Enforce manager EthernetInterface privileges
EthernetInterface resources under a Manager use the base EthernetInterface privileges, which require ConfigureComponents for PATCH and DELETE. The privilege registry defines a subordinate override requiring ConfigureManager when an EthernetInterface is subordinate to a Manager, but no route used it. An Operator, who holds ConfigureComponents, could therefore change and delete BMC network addresses. user-management.md states that an Operator is not allowed to change network configuration. The SubOverManager constants have been generated by parse_registries.py since fff6a4d3, but were never referenced. Point the following routes at them: POST /redfish/v1/Managers/<id>/EthernetInterfaces PATCH /redfish/v1/Managers/<id>/EthernetInterfaces/<id> DELETE /redfish/v1/Managers/<id>/EthernetInterfaces/<id> Compatibility: this is a visible change for Operator accounts, which now receive 403 rather than performing the operation. Administrator accounts are unaffected. The change is intentional and brings bmcweb in line with the privilege registry and user-management.md. Tested: Builds clean on master. Behavior verified on a downstream tree carrying this change, on a QEMU BMC with a local Operator account: POST /redfish/v1/Managers/bmc/EthernetInterfaces -> 403 PATCH /redfish/v1/Managers/bmc/EthernetInterfaces/eth0 -> 403 DELETE /redfish/v1/Managers/bmc/EthernetInterfaces/eth0 -> 403 GET /redfish/v1/Managers/bmc/EthernetInterfaces/eth0 -> 200 As Administrator, PATCH returns 204 and GET returns 200, both unchanged from before the patch. Fixes: https://github.com/openbmc/bmcweb/issues/284 Change-Id: Ic703956a1c3ae9e469589a713e3b2b69c2cb3f23 Signed-off-by: Sathiyaseelan Lakshminarayanan <sathiyaseelan_l@jabil.com>
S
Sathiyaseelan Lakshminarayanan committed
a22a949514a82d954a575933d669bc7526f645c5
Parent: a47c650