Method customRoleEscalationCheck

coderd/database/dbauthz/dbauthz.go:1403–1424

customRoleEscalationCheck checks to make sure the caller has every permission they are adding to a custom role. This prevents permission escalation.

(ctx context.Context, actor rbac.Subject, perm rbac.Permission, object rbac.Object)

// customRoleEscalationCheck checks to make sure the caller has every permission they are adding
// to a custom role. This prevents permission escalation.
func (q *querier) customRoleEscalationCheck(ctx context.Context, actor rbac.Subject, perm rbac.Permission, object rbac.Object) error {
	if perm.Negate {
		// Users do not need negative permissions. We can include it later if required.
		return xerrors.Errorf("invalid permission for action=%q type=%q, no negative permissions", perm.Action, perm.ResourceType)
	}

	if perm.Action == policy.WildcardSymbol || perm.ResourceType == policy.WildcardSymbol {
		// It is possible to check for supersets with wildcards, but wildcards can also
		// include resources and actions that do not exist today. Custom roles should only be allowed
		// to include permissions for existing resources.
		return xerrors.Errorf("invalid permission for action=%q type=%q, no wildcard symbols", perm.Action, perm.ResourceType)
	}

	object.Type = perm.ResourceType
	if err := q.auth.Authorize(ctx, actor, perm.Action, object); err != nil {
		// This is a forbidden error, but we can provide more context. Since the user can create a role, just not
		// with this perm.
		return xerrors.Errorf("invalid permission for action=%q type=%q, not allowed to grant this permission", perm.Action, perm.ResourceType)
	}

	return nil
}

// customRoleCheck will validate a custom role for inserting or updating.
// If the role is not valid, an error will be returned.