Fix RBAC tracing issue - handling wildcarded resources

pkg/rbac/resource.go

@@ -64,10 +64,10 @@ func ResourceComponent(r string) string {
 	}
 }
 
+// match returns true if the given resource matches the given pattern
 func matchResource(matcher, resource string) (m bool) {
 	if matcher == resource {
-		// if resources match make sure no wildcards are resent
-		return !hasWildcards(resource)
+		return true
 	}
 
 	m, _ = path.Match(matcher, resource)

pkg/rbac/resource_test.go

@@ -73,11 +73,11 @@ func TestResourceMatch(t *testing.T) {
 }
 
 //cpu: Intel(R) Core(TM) i9-9980HK CPU @ 2.40GHz
-//Benchmark_MatchResource100-16        	 7353837	       157.0 ns/op
-//Benchmark_MatchResource1000-16       	 6868928	       166.0 ns/op
-//Benchmark_MatchResource10000-16      	 7373701	       164.8 ns/op
-//Benchmark_MatchResource100000-16     	 7556944	       156.5 ns/op
-//Benchmark_MatchResource1000000-16    	 7445456	       157.8 ns/op
+//Benchmark_MatchResource100-16        	 6527383	       183.2 ns/op
+//Benchmark_MatchResource1000-16       	 6335626	       183.5 ns/op
+//Benchmark_MatchResource10000-16      	 6565214	       183.5 ns/op
+//Benchmark_MatchResource100000-16     	 6541002	       183.7 ns/op
+//Benchmark_MatchResource1000000-16    	 6542052	       183.5 ns/op
 func benchmarkMatchResource(b *testing.B, c int) {
 	b.StartTimer()
 

pkg/rbac/service.go

@@ -97,6 +97,11 @@ func (svc *service) Check(ses Session, op string, res Resource) (a Access) {
 		fRoles = getContextRoles(ses, res, svc.roles)
 	)
 
+	if hasWildcards(res.RbacResource()) {
+		// prevent use of wildcard resources for checking permissions
+		return Inherit
+	}
+
 	a = check(svc.indexed, fRoles, op, res.RbacResource(), nil)
 
 	svc.logger.Debug(a.String()+" "+op+" for "+res.RbacResource(),