LeChatP/RootAsRole

Invalid Role generation with AddRole

LeChatP opened this issue · 5 comments

LeChatP commented

Issue

When creating a role with insufficient parameters (no users/groups), the role created is incorrect.

Command

addrole test cap_dac_override -c ls

Result

<role name="test">
      <capabilities>
        <capability>cap_sys_admin</capability>
      </capabilities>
      <commands>
        <command>ls</command>
      </commands>
</role>

Expected Result

An error, Respecting the DTD, role must have actor to have command.

SamerW commented

We need to block this operation, because roles must be assigned to users and/or groups.

  • 👍1
LeChatP commented

Globally, addrole don't respect DTD at all.

SamerW commented

I think we need to revise the code of role manager tools.

LeChatP commented

d596b19 Not completely tested fix

LeChatP commented

is no longer relevant