Closed Patagonia121 closed 1 month ago
@nonpunctual intook this FR today from customer-faltona, feel free to edit/modify as you see fit. Maybe we can tag customer-rocher as well?
cc @dherder
An alternate view of these permissions with a bit more context:
customer-reedtimmer also expressed additional control over script security. Currently controlling with packages but also could see use cases for controls at Fleet admin user level.
@nonpunctual and @Patagonia121 thanks for tracking this one.
Added customer-rocher
to this one.
Looking forward to chatting w/ them on Monday (2024-05-20)
Hey @Patagonia121 heads up, I updated this issue to user story format and moved your original issue description (awesome description) below:
Summary
Customer requires more granular control over permissions for running and executing scripts within their Fleet MDM instance. This feature will allow specific teams, such as engineering or IT, to execute scripts without granting access to all users, particularly those in the security team.
Background
Currently, script execution permissions within Fleet MDM are too broad, creating a roadblock for customers that need to limit script execution to certain teams. This particular customer has had to disable script execution across their entire system to prevent unauthorized use, which has hindered their operations. They need a solution that allows more tailored permissions to enhance security while maintaining functionality for authorized teams.
Desired Functionality
Benefits
•Enhanced Security: By restricting script execution to authorized teams, the risk of unauthorized actions is minimized. •Operational Efficiency: Allows teams like engineering and IT to perform necessary script-based tasks without broad access limitations. •Compliance: Helps organizations adhere to internal security policies and regulatory requirements.
Marko: We could add an "Observers can run" option to scripts. Like we do for live queries.
Noah: I think this is a great idea. Let's come back to this when a customer is trying to enable help desk.
Est: FE 1 BE 2
@noahtalerman does this conflict with any other customers we have that might use observer+ for their support staff that use run save script to attempt to fix some known issues? Would this break them and is that acceptable? Thinking about customer-eponym here.
https://github.com/fleetdm/fleet/issues/19055#issuecomment-2142486129 basically I am saying I think we already have this customer
does this conflict with any other customers we have that might use observer+ for their support staff that use run save script to attempt to fix some known issues? Would this break them and is that acceptable? Thinking about customer-eponym here.
@georgekarrv I don't think any customers are letting users w/ observer or observer+ role run scripts.
@zayhanlon and @Patagonia121 please let me know if you think we're wrong.
my 2¢ on this is, if possible, we should try to think about allowing users to assign granular capabilities to administrator access levels, not pre-bundling capabilities into levels for them, unless, those groupings of capabilities are well-understood as something that will be useful to 80/20% of customers rather than 1 thing that 1 customer requested.
Backend portion merged to main. Moving back to ready for @jacobshandling
@nonpunctual we discussed this when the request for more granular roles came up (when we added GitOps and Observer+) for a customer last year but the scope of work is large and we needed to get something out faster / more aligned to our sprint cadence. Something we could do for the future but not soon
@noahtalerman @georgekarrv @marko-lisica
The feedback from customer-eponym is "What would be ideal for us would be being able to selectively allow some scripts or all scripts, as something observer roles could run and have the default be the script runs being locked to maintainer. Then we could be very granular about it if need be."
Hey @Patagonia121 heads up that this customer request was shipped in Fleet 4.54.
Updating the permissions docs is still TODO. The open PR is here: https://github.com/fleetdm/fleet/pull/20624
Also, updating features.yml is still TODO: https://github.com/fleetdm/fleet/blob/main/handbook/company/pricing-features-table.yml#L87
I assigned myself.
Also, updating features.yml is still TODO: https://github.com/fleetdm/fleet/blob/main/handbook/company/pricing-features-table.yml#L87
PR is up here: https://github.com/fleetdm/fleet/pull/20682
In Fleet's glass city, Scripts run by those trusted, Safe, with no pity.
Goal
Context
Changes
Product
Engineering
QA
Risk assessment
Manual testing steps
Interface matrix 1: [API, fleetctl] User matrix: [global observer, global observer+, team observer, team observer+]
Testing notes
Confirmation