From 6d6a726f9d145e4d3de541322968c3f7473562c4 Mon Sep 17 00:00:00 2001
From: Max Bowsher <maxbowsher@gmail.com>
Date: Tue, 10 Jan 2023 18:17:16 +0000
Subject: [PATCH] Fix HelpOperation on sudo-protected paths (#18568)

* Fix HelpOperation on sudo-protected paths

Fixes #18566

* Add changelog
---
 changelog/18568.txt | 3 +++
 vault/acl.go        | 4 +++-
 2 files changed, 6 insertions(+), 1 deletion(-)
 create mode 100644 changelog/18568.txt

diff --git a/changelog/18568.txt b/changelog/18568.txt
new file mode 100644
index 000000000..a1fbabf25
--- /dev/null
+++ b/changelog/18568.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+core: Fix spurious `permission denied` for all HelpOperations on sudo-protected paths
+```
diff --git a/vault/acl.go b/vault/acl.go
index 7aeb102bd..3a3f99a4c 100644
--- a/vault/acl.go
+++ b/vault/acl.go
@@ -719,7 +719,9 @@ func (c *Core) performPolicyChecks(ctx context.Context, acl *ACL, te *logical.To
 		if !ret.ACLResults.Allowed {
 			return ret
 		}
-		if !ret.RootPrivs && opts.RootPrivsRequired {
+		// Since HelpOperation was fast-pathed inside AllowOperation, RootPrivs will not have been populated in this
+		// case, so we need to special-case that here as well, or we'll block HelpOperation on all sudo-protected paths.
+		if !ret.RootPrivs && opts.RootPrivsRequired && req.Operation != logical.HelpOperation {
 			return ret
 		}
 	}