From bab140a3f93ae2cff74677d25869d7bcc5b62806 Mon Sep 17 00:00:00 2001 From: Denis Arh Date: Sun, 24 Jul 2022 11:45:29 +0200 Subject: [PATCH] Skip contextual roles when doing RBAC trace on wildcard resource --- pkg/rbac/roles.go | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/pkg/rbac/roles.go b/pkg/rbac/roles.go index 77f9c8e38..32f33345f 100644 --- a/pkg/rbac/roles.go +++ b/pkg/rbac/roles.go @@ -159,6 +159,17 @@ func getContextRoles(s Session, res Resource, preloadedRoles []*Role) (out partR for _, r := range preloadedRoles { if r.kind == ContextRole { + if hasWildcards(res.RbacResource()) { + // if resource has wildcards, we can't use it for contextual role evaluation + // + // this exception causes RBAC trace requests that can have wildcard + // resources to ignore this role + // + // without skipping contextual roles like this + // check function on role is highly likely to fail to evaluate properly + continue + } + if len(r.crtypes) == 0 || !r.crtypes[ResourceType(res.RbacResource())] { // resource type not compatible with this contextual role continue