envoyproxy/envoy

RBAC policy for unix socket peer uid/gid

Open

#6,193 opened on Mar 6, 2019

View on GitHub
 (2 comments) (0 reactions) (1 assignee)C++ (5,373 forks)batch import
area/rbacdesign proposalhelp wanted

Repository metrics

Stars
 (27,997 stars)
PR merge metrics
 (Avg merge 8d) (378 merged PRs in 30d)

Description

It would be nice to be able to specify a RBAC policy based on the UID or GID of the downstream connection when it's coming through a unix socket.

This would involve exposing the UID/GID on the Connection if applicable. This would be done by using SO_PEERCRED to get the peer credentials from the socket.

A RBAC policy would then be added to read this data.

The use case we have in mind here is restricting certain routes to be available only to users that can assume a specific unix group.

Contributor guide

Research direction
Examine how Envoy currently handles unix socket connections and extracts connection metadata. Study the RBAC filter implementation to understand where to add peer credential extraction. Implement `SO PEERCRED` in the connection handling code and expose uid/gid in the Connection object. Then extend RBAC policy to allow matching on these fields.
Tech stack
cpp
Domain
backendsecurity
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
C++Unix socket programming
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
35