Elgato_dark/fleet
1
0
Fork 0
mirror of https://github.com/fleetdm/fleet synced 2026-05-23 08:58:41 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 111

Fix live query for observers (#1603)

Browse source 
Set observer can run when performing authz check for live query results.

Final backend fix for #1515
This commit is contained in:
Zach Wasserman 2021-08-09 19:30:17 -07:00 committed by GitHub
parent 6a1b82f52f
commit a29844120b
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 15 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
server/service/service_campaigns.go
View file

@ -185,7 +185,10 @@ type campaignStatus struct {
func (svc Service) StreamCampaignResults(ctx context.Context, conn *websocket.Conn, campaignID uint) {
logging.WithExtras(ctx, "campaign_id", campaignID)
if err := svc.authz.Authorize(ctx, &fleet.Query{}, fleet.ActionRun); err != nil {
// Explicitly set ObserverCanRun: true in this check because we check that the user trying to
// read results is the same user that initiated the query. This means the observer check already
// happened with the actual value for this query.
if err := svc.authz.Authorize(ctx, &fleet.Query{ObserverCanRun: true}, fleet.ActionRun); err != nil {
level.Info(svc.logger).Log("err", "stream results authorization failed")
conn.WriteJSONError(authz.ForbiddenErrorMessage)
return

13
server/service/service_status.go
View file

@ -3,17 +3,26 @@ package service
import (
"context"
"github.com/fleetdm/fleet/v4/server/fleet"
"github.com/pkg/errors"
)
func (svc *Service) StatusResultStore(ctx context.Context) error {
if err := svc.authz.Authorize(ctx, &fleet.AppConfig{}, fleet.ActionRead); err != nil {
return err
}
return svc.resultStore.HealthCheck()
}
func (svc *Service) StatusLiveQuery(ctx context.Context) error {
cfg, err := svc.AppConfig(ctx)
if err := svc.authz.Authorize(ctx, &fleet.AppConfig{}, fleet.ActionRead); err != nil {
return err
}
cfg, err := svc.ds.AppConfig()
if err != nil {
return errors.Wrap(err, "retreiving app config")
return errors.Wrap(err, "retrieve app config")
}
if cfg.LiveQueryDisabled {