Client ACL and external auth system should have support for limiting functions to certain arguments

[torhve]

My use case is that I want to limit a certain PAM user to control his own virtual machine using the virt module. The virt module often takes the VM name as the argument.
Example:

salt-call virt.destroy VMName

But if I give a user access to the virt.destroy function, the user could then destroy all VMs on the host.

What would solve it is support for checking arguments to function, for example like this:

external_auth:
  pam:
    vmuser:
     - virt.destroy:
        arg0: VMName

I'm not sure how the arg-system should work, but should probably include support for regexes, or at the very least a static list of allowed arguments.

[thatch45]

wow, this will be a bit of a challenge. But I am open to it, the hard part I think will be deciding exactly how these will look in the config, since this is already the most complicated config component

[torhve]

Since my use case is mostly relevant to the API, it could be solved in salt API instead of here, but I guess the feature would be useful for all salt clients, not just the API. But maybe the API would/could have additional checks ?

My final resort would be to filter this in nginx proxy, using lua to check all the args. Would be very easy to implement.

[thatch45]

Yes, I am game for adding this, but I won't be able to get to it right away.

[meggiebot]

Committed for Boron

[meggiebot]

ZD 411

[DmitryKuzmenko]

Here is an example of usage:

external_auth:
  pam:
    my_user:
      - '*':
        - 'my_mod.*':
          args:
            - 'a.*'
            - 'b.*'
          kwargs:
            'kwa': 'kwa.*'
            'kwb': 'kwb'

The rules:

1. The arguments values are matched as regexp.
2. If arguments restrictions are specified the only matched are allowed.
3. If an argument isn't specified any value is allowed.
4. To skip an arg use "everything" regexp .*. I.e. if arg0 and arg2 should be limited but arg1 and other arguments could have any value use:

          args:
            - 'value0'
            - '.*'
            - 'value2'

[mikepietruszka]

@DmitryKuzmenko Does this work for client_acl as well, or just external_auth?

Edit: Actually just saw that this is for external_auth only and works in 2016.3.0+.

[thatsk]

can you just show one example by using any module
?

[thatsk]

publisher_acl:
user:
- nodename:
- test.ping
- pkg.clean_metadata
- pkg.upgrade:
args:
- 'httpd'
- 'nginx'
kwargs:

[thatsk]

how to use kwargs?

[rallytime]

@thatsk Can you file a new issue about your documentation questions?