filtering of roles to ones from the owning account should be done in libmahi, not in muskie/marlin

[arekinath]

Currently we have a situation where muskie is partially responsible for filtering roles (in the case of default roles especially) based on their associated account, and mahi is partially responsible for it as well (with the check on the admin role).

We should make libmahi entirely responsible for this check, which would also fix up issues with job authcontexts and xacct roles.

[arekinath]

Sadly, changing to this mode of operation means that older marlin images (i.e. if you update muskie but don't update marlin) will authorize using rules from roles that aren't on the account that owns a particular object. This is very bad, because it means you can set up a role on a account B with account A as a member that authorizes can getobject *, but then have it apply for inputs to a job that are owned by account C. This is basically an arbitrary read for manta.

To avoid this, we will have muskie put two different arrays of activeRoles in the token: activeRoles contains only roles owned by the resource owner, and activeXAcctRoles contains all other roles. This way only an updated marlin (with a new node-mahi) will process the activeXAcctRoles, which knows to check whether the role account matches.

[arekinath]

So far the ps#2 version of these I've run in coal, and now tested in prod at UQ.

• Hot-patched into muskie zone, verified:
  • Account acting on own object
  • Sub-user acting on account's objects authorised by role
  • Account acting on a different account's object authorised by default administrator role
  • Account acting on a different account's object authorised by non-administrator non-default role
• After verifying with mls, then verified with mlogin as well, to make sure it behaves identically