
system_endpoint_test.go
testing.go	tests: disable server auto join by default	2019-09-04 07:54:54 -04:00
timetable.go
timetable_test.go
util.go	acl: check ACL against object namespace	2019-10-08 12:59:22 -04:00
util_test.go	util partitionAll for paging	2019-07-10 13:56:19 -04:00
vault.go	Merge pull request #6082 from hashicorp/b-vault-deadlock	2019-08-06 15:30:17 -07:00
vault_test.go	vault: fix deadlock in SetConfig	2019-08-06 10:40:14 -07:00
vault_testing.go
worker.go	add create and modify timestamps to evaluations (#5881)	2019-08-07 09:50:35 -07:00
worker_test.go	nomad: SnapshotAfter -> SnapshotMinIndex	2019-06-24 12:16:46 -07:00