[v0.4.6] s4: Fixes 374

docs.md

@@ -51,7 +51,9 @@ If yes, the webhook redacts the role, so that it only grants a deletion permissi
 
 #### Escalation Prevention
 
-Users can only create/update ClusterRoleTemplateBindings which grant permissions to RoleTemplates with rights less than or equal to those they currently possess. This is to prevent privilege escalation. 
+Users can only create/update ClusterRoleTemplateBindings which grant permissions to RoleTemplates with rights less than or equal to those they currently possess. This is to prevent privilege escalation.
+For external RoleTemplates (RoleTemplates with `external` set to `true`), if the `external-rules` feature flag is enabled and `ExternalRules` is specified in the roleTemplate in `RoleTemplateName`,
+`ExternalRules` will be used for authorization. Otherwise (if the feature flag is off or `ExternalRules` are nil), the rules from the backing `ClusterRole` in the local cluster will be used.
 
 #### Invalid Fields - Create
 
@@ -90,6 +92,7 @@ In addition, as in the create validation, both a user subject and a group subjec
 #### On update
 
 The desired value must not change on new spec unless it's equal to the `lockedValue` or `lockedValue` is nil.
+Due to the security impact of the `external-rules` feature flag, only users with admin permissions (`*` verbs on `*` resources in `*` APIGroups in all namespaces) can enable or disable this feature flag.
 
 ## FleetWorkspace 
 
@@ -207,6 +210,8 @@ Adds the authz.management.cattle.io/creator-role-bindings annotation.
 
 Users can only create/update ProjectRoleTemplateBindings with rights less than or equal to those they currently possess.
 This is to prevent privilege escalation.
+For external RoleTemplates (RoleTemplates with `external` set to `true`), if the `external-rules` feature flag is enabled and `ExternalRules` is specified in the roleTemplate in `RoleTemplateName`,
+`ExternalRules` will be used for authorization. Otherwise, if `ExternalRules` are nil when the feature flag is on, the rules from the backing `ClusterRole` in the local cluster will be used.
 
 #### Invalid Fields - Create
 
@@ -256,11 +261,12 @@ Circular references to a `RoleTemplate` (a inherits b, b inherits a) are not all
 
 #### Rules Without Verbs, Resources, API groups
 
-Rules without verbs, resources, or apigroups are not permitted. The `rules` included in a RoleTemplate are of the same type as the rules used by standard Kubernetes RBAC types (such as `Roles` from `rbac.authorization.k8s.io/v1`). Because of this, they inherit the same restrictions as these types, including this one.
+Rules without verbs, resources, or apigroups are not permitted. The `rules` and `externalRules` included in a RoleTemplate are of the same type as the rules used by standard Kubernetes RBAC types (such as `Roles` from `rbac.authorization.k8s.io/v1`). Because of this, they inherit the same restrictions as these types, including this one.
 
 #### Escalation Prevention
 
 Users can only change RoleTemplates with rights less than or equal to those they currently possess. This prevents privilege escalation. 
+Users can't create external RoleTemplates (or update existing RoleTemplates) with `ExternalRules` without having the `escalate` verb on that RoleTemplate.
 
 #### Context Validation
 

go.mod

@@ -38,8 +38,8 @@ require (
 	github.com/gorilla/mux v1.8.0
 	github.com/rancher/dynamiclistener v0.4.0-rc2
 	github.com/rancher/lasso v0.0.0-20240123150939-7055397d6dfa
-	github.com/rancher/rancher/pkg/apis v0.0.0-20240507213626-07f244b8be3a
-	github.com/rancher/rke v1.5.9-rc2
+	github.com/rancher/rancher/pkg/apis v0.0.0-20240611034301-19a4362e2243
+	github.com/rancher/rke v1.5.9
 	github.com/rancher/wrangler/v2 v2.1.4
 	github.com/robfig/cron v1.2.0
 	github.com/sirupsen/logrus v1.9.3

go.sum

@@ -299,10 +299,10 @@ github.com/rancher/lasso v0.0.0-20240123150939-7055397d6dfa h1:eRhvQJjIpPxJunlS3
 github.com/rancher/lasso v0.0.0-20240123150939-7055397d6dfa/go.mod h1:utdskbIL7kdVvPCUFPEJQDWJwPHGFpUCRfVkX2G2Xxg=
 github.com/rancher/norman v0.0.0-20240206180703-6eda4bc94b4c h1:ayqZqJ4AYYVaZGlBztLBij81z/QRsSFbQfxs9bzA+Tg=
 github.com/rancher/norman v0.0.0-20240206180703-6eda4bc94b4c/go.mod h1:WbNpu/HwChwKk54W0rWBdioxYVVZwVVz//UX84m/NvY=
-github.com/rancher/rancher/pkg/apis v0.0.0-20240507213626-07f244b8be3a h1:D1X2mAW6LZdkZhQbmtwCKNND7jl2v+m3V4VuwaB+BiE=
-github.com/rancher/rancher/pkg/apis v0.0.0-20240507213626-07f244b8be3a/go.mod h1:RZjaN8KMbRMF9zfpYEOkWUuwy6uZ6R/FKqK/gwOXnaQ=
-github.com/rancher/rke v1.5.9-rc2 h1:DCovi6z3Q+GlxRy3mIRSR+cqLWoHD1OKOOdnR8HCaYg=
-github.com/rancher/rke v1.5.9-rc2/go.mod h1:vojhOf8U8VCmw7y17OENWXSIfEFPEbXCMQcmI7xN7i8=
+github.com/rancher/rancher/pkg/apis v0.0.0-20240611034301-19a4362e2243 h1:lDdMkc0klQ/0jA8l3QWRzKpK21nO6E4qIagaOBq2KdA=
+github.com/rancher/rancher/pkg/apis v0.0.0-20240611034301-19a4362e2243/go.mod h1:5FRNHrG/G92wZ7XYKr9eFl/Sf2XqHown8CozHk+pmmU=
+github.com/rancher/rke v1.5.9 h1:sCD2vWtkUQEQmNWyne7akZXuu4gZw+3vZVf8VRALXOE=
+github.com/rancher/rke v1.5.9/go.mod h1:/z9oyKqYpFwgRBV9rfLxqUdjydz/VMCTcjld4uUt7uM=
 github.com/rancher/wrangler/v2 v2.1.4 h1:ohov0i6A9dJHHO6sjfsH4Dqv93ZTdm5lIJVJdPzVdQc=
 github.com/rancher/wrangler/v2 v2.1.4/go.mod h1:af5OaGU/COgreQh1mRbKiUI64draT2NN34uk+PALFY8=
 github.com/robfig/cron v1.2.0 h1:ZjScXvvxeQ63Dbyxy76Fj3AT3Ut0aKsyd2/tl3DTMuQ=

pkg/auth/globalrole_test.go

@@ -153,7 +153,7 @@ func TestGlobalRulesFromRole(t *testing.T) {
 			if test.stateSetup != nil {
 				test.stateSetup(state)
 			}
-			grResolver := auth.NewGlobalRoleResolver(auth.NewRoleTemplateResolver(state.rtCacheMock, nil), nil)
+			grResolver := auth.NewGlobalRoleResolver(auth.NewRoleTemplateResolver(state.rtCacheMock, nil, nil), nil)
 			rules := grResolver.GlobalRulesFromRole(test.globalRole)
 
 			require.Len(t, rules, len(test.wantRules))
@@ -264,7 +264,7 @@ func TestClusterRulesFromRole(t *testing.T) {
 			if test.stateSetup != nil {
 				test.stateSetup(state)
 			}
-			grResolver := auth.NewGlobalRoleResolver(auth.NewRoleTemplateResolver(state.rtCacheMock, nil), nil)
+			grResolver := auth.NewGlobalRoleResolver(auth.NewRoleTemplateResolver(state.rtCacheMock, nil, nil), nil)
 			rules, err := grResolver.ClusterRulesFromRole(test.globalRole)
 			if test.wantErr {
 				require.Error(t, err)
@@ -337,7 +337,7 @@ func TestGetRoleTemplatesForGlobalRole(t *testing.T) {
 			if test.stateSetup != nil {
 				test.stateSetup(state)
 			}
-			grResolver := auth.NewGlobalRoleResolver(auth.NewRoleTemplateResolver(state.rtCacheMock, nil), nil)
+			grResolver := auth.NewGlobalRoleResolver(auth.NewRoleTemplateResolver(state.rtCacheMock, nil, nil), nil)
 			roleTemplates, err := grResolver.GetRoleTemplatesForGlobalRole(test.globalRole)
 			if test.wantErr {
 				require.Error(t, err)

pkg/auth/roleTemplate.go

@@ -9,17 +9,21 @@ import (
 	rbacv1 "k8s.io/api/rbac/v1"
 )
 
+const ExternalRulesFeature = "external-rules"
+
 // RoleTemplateResolver provides an interface to flatten role templates into slice of rules.
 type RoleTemplateResolver struct {
 	roleTemplates v3.RoleTemplateCache
 	clusterRoles  v1.ClusterRoleCache
+	features      v3.FeatureCache
 }
 
 // NewRoleTemplateResolver creates a newly allocated RoleTemplateResolver from the provided caches
-func NewRoleTemplateResolver(roleTemplates v3.RoleTemplateCache, clusterRoles v1.ClusterRoleCache) *RoleTemplateResolver {
+func NewRoleTemplateResolver(roleTemplates v3.RoleTemplateCache, clusterRoles v1.ClusterRoleCache, features v3.FeatureCache) *RoleTemplateResolver {
 	return &RoleTemplateResolver{
 		roleTemplates: roleTemplates,
 		clusterRoles:  clusterRoles,
+		features:      features,
 	}
 }
 
@@ -58,12 +62,29 @@ func (r *RoleTemplateResolver) RulesFromTemplate(roleTemplate *rancherv3.RoleTem
 func (r *RoleTemplateResolver) gatherRules(roleTemplate *rancherv3.RoleTemplate, rules []rbacv1.PolicyRule, seen map[string]bool) ([]rbacv1.PolicyRule, error) {
 	seen[roleTemplate.Name] = true
 
-	if roleTemplate.External && roleTemplate.Context == "cluster" {
-		cr, err := r.clusterRoles.Get(roleTemplate.Name)
+	if roleTemplate.External {
+		externalRulesEnabled, err := r.isExternalRulesFeatureFlagEnabled()
 		if err != nil {
-			return nil, fmt.Errorf("failed to get clusterRoles '%s': %w", roleTemplate.Name, err)
+			return nil, fmt.Errorf("failed to check externalRules feature flag: %w", err)
+		}
+
+		if externalRulesEnabled {
+			if roleTemplate.ExternalRules != nil {
+				rules = append(rules, roleTemplate.ExternalRules...)
+			} else {
+				cr, err := r.clusterRoles.Get(roleTemplate.Name)
+				if err != nil {
+					return nil, fmt.Errorf("for external RoleTemplates, externalRules must be provided or a backing clusterRole must be installed to check for privilege escalations: failed to get ClusterRole %q: %w", roleTemplate.Name, err)
+				}
+				rules = append(rules, cr.Rules...)
+			}
+		} else if roleTemplate.Context == "cluster" {
+			cr, err := r.clusterRoles.Get(roleTemplate.Name)
+			if err != nil {
+				return nil, fmt.Errorf("failed to get ClusterRole %q: %w", roleTemplate.Name, err)
+			}
+			rules = append(rules, cr.Rules...)
 		}
-		rules = append(rules, cr.Rules...)
 	}
 
 	rules = append(rules, roleTemplate.Rules...)
@@ -84,3 +105,14 @@ func (r *RoleTemplateResolver) gatherRules(roleTemplate *rancherv3.RoleTemplate,
 	}
 	return rules, nil
 }
+
+func (r *RoleTemplateResolver) isExternalRulesFeatureFlagEnabled() (bool, error) {
+	f, err := r.features.Get(ExternalRulesFeature)
+	if err != nil {
+		return false, err
+	}
+	if f.Spec.Value == nil {
+		return f.Status.Default, nil
+	}
+	return *f.Spec.Value, nil
+}