Adding privilege checks on user and account operations

Co-authored-by: Harikrishna <[email protected]>

Author: 2 people

api/src/main/java/com/cloud/user/Account.java

@@ -71,6 +71,7 @@ public static Type getFromValue(Integer type){
     }
 
     public static final long ACCOUNT_ID_SYSTEM = 1;
+    public static final long ACCOUNT_ID_ADMIN = 2;
 
     public String getAccountName();
 

plugins/network-elements/juniper-contrail/src/test/java/org/apache/cloudstack/network/contrail/management/MockAccountManager.java

@@ -521,4 +521,8 @@ public ConfigKey<?>[] getConfigKeys() {
     public UserAccount clearUserTwoFactorAuthenticationInSetupStateOnLogin(UserAccount user) {
         return null;
     }
+
+    @Override
+    public void verifyCallerPrivilegeForUserOrAccountOperations(Account userAccount) {
+    }
 }

server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java

@@ -47,11 +47,13 @@
 
 
 import com.cloud.hypervisor.HypervisorGuru;
+import com.cloud.user.AccountManagerImpl;
 import com.cloud.utils.crypt.DBEncryptionUtil;
 import com.cloud.host.HostTagVO;
 import com.cloud.storage.StoragePoolTagVO;
 import com.cloud.storage.VolumeApiServiceImpl;
 import com.googlecode.ipv6.IPv6Address;
+import org.apache.cloudstack.acl.RoleType;
 import org.apache.cloudstack.acl.SecurityChecker;
 import org.apache.cloudstack.affinity.AffinityGroup;
 import org.apache.cloudstack.affinity.AffinityGroupService;
@@ -470,6 +472,7 @@ public class ConfigurationManagerImpl extends ManagerBase implements Configurati
     private long _defaultPageSize = Long.parseLong(Config.DefaultPageSize.getDefaultValue());
     private static final String DOMAIN_NAME_PATTERN = "^((?!-)[A-Za-z0-9-]{1,63}(?<!-)\\.)+[A-Za-z]{1,63}$";
     private Set<String> configValuesForValidation = new HashSet<String>();
+    private Set<String> configKeysAllowedOnlyForDefaultAdmin = new HashSet<String>();
     private Set<String> weightBasedParametersForValidation = new HashSet<String>();
     private Set<String> overprovisioningFactorsForValidation = new HashSet<String>();
 
@@ -533,6 +536,7 @@ public boolean configure(final String name, final Map<String, Object> params) th
         populateConfigValuesForValidationSet();
         weightBasedParametersForValidation();
         overProvisioningFactorsForValidation();
+        populateConfigKeysAllowedOnlyForDefaultAdmin();
         initMessageBusListener();
         return true;
     }
@@ -596,6 +600,11 @@ private void overProvisioningFactorsForValidation() {
         overprovisioningFactorsForValidation.add(CapacityManager.StorageOverprovisioningFactor.key());
     }
 
+    protected void populateConfigKeysAllowedOnlyForDefaultAdmin() {
+        configKeysAllowedOnlyForDefaultAdmin.add(AccountManagerImpl.listOfRoleTypesAllowedForOperationsOfSameRoleType.key());
+        configKeysAllowedOnlyForDefaultAdmin.add(AccountManagerImpl.allowOperationsOnUsersInSameAccount.key());
+    }
+
     private void initMessageBusListener() {
         messageBus.subscribe(EventTypes.EVENT_CONFIGURATION_VALUE_EDIT, new MessageSubscriber() {
             @Override
@@ -1183,6 +1192,7 @@ protected String validateConfigurationValue(final String name, String value, fin
             s_logger.error("Missing configuration variable " + name + " in configuration table");
             return "Invalid configuration variable.";
         }
+        validateConfigurationAllowedOnlyForDefaultAdmin(name, value);
 
         final String configScope = cfg.getScope();
         if (scope != null) {
@@ -1347,6 +1357,33 @@ protected String validateConfigurationValue(final String name, String value, fin
         return String.format("Invalid value for configuration [%s].", name);
     }
 
+    protected void validateConfigurationAllowedOnlyForDefaultAdmin(String configName, String value) {
+        if (configKeysAllowedOnlyForDefaultAdmin.contains(configName)) {
+            final Long userId = CallContext.current().getCallingUserId();
+            if (userId != User.UID_ADMIN) {
+                throw new CloudRuntimeException("Only default admin is allowed to change this setting");
+            }
+
+            if (AccountManagerImpl.listOfRoleTypesAllowedForOperationsOfSameRoleType.key().equals(configName)) {
+                if (value != null && !value.isBlank()) {
+                    List<String> validRoleTypes = Arrays.stream(RoleType.values())
+                            .map(Enum::name)
+                            .collect(Collectors.toList());
+
+                    boolean allValid = Arrays.stream(value.split(","))
+                            .map(String::trim)
+                            .allMatch(validRoleTypes::contains);
+
+                    if (!allValid) {
+                        throw new CloudRuntimeException("Invalid role types provided in value");
+                    }
+                } else {
+                    throw new CloudRuntimeException("Value for role types must not be empty");
+                }
+            }
+        }
+    }
+
     /**
      * A valid value should be an integer between min and max (the values from the range).
      */

server/src/main/java/com/cloud/resourcelimit/ResourceLimitManagerImpl.java

@@ -784,6 +784,7 @@ public ResourceLimitVO updateResourceLimit(Long accountId, Long domainId, Intege
             } else {
                 _accountMgr.checkAccess(caller, null, true, account);
             }
+            _accountMgr.verifyCallerPrivilegeForUserOrAccountOperations(account);
 
             ownerType = ResourceOwnerType.Account;
             ownerId = accountId;
@@ -853,6 +854,11 @@ public List<ResourceCountVO> recalculateResourceCount(Long accountId, Long domai
             throw new InvalidParameterValueException("Please specify a valid domain ID.");
         }
         _accountMgr.checkAccess(callerAccount, domain);
+        Account account = _entityMgr.findById(Account.class, accountId);
+        if (account == null) {
+            throw new InvalidParameterValueException("Unable to find account " + accountId);
+        }
+        _accountMgr.verifyCallerPrivilegeForUserOrAccountOperations(account);
 
         if (resourceType != null) {
             resourceTypes.add(resourceType);

server/src/main/java/com/cloud/user/AccountManager.java

@@ -200,4 +200,5 @@ void buildACLViewSearchCriteria(SearchCriteria<? extends ControlledViewEntity> s
 
     UserAccount clearUserTwoFactorAuthenticationInSetupStateOnLogin(UserAccount user);
 
+    void verifyCallerPrivilegeForUserOrAccountOperations(Account userAccount);
 }