diff --git a/spp_key_management/README.rst b/spp_key_management/README.rst index eb9a3a265..a31bb296f 100644 --- a/spp_key_management/README.rst +++ b/spp_key_management/README.rst @@ -165,6 +165,20 @@ External Python dependencies: ``cryptography`` Changelog ========= +19.0.2.0.1 +~~~~~~~~~~ + +- fix(security): stop the Key Management Admin group from granting full + system administration. ``implied_ids`` grants the implied groups to + members, so the previous ``base.group_system`` link escalated any + holder of the key management role to a Settings/System administrator. + The admin group now implies Key Operator instead, key admins keep + field access to the KMS-wrapped key material the cloud providers read + in user context, and a migration strips the unsafe link from existing + databases. The Key Management menu moved from Settings to a top-level + menu: the Settings root is only visible to ERP managers, so key admins + who are no longer system administrators could not reach it there. + 19.0.2.0.0 ~~~~~~~~~~ diff --git a/spp_key_management/__manifest__.py b/spp_key_management/__manifest__.py index 12b625afc..618f7e364 100644 --- a/spp_key_management/__manifest__.py +++ b/spp_key_management/__manifest__.py @@ -4,7 +4,7 @@ "name": "OpenSPP Key Management", "summary": "Centralized cryptographic key management with pluggable providers", "category": "OpenSPP/Identity", - "version": "19.0.2.0.0", + "version": "19.0.2.0.1", "sequence": 1, "author": "OpenSPP.org", "website": "https://github.com/OpenSPP/OpenSPP2", diff --git a/spp_key_management/migrations/19.0.2.0.1/post-migration.py b/spp_key_management/migrations/19.0.2.0.1/post-migration.py new file mode 100644 index 000000000..92b2bbcd5 --- /dev/null +++ b/spp_key_management/migrations/19.0.2.0.1/post-migration.py @@ -0,0 +1,45 @@ +# Part of OpenSPP. See LICENSE file for full copyright and licensing details. +"""Remove the base.group_system implication from the Key Management Admin group. + +Earlier versions shipped ``spp_key_management.group_key_admin`` with +``implied_ids`` linking ``base.group_system``. ``implied_ids`` GRANTS the +implied groups to members, so any user given the key management role +silently became a full Settings/System administrator. Removing the link +from the XML only stops adding it on fresh installs - it never removes an +existing relation - so strip it here. Odoo computes effective membership +as a transitive closure of ``implied_ids``, so removing the link +immediately revokes the escalated privileges from affected users. (The +replacement implication - admin implies operator - is applied by the +regular data load; the groups file is not noupdate.) +""" + +import logging + +from odoo import SUPERUSER_ID, Command, api + +_logger = logging.getLogger(__name__) + + +def migrate(cr, version): + if not version: + return + + env = api.Environment(cr, SUPERUSER_ID, {}) + group = env.ref("spp_key_management.group_key_admin", raise_if_not_found=False) + system = env.ref("base.group_system", raise_if_not_found=False) + if not group or not system or system not in group.implied_ids: + return + + # all_user_ids also counts members of any group implying key admin, so + # the log reflects everyone who actually held the escalation. + affected = len(group.all_user_ids) + group.write({"implied_ids": [Command.unlink(system.id)]}) + _logger.warning( + "Removed the base.group_system implication from the Key Management " + "Admin group; %s user(s) held the group and lose the transitively " + "granted system administration rights. Audit changes made by these " + "users while escalated, grant base.group_system explicitly where it " + "is genuinely intended, and consider rotating data keys if key " + "custody policy separates platform admins from key admins.", + affected, + ) diff --git a/spp_key_management/models/encryption_key.py b/spp_key_management/models/encryption_key.py index 27ee771c0..f80f5a6ea 100644 --- a/spp_key_management/models/encryption_key.py +++ b/spp_key_management/models/encryption_key.py @@ -43,7 +43,11 @@ class EncryptionKey(models.Model): ) encrypted_key = fields.Char( required=True, - groups="base.group_system", + # Key admins need field access because the AWS KMS, Azure Key Vault + # and GCP KMS providers read the cached wrapped key in the calling + # user's context. The value is ciphertext (wrapped by the KMS); + # plaintext key material is never stored here. + groups="base.group_system,spp_key_management.group_key_admin", help="Base64-encoded encrypted key material", ) algorithm = fields.Char( diff --git a/spp_key_management/readme/HISTORY.md b/spp_key_management/readme/HISTORY.md index 4aaf9afef..cbb5293f9 100644 --- a/spp_key_management/readme/HISTORY.md +++ b/spp_key_management/readme/HISTORY.md @@ -1,3 +1,16 @@ +### 19.0.2.0.1 + +- fix(security): stop the Key Management Admin group from granting full + system administration. `implied_ids` grants the implied groups to members, + so the previous `base.group_system` link escalated any holder of the key + management role to a Settings/System administrator. The admin group now + implies Key Operator instead, key admins keep field access to the + KMS-wrapped key material the cloud providers read in user context, and a + migration strips the unsafe link from existing databases. The Key + Management menu moved from Settings to a top-level menu: the Settings + root is only visible to ERP managers, so key admins who are no longer + system administrators could not reach it there. + ### 19.0.2.0.0 - Initial migration to OpenSPP2 diff --git a/spp_key_management/security/security_groups.xml b/spp_key_management/security/security_groups.xml index f5123ced8..372efc0e3 100644 --- a/spp_key_management/security/security_groups.xml +++ b/spp_key_management/security/security_groups.xml @@ -15,17 +15,9 @@ 20 - - - Key Management Admin - - Full access to key management. Can configure providers, rotate keys, and view all key operations. - - - - + Key Operator @@ -34,4 +26,28 @@ >Can use encryption keys for operations but cannot manage providers or rotate keys. + + + + Key Management Admin + + Full access to key management. Can configure providers, rotate keys, and view all key operations. + + diff --git a/spp_key_management/static/description/index.html b/spp_key_management/static/description/index.html index 10418817f..a16177040 100644 --- a/spp_key_management/static/description/index.html +++ b/spp_key_management/static/description/index.html @@ -548,6 +548,21 @@

Changelog

+

19.0.2.0.1

+ +
+

19.0.2.0.0