Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update RBAC after each roleSetter function event is received and it is executed successfully #31

Open
mojtaba-eshghie opened this issue Sep 16, 2023 · 2 comments
Assignees
Labels
enhancement New feature or request good first issue Good for newcomers

Comments

@mojtaba-eshghie
Copy link
Owner

The updating of RBAC using updateRBAC utility function should happen regardless of the violation or normal events. This will ensure the monitor is keeping track of the runtime data correctly.

I think the following line is the suitable place to add it (before serve):
https://github.com/mojtaba-eshghie/CLawK/blob/43d809942a90c2beb851579a473cba379ef42eac/server/monitor/dcrCaller.js#L65

@mojtaba-eshghie mojtaba-eshghie added the enhancement New feature or request label Sep 16, 2023
@mojtaba-eshghie mojtaba-eshghie self-assigned this Sep 16, 2023
@mojtaba-eshghie
Copy link
Owner Author

mojtaba-eshghie commented Sep 23, 2023

  • updateRBAC is not yet invoked each time an event is executed.
  • When an activity is sent for the DCR engine, the role is not attached to it yet.

@mojtaba-eshghie
Copy link
Owner Author

mojtaba-eshghie commented Oct 5, 2023

On second thoughts this would have been a deterimental vulnerability of the monitoring system if implemented like this. In simple words, any function could change the roles of an account without being noticed. This features should be changed to for all role-setter functions update the exact role that should be updated after the function is executed in the monitor.

To resolve this correctly, we have to use another parameter as the monitor giving in the following form:
{
"setterFunctionIdentifier": "roleIdentifier"
}

Here, the roleIdentifier is the variable identifier holding the address of the person holding the role. Of course the new value that should be set for the roleIdentifier is received as msg.sender. So, the first thing checked against is if this function is among the setters from the passed file. Second, other things such as the convention we have for the arguments.

@mojtaba-eshghie mojtaba-eshghie added the good first issue Good for newcomers label Oct 5, 2023
@mojtaba-eshghie mojtaba-eshghie changed the title Update RBAC after each event is received Update RBAC after each roleSetter function event is received Oct 5, 2023
@mojtaba-eshghie mojtaba-eshghie changed the title Update RBAC after each roleSetter function event is received Update RBAC after each roleSetter function event is received and it is executed successfully Oct 5, 2023
mojtaba-eshghie added a commit that referenced this issue Oct 5, 2023
mojtaba-eshghie added a commit that referenced this issue Oct 16, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request good first issue Good for newcomers
Projects
None yet
Development

No branches or pull requests

1 participant