System index permissions

src/main/java/org/opensearch/security/privileges/PrivilegesEvaluator.java

@@ -308,7 +308,7 @@ public PrivilegesEvaluatorResponse evaluate(
         }
 
         // Security index access
-        if (securityIndexAccessEvaluator.evaluate(request, task, action0, requestedResolved, presponse).isComplete()) {
+        if (securityIndexAccessEvaluator.evaluate(request, task, action0, requestedResolved, presponse, securityRoles).isComplete()) {
             return presponse;
         }
 

src/main/java/org/opensearch/security/privileges/SecurityIndexAccessEvaluator.java

@@ -27,7 +27,6 @@
 package org.opensearch.security.privileges;
 
 import java.util.ArrayList;
-import java.util.HashSet;
 import java.util.List;
 import java.util.Set;
 import java.util.stream.Collectors;
@@ -42,6 +41,8 @@
 import org.opensearch.security.auditlog.AuditLog;
 import org.opensearch.security.resolver.IndexResolverReplacer;
 import org.opensearch.security.resolver.IndexResolverReplacer.Resolved;
+import org.opensearch.security.securityconf.IndexPattern;
+import org.opensearch.security.securityconf.SecurityRoles;
 import org.opensearch.security.support.ConfigConstants;
 import org.opensearch.security.support.WildcardMatcher;
 import org.opensearch.tasks.Task;
@@ -55,7 +56,6 @@ public class SecurityIndexAccessEvaluator {
     private final WildcardMatcher securityDeniedActionMatcher;
     private final IndexResolverReplacer irr;
     private final boolean filterSecurityIndex;
-
     // for system-indices configuration
     private final WildcardMatcher systemIndexMatcher;
     private final boolean systemIndexEnabled;
@@ -75,7 +75,6 @@ public SecurityIndexAccessEvaluator(final Settings settings, AuditLog auditLog,
             ConfigConstants.SECURITY_SYSTEM_INDICES_ENABLED_KEY,
             ConfigConstants.SECURITY_SYSTEM_INDICES_ENABLED_DEFAULT
         );
-
         final boolean restoreSecurityIndexEnabled = settings.getAsBoolean(
             ConfigConstants.SECURITY_UNSUPPORTED_RESTORE_SECURITYINDEX_ENABLED,
             false
@@ -105,9 +104,26 @@ public PrivilegesEvaluatorResponse evaluate(
         final Task task,
         final String action,
         final Resolved requestedResolved,
-        final PrivilegesEvaluatorResponse presponse
+        final PrivilegesEvaluatorResponse presponse,
+        final SecurityRoles securityRoles
     ) {
+
         final boolean isDebugEnabled = log.isDebugEnabled();
+
+        if (matchAnySystemIndices(requestedResolved) && !checkSystemIndexPermissionsForUser(securityRoles)) {
+            auditLog.logSecurityIndexAttempt(request, action, task);
+            if (log.isInfoEnabled()) {
+                log.info(
+                    "No {} permission for user roles {} to System Indices {}",
+                    action,
+                    securityRoles,
+                    getProtectedIndexes(requestedResolved).stream().collect(Collectors.joining(", "))
+                );
+            }
+            presponse.allowed = false;
+            return presponse.markComplete();
+        }
+
         if (securityDeniedActionMatcher.test(action)) {
             if (requestedResolved.isLocalAll()) {
                 if (filterSecurityIndex) {
@@ -122,35 +138,11 @@ public PrivilegesEvaluatorResponse evaluate(
                         );
                     }
                     return presponse;
-                } else {
-                    auditLog.logSecurityIndexAttempt(request, action, task);
-                    log.warn("{} for '_all' indices is not allowed for a regular user", action);
-                    presponse.allowed = false;
-                    return presponse.markComplete();
-                }
-            } else if (matchAnySystemIndices(requestedResolved)) {
-                if (filterSecurityIndex) {
-                    Set<String> allWithoutSecurity = new HashSet<>(requestedResolved.getAllIndices());
-                    allWithoutSecurity.remove(securityIndex);
-                    if (allWithoutSecurity.isEmpty()) {
-                        if (isDebugEnabled) {
-                            log.debug("Filtered '{}' but resulting list is empty", securityIndex);
-                        }
-                        presponse.allowed = false;
-                        return presponse.markComplete();
-                    }
-                    irr.replace(request, false, allWithoutSecurity.toArray(new String[0]));
-                    if (isDebugEnabled) {
-                        log.debug("Filtered '{}', resulting list is {}", securityIndex, allWithoutSecurity);
-                    }
-                    return presponse;
-                } else {
-                    auditLog.logSecurityIndexAttempt(request, action, task);
-                    final String foundSystemIndexes = getProtectedIndexes(requestedResolved).stream().collect(Collectors.joining(", "));
-                    log.warn("{} for '{}' index is not allowed for a regular user", action, foundSystemIndexes);
-                    presponse.allowed = false;
-                    return presponse.markComplete();
                 }
+                auditLog.logSecurityIndexAttempt(request, action, task);
+                log.info("{} for '_all' indices is not allowed for a regular user", action);
+                presponse.allowed = false;
+                return presponse.markComplete();
             }
         }
 
@@ -175,6 +167,23 @@ public PrivilegesEvaluatorResponse evaluate(
         return presponse;
     }
 
+    private boolean checkSystemIndexPermissionsForUser(SecurityRoles securityRoles) {
+        // The generic wildcard "*" permission shouldn't give access to SystemIndices, so excluding it from the user roles's permissions
+        // before the check
+        Set<WildcardMatcher> userPermissions = securityRoles.getRoles()
+            .stream()
+            .flatMap(role -> role.getIpatterns().stream())
+            .map(IndexPattern::getNonWildCardPerms)
+            .collect(Collectors.toSet());
+
+        for (WildcardMatcher userPermission : userPermissions.stream().collect(Collectors.toSet())) {
+            if (userPermission.matchAny(ConfigConstants.SYSTEM_INDEX_PERMISSION)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
     private boolean matchAnySystemIndices(final Resolved requestedResolved) {
         return !getProtectedIndexes(requestedResolved).isEmpty();
     }