Protect workspace execution

Emyrk · Emyrk · commit 30338b41a874 · 2022-08-12T14:21:19.000-05:00
diff --git a/coderd/database/modelmethods.go b/coderd/database/modelmethods.go
@@ -17,6 +17,10 @@ func (w Workspace) RBACObject() rbac.Object {
 	return rbac.ResourceWorkspace.InOrg(w.OrganizationID).WithOwner(w.OwnerID.String())
 }
 
+func (w Workspace) ExecutionRBAC() rbac.Object {
+	return rbac.ResourceWorkspaceExecution.InOrg(w.OrganizationID).WithOwner(w.OwnerID.String())
+}
+
 func (m OrganizationMember) RBACObject() rbac.Object {
 	return rbac.ResourceOrganizationMember.InOrg(m.OrganizationID)
 }
diff --git a/coderd/roles_test.go b/coderd/roles_test.go
@@ -120,7 +120,7 @@ func TestListRoles(t *testing.T) {
 	require.NoError(t, err, "create org")
 
 	const forbidden = "Forbidden"
-	siteRoles := convertRoles(rbac.RoleAdmin(), "auditor", "template-manager")
+	siteRoles := convertRoles(rbac.RoleAdmin(), "auditor", "template-admin", "user-admin")
 	orgRoles := convertRoles(rbac.RoleOrgAdmin(admin.OrganizationID))
 
 	testCases := []struct {
diff --git a/coderd/workspaceagents.go b/coderd/workspaceagents.go
@@ -70,7 +70,7 @@ func (api *API) workspaceAgentDial(rw http.ResponseWriter, r *http.Request) {
 
 	workspaceAgent := httpmw.WorkspaceAgentParam(r)
 	workspace := httpmw.WorkspaceParam(r)
-	if !api.Authorize(r, rbac.ActionUpdate, workspace) {
+	if !api.Authorize(r, rbac.ActionUpdate, workspace.ExecutionRBAC()) {
 		httpapi.ResourceNotFound(rw)
 		return
 	}
@@ -304,6 +304,12 @@ func (api *API) workspaceAgentICEServers(rw http.ResponseWriter, _ *http.Request
 
 // workspaceAgentTurn proxies a WebSocket connection to the TURN server.
 func (api *API) workspaceAgentTurn(rw http.ResponseWriter, r *http.Request) {
+	workspace := httpmw.WorkspaceParam(r)
+	if !api.Authorize(r, rbac.ActionUpdate, workspace.ExecutionRBAC()) {
+		httpapi.ResourceNotFound(rw)
+		return
+	}
+
 	api.websocketWaitMutex.Lock()
 	api.websocketWaitGroup.Add(1)
 	api.websocketWaitMutex.Unlock()
@@ -364,7 +370,7 @@ func (api *API) workspaceAgentPTY(rw http.ResponseWriter, r *http.Request) {
 
 	workspaceAgent := httpmw.WorkspaceAgentParam(r)
 	workspace := httpmw.WorkspaceParam(r)
-	if !api.Authorize(r, rbac.ActionUpdate, workspace) {
+	if !api.Authorize(r, rbac.ActionUpdate, workspace.ExecutionRBAC()) {
 		httpapi.ResourceNotFound(rw)
 		return
 	}
@@ -478,7 +484,7 @@ func (api *API) postWorkspaceAgentWireguardPeer(rw http.ResponseWriter, r *http.
 		workspace      = httpmw.WorkspaceParam(r)
 	)
 
-	if !api.Authorize(r, rbac.ActionUpdate, workspace) {
+	if !api.Authorize(r, rbac.ActionUpdate, workspace.ExecutionRBAC()) {
 		httpapi.ResourceNotFound(rw)
 		return
 	}
diff --git a/coderd/workspaceapps.go b/coderd/workspaceapps.go
@@ -44,8 +44,7 @@ func (api *API) workspaceAppsProxyPath(rw http.ResponseWriter, r *http.Request)
 		return
 	}
 
-	if !api.Authorize(r, rbac.ActionCreate,
-		rbac.ResourceWorkspaceExecution.InOrg(workspace.OrganizationID).WithOwner(workspace.OwnerID.String())) {
+	if !api.Authorize(r, rbac.ActionCreate, workspace.ExecutionRBAC()) {
 		httpapi.ResourceNotFound(rw)
 		return
 	}

Original file line number	Diff line number	Diff line change
`@@ -17,6 +17,10 @@ func (w Workspace) RBACObject() rbac.Object {`
`17`	`17`	`return rbac.ResourceWorkspace.InOrg(w.OrganizationID).WithOwner(w.OwnerID.String())`
`18`	`18`	`}`
`19`	`19`
	`20`	`+func (w Workspace) ExecutionRBAC() rbac.Object {`
	`21`	`+ return rbac.ResourceWorkspaceExecution.InOrg(w.OrganizationID).WithOwner(w.OwnerID.String())`
	`22`	`+}`
	`23`	`+`
`20`	`24`	`func (m OrganizationMember) RBACObject() rbac.Object {`
`21`	`25`	`return rbac.ResourceOrganizationMember.InOrg(m.OrganizationID)`
`22`	`26`	`}`
Original file line number	Diff line number	Diff line change
`@@ -44,8 +44,7 @@ func (api API) workspaceAppsProxyPath(rw http.ResponseWriter, r http.Request)`
`44`	`44`	`return`
`45`	`45`	`}`
`46`	`46`
`47`		`- if !api.Authorize(r, rbac.ActionCreate,`
`48`		`- rbac.ResourceWorkspaceExecution.InOrg(workspace.OrganizationID).WithOwner(workspace.OwnerID.String())) {`
	`47`	`+ if !api.Authorize(r, rbac.ActionCreate, workspace.ExecutionRBAC()) {`
`49`	`48`	`httpapi.ResourceNotFound(rw)`
`50`	`49`	`return`
`51`	`50`	`}`