Repository navigation
fix(config): restrict config:install to the admin role - #2861
Merged
Merged
Conversation
config:install writes a file fetched from an arbitrary URL into
${karaf.etc}, which also holds users.properties, keys.properties and the
*.acl.* files. The command had no entry in the org.apache.karaf.command.acl.config
ACL, and the command guard treats an unmatched command as allowed, so any
authenticated shell user could run it.
Add "install = admin" to the config command ACL, consistent with
config:delete and with bundle:install / feature:install / kar:install.
jbonofre
force-pushed
the
config-install-acl-admin
branch
from
September 8, 2026 17:43
a34b627 to
40fca4b
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
config:install <url> <finalname>downloads a file from an arbitrary URL and writes it into${karaf.etc}(the-o/--overrideoption lets it overwrite an existing file). That folder also holdsusers.properties,keys.properties,host.keyand everyorg.apache.karaf.*.acl.*file.The command has no entry in
org.apache.karaf.command.acl.config.SecuredSessionFactoryImpl.checkSecurity()treats an unmatched command as allowed (Specificity.NO_MATCH→passCheck = true), andkaraf.secured.command.compulsory.rolesships commented out, so any authenticated shell/SSH user — including aviewer— can runconfig:installand overwrite, for example, the command ACL files orusers.properties.By contrast
bundle:install,feature:installandkar:installare alladmin-only in their own ACLs, andconfig:deleteisadminin this same ACL.Fix
Add
install = adminto theconfigcommand ACL, in both shipped locations:assemblies/features/standard/src/main/feature/feature.xml(<config>block)instance/.../etc/org.apache.karaf.command.acl.config.cfg(instance template)and to the itest etc fixture (
itests/test/src/test/filtered-resources/etc/feature.xml).Test
ConfigSshCommandSecurityTest#testConfigInstallCommandSecurityViaSsh— aviewerand amanagergetCommand not found; anadmincan run it.Note
The underlying fail-open behaviour (unmatched command → allowed, with
karaf.secured.command.compulsory.rolesdisabled by default) is a broader hardening question tracked separately; this PR only closes theconfig:installgap.