Enforce authz on cost, policy and scanner report endpoints

pkg/apiserver/apiserver.go

@@ -402,7 +402,7 @@ func (c completedConfig) New(ctx context.Context) (*UIServer, error) {
 
 		v1alpha1storage := map[string]rest.Storage{}
 		v1alpha1storage[scannerreportsapi.ResourceImages] = imagestorage.NewStorage(ctrlClient)
-		v1alpha1storage[scannerreportsapi.ResourceCVEReports] = reportstorage.NewStorage(ctrlClient)
+		v1alpha1storage[scannerreportsapi.ResourceCVEReports] = reportstorage.NewStorage(ctrlClient, rbacAuthorizer)
 		apiGroupInfo.VersionedResourcesStorageMap["v1alpha1"] = v1alpha1storage
 
 		if err := s.GenericAPIServer.InstallAPIGroup(&apiGroupInfo); err != nil {
@@ -413,7 +413,7 @@ func (c completedConfig) New(ctx context.Context) (*UIServer, error) {
 		apiGroupInfo := genericapiserver.NewDefaultAPIGroupInfo(policyapi.GroupName, Scheme, metav1.ParameterCodec, Codecs)
 
 		v1alpha1storage := map[string]rest.Storage{}
-		v1alpha1storage[policyapi.ResourcePolicyReports] = policystorage.NewStorage(ctrlClient)
+		v1alpha1storage[policyapi.ResourcePolicyReports] = policystorage.NewStorage(ctrlClient, rbacAuthorizer)
 		apiGroupInfo.VersionedResourcesStorageMap["v1alpha1"] = v1alpha1storage
 
 		if err := s.GenericAPIServer.InstallAPIGroup(&apiGroupInfo); err != nil {
@@ -424,7 +424,7 @@ func (c completedConfig) New(ctx context.Context) (*UIServer, error) {
 		apiGroupInfo := genericapiserver.NewDefaultAPIGroupInfo(costapi.GroupName, Scheme, metav1.ParameterCodec, Codecs)
 
 		v1alpha1storage := map[string]rest.Storage{}
-		v1alpha1storage[costapi.ResourceCostReports] = coststorage.NewStorage(ctrlClient)
+		v1alpha1storage[costapi.ResourceCostReports] = coststorage.NewStorage(ctrlClient, rbacAuthorizer)
 		apiGroupInfo.VersionedResourcesStorageMap["v1alpha1"] = v1alpha1storage
 
 		if err := s.GenericAPIServer.InstallAPIGroup(&apiGroupInfo); err != nil {

pkg/registry/cost/reports/storage.go

@@ -25,6 +25,7 @@ import (
 	"strings"
 
 	costapi "kubeops.dev/ui-server/apis/cost/v1alpha1"
+	"kubeops.dev/ui-server/pkg/shared"
 
 	gs "github.com/gorilla/schema"
 	"github.com/pkg/errors"
@@ -34,6 +35,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apiserver/pkg/authorization/authorizer"
 	"k8s.io/apiserver/pkg/registry/rest"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
@@ -45,6 +47,7 @@ var (
 
 type Storage struct {
 	kc client.Client
+	a  authorizer.Authorizer
 }
 
 var (
@@ -55,9 +58,10 @@ var (
 	_ rest.SingularNameProvider     = &Storage{}
 )
 
-func NewStorage(kc client.Client) *Storage {
+func NewStorage(kc client.Client, a authorizer.Authorizer) *Storage {
 	return &Storage{
 		kc: kc,
+		a:  a,
 	}
 }
 
@@ -82,6 +86,12 @@ func (r *Storage) Destroy() {}
 func (r *Storage) Create(ctx context.Context, obj runtime.Object, _ rest.ValidateObjectFunc, _ *metav1.CreateOptions) (runtime.Object, error) {
 	in := obj.(*costapi.CostReport)
 
+	// The cost report aggregates spend across the whole cluster and has no single
+	// resource to scope to, so require cluster-wide read access.
+	if err := shared.Authorize(ctx, r.a, shared.ClusterReadAttributes()); err != nil {
+		return nil, err
+	}
+
 	once.Do(func() error {
 		var svcs core.ServiceList
 		err := r.kc.List(ctx, &svcs, client.MatchingLabels{

pkg/registry/policy/reports/storage.go

@@ -29,10 +29,12 @@ import (
 	"kubeops.dev/ui-server/pkg/shared"
 
 	"gomodules.xyz/sets"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apiserver/pkg/authorization/authorizer"
 	"k8s.io/apiserver/pkg/registry/rest"
 	kmapi "kmodules.xyz/client-go/api/v1"
 	"kmodules.xyz/resource-metadata/apis/meta/v1alpha1"
@@ -41,6 +43,7 @@ import (
 
 type Storage struct {
 	kc client.Client
+	a  authorizer.Authorizer
 }
 
 var (
@@ -51,9 +54,10 @@ var (
 	_ rest.SingularNameProvider     = &Storage{}
 )
 
-func NewStorage(kc client.Client) *Storage {
+func NewStorage(kc client.Client, a authorizer.Authorizer) *Storage {
 	return &Storage{
 		kc: kc,
+		a:  a,
 	}
 }
 
@@ -75,9 +79,51 @@ func (r *Storage) New() runtime.Object {
 
 func (r *Storage) Destroy() {}
 
+// authorize ensures the caller may read the scope whose policy violations are reported:
+// cluster scope requires cluster-wide read, namespace scope requires access to the
+// namespace, and a resource scope requires get access to the referenced object.
+func (r *Storage) authorize(ctx context.Context, req *policyapi.PolicyReportRequest) error {
+	if req == nil || shared.IsClusterRequest(&req.ObjectInfo) {
+		return shared.Authorize(ctx, r.a, shared.ClusterReadAttributes())
+	}
+	if shared.IsNamespaceRequest(&req.ObjectInfo) {
+		return shared.Authorize(ctx, r.a, authorizer.AttributesRecord{
+			Verb:     "get",
+			Resource: "namespaces",
+			Name:     req.Ref.Name,
+		})
+	}
+
+	rid := req.Resource
+	if rid.Kind == "" {
+		r2, err := kmapi.ExtractResourceID(r.kc.RESTMapper(), req.Resource)
+		if err != nil {
+			return err
+		}
+		rid = *r2
+	}
+	mapping, err := r.kc.RESTMapper().RESTMapping(schema.GroupKind{Group: rid.Group, Kind: rid.Kind})
+	if err != nil {
+		return apierrors.NewInternalError(err)
+	}
+	return shared.Authorize(ctx, r.a, authorizer.AttributesRecord{
+		Verb:      "get",
+		APIGroup:  mapping.Resource.Group,
+		Resource:  mapping.Resource.Resource,
+		Namespace: req.Ref.Namespace,
+		Name:      req.Ref.Name,
+	})
+}
+
 func (r *Storage) Create(ctx context.Context, obj runtime.Object, _ rest.ValidateObjectFunc, _ *metav1.CreateOptions) (runtime.Object, error) {
 	in := obj.(*policyapi.PolicyReport)
 
+	// The policy report exposes constraint violations for the requested scope, so require
+	// the caller to be allowed to read that scope before returning it.
+	if err := r.authorize(ctx, in.Request); err != nil {
+		return nil, err
+	}
+
 	var (
 		scp           scopeDetails
 		resourceGraph *v1alpha1.ResourceGraphResponse

pkg/registry/scanner/reports/storage.go

@@ -33,6 +33,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apiserver/pkg/authorization/authorizer"
 	"k8s.io/apiserver/pkg/registry/rest"
 	kmapi "kmodules.xyz/client-go/api/v1"
 	"kmodules.xyz/client-go/client/apiutil"
@@ -42,6 +43,7 @@ import (
 
 type Storage struct {
 	kc client.Client
+	a  authorizer.Authorizer
 }
 
 var (
@@ -52,9 +54,10 @@ var (
 	_ rest.SingularNameProvider     = &Storage{}
 )
 
-func NewStorage(kc client.Client) *Storage {
+func NewStorage(kc client.Client, a authorizer.Authorizer) *Storage {
 	return &Storage{
 		kc: kc,
+		a:  a,
 	}
 }
 
@@ -76,13 +79,73 @@ func (r *Storage) New() runtime.Object {
 
 func (r *Storage) Destroy() {}
 
+// authorize ensures the caller may read the pods that back the requested CVE report.
+// The required access mirrors what graph.LocatePods reads for each request scope.
+func (r *Storage) authorize(ctx context.Context, oi *kmapi.ObjectInfo) error {
+	switch {
+	case shared.IsClusterRequest(oi), shared.IsImageRequest(oi), shared.IsClusterCVERequest(oi):
+		// enumerates pods across the whole cluster
+		return shared.Authorize(ctx, r.a, authorizer.AttributesRecord{
+			Verb:     "list",
+			Resource: "pods",
+		})
+	case shared.IsNamespaceRequest(oi):
+		return shared.Authorize(ctx, r.a, authorizer.AttributesRecord{
+			Verb:      "list",
+			Resource:  "pods",
+			Namespace: oi.Ref.Name,
+		})
+	case shared.IsNamespaceCVERequest(oi):
+		return shared.Authorize(ctx, r.a, authorizer.AttributesRecord{
+			Verb:      "list",
+			Resource:  "pods",
+			Namespace: oi.Ref.Namespace,
+		})
+	case shared.IsPodRequest(oi):
+		return shared.Authorize(ctx, r.a, authorizer.AttributesRecord{
+			Verb:      "get",
+			Resource:  "pods",
+			Namespace: oi.Ref.Namespace,
+			Name:      oi.Ref.Name,
+		})
+	default:
+		// object request (e.g. a workload): require get access to the referenced object
+		rid := oi.Resource
+		if rid.Kind == "" {
+			r2, err := kmapi.ExtractResourceID(r.kc.RESTMapper(), oi.Resource)
+			if err != nil {
+				return err
+			}
+			rid = *r2
+		}
+		mapping, err := r.kc.RESTMapper().RESTMapping(schema.GroupKind{Group: rid.Group, Kind: rid.Kind})
+		if err != nil {
+			return apierrors.NewInternalError(err)
+		}
+		return shared.Authorize(ctx, r.a, authorizer.AttributesRecord{
+			Verb:      "get",
+			APIGroup:  mapping.Resource.Group,
+			Resource:  mapping.Resource.Resource,
+			Namespace: oi.Ref.Namespace,
+			Name:      oi.Ref.Name,
+		})
+	}
+}
+
 func (r *Storage) Create(ctx context.Context, obj runtime.Object, _ rest.ValidateObjectFunc, _ *metav1.CreateOptions) (runtime.Object, error) {
 	in := obj.(*reportsapi.CVEReport)
 
 	var oi *kmapi.ObjectInfo
 	if in.Request != nil {
 		oi = &in.Request.ObjectInfo
 	}
+
+	// The CVE report enumerates the pods (and therefore the images) of the requested
+	// scope, so require the caller to be allowed to read that scope before returning it.
+	if err := r.authorize(ctx, oi); err != nil {
+		return nil, err
+	}
+
 	pods, err := graph.LocatePods(ctx, r.kc, oi)
 	if err != nil {
 		return nil, err

pkg/shared/authz.go

@@ -0,0 +1,64 @@
+/*
+Copyright AppsCode Inc. and Contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package shared
+
+import (
+	"context"
+	"errors"
+
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apiserver/pkg/authorization/authorizer"
+	apirequest "k8s.io/apiserver/pkg/endpoints/request"
+)
+
+// Authorize resolves the requesting user from ctx, fills it into attrs, and asks the
+// authorizer for a decision. It returns a Forbidden error when access is denied so the
+// aggregated apiserver surfaces a proper 403 to the caller.
+//
+// Callers only need to set the resource-identifying fields of attrs (Verb, APIGroup,
+// Resource, Namespace, Name); User and ResourceRequest are set here.
+func Authorize(ctx context.Context, a authorizer.Authorizer, attrs authorizer.AttributesRecord) error {
+	user, ok := apirequest.UserFrom(ctx)
+	if !ok {
+		return apierrors.NewBadRequest("missing user info in request context")
+	}
+	attrs.User = user
+	attrs.ResourceRequest = true
+
+	decision, why, err := a.Authorize(ctx, attrs)
+	if err != nil {
+		return apierrors.NewInternalError(err)
+	}
+	if decision != authorizer.DecisionAllow {
+		gr := schema.GroupResource{Group: attrs.APIGroup, Resource: attrs.Resource}
+		return apierrors.NewForbidden(gr, attrs.Name, errors.New(why))
+	}
+	return nil
+}
+
+// ClusterReadAttributes returns attributes representing cluster-wide read access
+// (get on all resources in all groups). Only callers effectively granted cluster-admin
+// satisfy this check. Used to gate endpoints that expose whole-cluster data with no
+// single resource to authorize against.
+func ClusterReadAttributes() authorizer.AttributesRecord {
+	return authorizer.AttributesRecord{
+		Verb:     "get",
+		APIGroup: "*",
+		Resource: "*",
+	}
+}