Uploaded image for project: 'OpenShift Request For Enhancement'
  1. OpenShift Request For Enhancement
  2. RFE-6754

Restrict excessive permissions in the basic-users ClusterRoleBinding to prevent unauthorized access to ClusterRoles.

XMLWordPrintable

    • Improvement
    • False
    • None
    • False
    • Not Selected

      1. Proposed title of this feature request : Restrict Excessive Permissions Granted by the basic-users ClusterRoleBinding

      2. What is the nature and description of the request? : The basic-users ClusterRoleBinding currently provides normal users with excessive permissions, including the ability to execute oc get clusterroles. This exposes sensitive role configurations and permissions that should remain restricted to administrators or specific user groups. The request is to modify or redesign the basic-users ClusterRoleBinding to ensure it grants only the minimum necessary permissions for regular users without exposing cluster-wide resources like ClusterRoles.

      3. Why does the customer need this? (List the business requirements here) : 

      • Prevent Unauthorized Access:
        Restrict normal users from viewing ClusterRoles to ensure sensitive role configurations remain private.
      • Reduce Security Risks:
        Limiting access minimizes the potential for exploitation of exposed roles and permissions by unauthorized users.
      • Enhance Compliance:
        Ensures the cluster adheres to security best practices and regulatory requirements by implementing the principle of least privilege.
      • Maintain Operational Integrity:
        Prevents users from gaining insights into roles that could be used to craft targeted attacks or circumvent security policies.

      4. List any affected packages or components.

      • RBAC (Role-Based Access Control):
        Specifically, the basic-users ClusterRoleBinding and its associated ClusterRole.
      • ClusterRoleBinding Configuration Management
        Any system or automation process that relies on the basic-users ClusterRoleBinding.
      • OpenShift CLI (oc):
        Commands such as oc get clusterroles and oc get clusterrolebindings are directly affected.

              atelang@redhat.com Anjali Telang
              rhn-support-vismishr Vishvranjan Mishra
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated: