jbonofre opened a new pull request, #2884: URL: https://github.com/apache/karaf/pull/2884
## Summary Backport of #2883 to `karaf-4.4.x`. - `feature:repo-add -i <url>` and `feature:repo-remove -u <url>` call `FeaturesServiceImpl.addRepository()`/`removeRepository()` with the install/uninstall flag set, which installs (and starts) or uninstalls every feature in the given repository. - Neither `repo-add` nor `repo-remove` had an entry in the `feature` scope's command ACL, so any SSH user holding only the `viewer` role could reach them and have Karaf install/start an arbitrary attacker-supplied features repository — bypassing the admin-only ACL already enforced on `feature:install`/`feature:uninstall`. - Adds option-specific ACL rules, mirroring the existing pattern used for `bundle:refresh -f` and similar bundle-scope commands: only the `-i`/`-u` option variants now require `admin`; plain `repo-add`/`repo-remove` (which don't install/uninstall anything) remain open as before, so there's no behavior change beyond closing the escalation path. - Applied identically in the three places the `feature` ACL is defined on this branch: the standard assembly `feature.xml`, the `instance` `etc` template, and the itest config fixture. - Adds a regression test (`FeatureSshCommandSecurityTest#testFeatureRepoCommandSecurityViaSsh`) exercising the ACL boundary for both a viewer and an admin user, using a non-existent repository URL so nothing is actually installed/removed. ## Test plan - [x] `mvn -pl itests/test test-compile` passes - [ ] Full PaxExam SSH itest suite (`itests/test`) run in CI -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
