Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

JIMI Core System - Inherited ACL from Trigger #55

Open
b1scuit-thi3f opened this issue Nov 24, 2020 · 2 comments
Open

JIMI Core System - Inherited ACL from Trigger #55

b1scuit-thi3f opened this issue Nov 24, 2020 · 2 comments
Labels
enhancement New feature or request Security
Milestone

Comments

@b1scuit-thi3f
Copy link
Collaborator

Is your feature request related to a problem? Please describe.
Flow should inherit ACL from the initial trigger. This would stop users who can create flows from escalating their privilege to the JIMI users (as JIMI runs everything in core as himself)

@b1scuit-thi3f b1scuit-thi3f added enhancement New feature or request Security labels Nov 24, 2020
@z1pti3
Copy link
Owner

z1pti3 commented Nov 28, 2020

Will look into this, but think that the ACL on objects is used to ensure this is the case as child objects will have inherited ACL from the object that created them.

@z1pti3
Copy link
Owner

z1pti3 commented Jan 3, 2021

Agreed that this should be added in version 3.0 to enable sandboxing of jimiFlows to prevent core escalation / breakout from user defined ACL.

Currently ACL is only enforced for web and core runs with access to all objects, this feature could enable core to run with limited ACL as per the ACL of the trigger object.

@z1pti3 z1pti3 added this to the v3.0 milestone Jan 3, 2021
@z1pti3 z1pti3 modified the milestones: v3.0, v4.0 Jul 26, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request Security
Projects
None yet
Development

No branches or pull requests

2 participants