User has access to JOBS he has not run

[fvzwieten]

ISSUE TYPE

• Bug Report

COMPONENT NAME

• UI

SUMMARY

When user has USE permission on job template, it sees all jobs and thus job logging, survey data, etc, from all other users having access to this job template as well. This is seen as information leakage. Auditors and security officers do not like this. Users should see job info only for jobs it has permission to see. This includes his own jobs, and, though some RBAC control(s) jobs from other users.

ENVIRONMENT

• AWX version: 3.4.1
• AWX install method: non-docker
• Ansible version: 2.7.0
• Operating System: RHEL7
• Web Browser: Firefox 66

STEPS TO REPRODUCE

As user1, create a JT and give USE permission to user2 and user3
As user1, run the JT
As user2, run the JT
As user3, run the JT
As user3, look at jobs

EXPECTED RESULTS

As user1, I see only my own jobs
As user2, I see only my own jobs
As user3, I see only my own jobs

ACTUAL RESULTS

As userx, I see jobs from user1, user2 and user3

ADDITIONAL INFORMATION

Sometimes it would be usefull to see JOBS on JT ran by another user/team. No recommendation on how RBAC should be set up to allow that.
Files as a bug and not as a feature request on purpose.

[wenottingham]

This is currently intentional behavior; it would be a significant user-facing change at this point, and therefore would be treated/scheduled as n enhancement.

[AlanCoding]

When user has USE permission on job template

USE permission -> execute permission

[fvzwieten]

The point is that this is information leakage. As a Security Auditor, I would make a point on this.

[AlanCoding]

#3668

I could possibly imagine adding an auditor_role for job templates, although this would significantly complicate the querysets.