mirror of
https://github.com/fleetdm/fleet
synced 2026-05-24 09:28:54 +00:00
A question in form of PR: Do we really need the following two entities in our [policy.rego](https://github.com/fleetdm/fleet/blob/main/server/authz/policy.rego) `1. (object=mdm_apple_command, action=read/write)` and `2. (object=host, action=mdm_command)`? (Maybe mdm_command is a leftover action from the PoC?) Guess: `mdm_apple_command` (`fleet.MDMAppleCommandAuthz`) is what we want: `action=write` means you can enqueue, `action=read` means you can list commands and read their results. PS: Found this while trying to add command execution permissions to the new `GitOps` role. |
||
|---|---|---|
| .. | ||
| authz.go | ||
| errors.go | ||
| policy.rego | ||
| policy_test.go | ||
| policy_test.rego | ||