jbonofre opened a new pull request, #2862:
URL: https://github.com/apache/karaf/pull/2862
Backport of #2861 to `karaf-4.4.x`.
## Problem
`config:install <url> <finalname>` downloads a file from an arbitrary URL
and writes it into `${karaf.etc}` (the `-o`/`--override` option lets it
overwrite an existing file). That folder also holds `users.properties`,
`keys.properties`, `host.key` and every `org.apache.karaf.*.acl.*` file.
The command has **no entry** in `org.apache.karaf.command.acl.config`.
`SecuredSessionFactoryImpl.checkSecurity()` treats an unmatched command as
allowed (`Specificity.NO_MATCH` → `passCheck = true`), and
`karaf.secured.command.compulsory.roles` ships commented out, so **any
authenticated shell/SSH user** — including a `viewer` — can run
`config:install` and overwrite, for example, the command ACL files or
`users.properties`.
By contrast `bundle:install`, `feature:install` and `kar:install` are all
`admin`-only in their own ACLs, and `config:delete` is `admin` in this same ACL.
## Fix
Add `install = admin` to the `config` command ACL, in both shipped locations:
- `assemblies/features/standard/src/main/feature/feature.xml` (`<config>`
block)
- `instance/.../etc/org.apache.karaf.command.acl.config.cfg` (instance
template)
and to the itest etc fixture
(`itests/test/src/test/filtered-resources/etc/feature.xml`).
## Test
`ConfigSshCommandSecurityTest#testConfigInstallCommandSecurityViaSsh` — a
`viewer` and a `manager` get `Command not found`; an `admin` can run it.
## Note
The underlying fail-open behaviour (unmatched command → allowed, with
`karaf.secured.command.compulsory.roles` disabled by default) is a broader
hardening question tracked separately; this PR only closes the `config:install`
gap.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
