GitLab Secure Stage, 1 Aug 2019

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Secure Brown Bag Sessions: Rails Policies and Permissions

Description

In this video, we discuss how permissions are implemented in GitLab codebase and what policies we use for Secure features.

https://gitlab.com/gitlab-org/security-products/brown-bag-sessions/issues/1

A

Let's start so today we are going to talk about rails policies and permission. So, let's start so all the policies in github code base are using declarative policy framework. So this framework was written inside of the Key Club and the code base. You will find in declarative poll. Sleep declarative, pools, folder, but it looks very close to bandit and for a few days, I was working with permission. I was actually confused, set a sexual punted, not declarative policy.

A

So basically, the most important in this framework is class ability and it's methods allowed which allows us to check if you don't have an ability to see some object or interact with some object. We usually use these methods implicitly in the for action. Filters like authorized happen and the methods can. Maybe you see this in controller somewhere. It's actually cool inside this ability allowed method. So all the policy.

A

So when actually the ability logged is triggered, it's create a copy of some policy and use its rules to check some permission and you can find all the policies inside of a policies or E or Enterprise a policies folder.

A

So, let's take a look on the policy class, so here we have some conditions with actually basically are some block of gods.

A

We can execute later and look have some condition for a room and actually rules which identify if we have an access to some object, if we have a permission so, for example, in its actually parts of real project policy- and we have run a profit, for example, condition for a developer, so team access level adjust some helper methods provided by project policy and the other one as a condition is checked early checking if this project have available feature for security dashboard.

A

So in this case, in the case of project policy class, the subject is actually our in our case, it's project so, and you, if you want, you, can just create a few rules which actually prevent, for example, some builds that happen or enable it, and it's not it's quite easy to write it, but sometimes not very easy to find out which actually how permissions works, because you can like find in the code just one room and maybe don't find another one.

A

So you should be careful with everything so for all the security features to reuse a few different rules. Most of them are grouped inside of the project policy and have another one in the group policy. So let's dig in and talk about all the different policies, one by mine, so the first punch its rules for read security dashboard. So what everyone knows is this feature, so you can have group or project that part and to have an access to it. You have.

A

The feature should be available and user should have at least and the developer axis, and let's talk a little bit more about each available method, so it's implemented on project and namespace or group, and you can actually so we have the same condition in both project policy and group policy. So it's basically checking if it's implicitly checking to things that this feature is licensed it.

A

So, for example, if we're talking about security, ports is licensed it in ultimate and in gold license and actually, if this feature is available, so we don't have this settings for secret security ports, but we have like such settings, for example, for met.

A

Request or pipelines, and you can check it in the settings settings if you want this feature for purchase or not, and this method feature available, it's actually the chicken was those links so for we have a bunch of policies for a separate software license policies, and you can be using these permissions for public API and for license compliance page as far as I know, so as well as they chicken. If we have this feature available and user, have an access to the project completed or have maintainer access for, providing some create, delete, admin actions.

A

Next is dependency least publicly pay. So we have this feature dependency list which actually showing users what dependency we have this project and we have publicly paid for this feature so because user can, if you choose it, you can see the repository user can see all the dependencies. So that's why we need to put this fee for this rule. We need to check if the feature obviously features available and user. Can it's not it's kind of tricky user can't download code, so we should basically check and see. Is that user can read the repository, but.

A

Historically, read repository is actually their rule, can download code so I, don't remember how I truly find it but flex it next. One is their permission, for a read depends the listview and right now it have the same access level as security, but just for now and to be I guess will be changed in near future, because, right now the pencil list page shows us different different information dependencies. It's variabilities licenses, so obviously it could.

A

Users, like you, have to check different things and right now. This policy is that you cut taxes. You have to have an access to security dashboard. It's.

B

A

Prevent some user flow from this page and it's not like what we want. So the access for the space should be more window and.

A

Some actions for manage vulnerability feedback, so we will review feedback. If you know this, like the actions that you, if you see, if you develop your latest violence, you can dismiss it or write. Some message give the feedback, so we as far as I, know right now.

A

We using use this only for we have this fun in security, delbert, so user, because put is the same rule as for security dashboard, so user has to help at least developer access to perform such actions and just one slide breaks break because we are heading for a last permission and it's the most shortest one.

A

So this permission allows us to read full mobility feedback and the wish of this information is in different places. What I found in the code base right now is that it is shown only on the merge request, a widget, but as far as you remember previously, we shall we show our ability, feedback, condemn pipelines, view I, guess somewhat were changed or it'll be added in the future. So we have the rules that user can have to read the project or have an access like can with merge, request or read bills.

A

So look again, we want to show will rebuild a feedback. The users who actually can read the project happen access to the code base, but there is situation when users can have an access.

A

Don't have an access to the project but say actually like don't help, but we don't like. We don't need an access, the whole project. We are interested only in few parts like merge, request and pipelines and because in settings we have different lot of different settings. So we actually have to check all this possible cases because we have different situation, for example, so we can check different access levels for a merge request and pipelines.

A

So, for example, if you go to the Settings General in on the project menu, we can go to the repository tap and can see that you can check different access level for much requested pipelines and purpose it. You as well so for a private project, is kind of very simple, because only user who have an access to the project can have an access to positive image requests in pipelines, but for public and for internal projects.

A

You can just like check all the different kinds of access and as well, you can just press out and make this feature unavailable. It's not like all of it. There is another part of settings, says D part when we have check for public pipelines, so this public pipelines Seton's allows users like not authorized its users to see your pipelines and it's kind of contradict with the settings for our pipelines, so actually how it works.

A

If you check public pipelines and you allow pipelines for everyone within access on the general tab, Doozers mm, without some taxes will have an access to the project. So actually it's works like and room, and if we go for like this condition, so a user have can be able to read bills and this route built is. This rule actually implement all this logic. So it's actually a check if pipelines I our public and access to the pipeline's are set for everyone.

A

Yeah, so if you interesting how all the settings for a project a Stewart, you can go to the project feature model and it's table project features and you can see all the access level values that are stored for per project. For example, I checked I like crazy snippet and we can see an access level for builds and Midwest and yeah builds and pipelines are the same. So in the code we have bills, but in the UI we have right now my plans everywhere.

A

So what challenges that we have to solve in future? So we have to create monkey granule access for our components because, as I said, for example, for dependency lists, page different users like we have a lot of different informations and all this information should be accessible by different rules because like if you are a developer and not interested in vulnerabilities, maybe you can see the buncee list, but you shouldn't see the motor abilities and works it.

A

So this components could be used in different places with different access level like vulnerability feedback, and all these rules should incorporate different factors like project visibility like the enable licenses.

A

The feature is enabled or not and so on, so this is what I have for you. So if we have some questions, let's talk about it.

C

Yeah I'm always confused like because we have the future flag as well, and they also named as GPS right. And how do you discriminate like between those three so.

A

We actually have licenses feature lessons it like we have licenses and in licenses we have an access to like we have lists of different picture features yeah. So this was like provided to the users.

C

A

C

A

In this case, I did that I choose to the wrong Court, because I like when I was like saying the feature like depends the least or security data port. So it's actually, it could have the same like the flag in licenses, but who do not it's pretty different.

D

I have a question as well, so in some of the slides, the that claims checks were always against a user. So the context is a user. Are their claims checks that are done in the context for an unauthenticated user.

A

mmm Yeah, so you can actually given you, don't if you don't, if you just want to check that, for example, there, for example, the rule for licenses feature. So if we have project and it's, for example, it's public and we don't care about the user like we just want to check. If the feature is available for a project and.

D

Then you can do we have to then explicitly skip the claim check for the user, or is it implied that all unauthenticated users would be able to have like say like read project depending on the I guess, inheritance of the policy? So if project is public and there's no user, that's Afeni kated. Do the permissions, then sort of say: okay, there unauthenticated, but the project sort of scope says that anybody can read this. So therefore they do ask the claim check.

A

Frankly, I don't know the answer for this question, so we can actually- and so it's basically question. If, with this method allowed, we can can like accept their rules out user, so I guess it can be so, but I I can start I can actually, after this call, I'll write the question down to say this and I'll find a sore inside them say it's a good place. So I can just check the code because I forgot for security features. Actually we all all of them.

A

We have to be authorized so I didn't like found any situation. I didn't broke associations. Okay, thank you. It's quite interesting. The question.

A

Any question the question: I'm.

B

Just gonna comment: I think I meant I, remember it. Maybe in the retro you mentioned that the policies or the permissions are quite confusing. Is there? Is there any kind of I haven't take a look at them, but is there thoughts that, maybe you know refactoring a you know have that how that works or is it kind of like this is how it is it has to. You know, stick with that.

A

So actually sexually I was working for, like the last policies at the show deal, their feedback I was working with it for last once or maybe two and it's like it's look very small one, but when you're like when you need to dig up and find out what actually this is supposed and we have to actually fight like have an Excel, so read an axis for a magic West and so on its became confusion and I, don't see how we can factor it, because it's much it's like favor framework.

A

So if you want your factor to have to factor it Emerson but like after you dig up a little, its became very easy to work with. So maybe in such sessions can like allow us to spread knowledge, and maybe this is featuring easy for everyone, like our current problems,.

B

There's a big learning curve we kind of got to get over and yeah.

A

And like our biggest problem right now, is it as far as I understand was he have the same situation, which is his issue with permissions? So we like, if we have a lot of settings and we need to check all the elements. So if you want to show our abilities in different places, we have to make sure that users have an access to this place and because we have different access level for projects, we have different access them for users. So it's like.

A

We have different settings for a crow and merge request or not so it's a game quite difficult and error-prone. I.

D

Think that first slide with the code sort of indicates that we we use, look at claims based access control and then the roles that we have have are derived based on each of like a grouping a claim.

D

So if you've got these claims, then you are in this role, so the claims based access control is it's easy to extend because you can add new claims without having to worry about going back and updating all the other parts of the app versus like a role based access control, where you have to decide whether or not which roles get access to this page and then have to go update.

D

So it's the DSL itself looks like a little bit complicated, but I think if we just think about in terms of like verifying like that second slide, you had or that first slide with the code like. Can this user perform this action against this resource? Do they have that claim? I, think that simplifies it, but the implementation is probably the complicated part yeah.

A

So, actually, if you want to interested in how the actual is frameworks, so in the on the first slide, I have a link for a correspondent, get llama documentation and there is a lot of very interesting information there. So if you interested and go there.

D

Great talk, thank you so much for covering this yeah.

A

I hope it helps for anyone, because actually it was kind of a pain I could take in it in the first place. Taking my.

D

Bad, so thank you for being our first person in there.

B

Saving the path for us, it's a good introduction for me at least I know who to speak to if I need to your ass anything about permissions. I'm sure you're excited to hear that you're, the go-to person.

A

So like so, it's like when you started say it sucks you're, like basically for a few first days, I was using punted the confrontation, because this looks the same in the 12 section, and this is the discovered something else is.

B

Is there a big comment in the codebase now saying this is not pundit? This is you know, format.

D

Believe the gen we're using is called six which was developed internally and then open source. So six isn't Jim.

D

Yes, s, IX I believe this is what we're using, which looks a lot like an can or pundit one of the two policy classes.

A

Funded but actually we have like in the declarative framework holder, we can actually see the code. Please.

D

Double check what I said, because I am super new.

A

It's quite old, so last commit was on March 2 yeah. Maybe it's like come. Oh okay, I'll check it two boxes so good. Take two months. All right. If you like last questions, is the last comment. Oh.

D

This may be old, sorry that we may not be using that I'm. Sorry, I, don't know where I saw that, but I don't see it in the gem file. Now.

A

Alright, okay, so thank you. Okay,.

B

Thank you. Thank you see you guys, thank you and.

D

Thanks for staying up late for us, oh it's.

A