diff --git a/docs/docs/sidebar/features/authentication.md b/docs/docs/sidebar/features/authentication.md index d66eeb420..c17f62004 100644 --- a/docs/docs/sidebar/features/authentication.md +++ b/docs/docs/sidebar/features/authentication.md @@ -63,11 +63,11 @@ flowchart TD Built-in roles expand to these default permissions: -| Role | Permissions | -| ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | +| Role | Permissions | +| ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `admin` | `agent:read`, `agent:write`, `node:read`, `node:write`, `network:read`, `network:write`, `job:read`, `job:write`, `health:read`, `audit:read`, `command:execute`, `command:shell`, `file:read`, `file:write`, `docker:read`, `docker:write`, `docker:execute`, `cron:read`, `cron:write`, `sysctl:read`, `sysctl:write`, `ntp:read`, `ntp:write`, `timezone:read`, `timezone:write`, `power:execute`, `process:read`, `process:execute`, `user:read`, `user:write`, `package:read`, `package:write`, `log:read`, `certificate:read`, `certificate:write`, `service:read`, `service:write` | -| `write` | `agent:read`, `node:read`, `node:write`, `network:read`, `network:write`, `job:read`, `job:write`, `health:read`, `file:read`, `file:write`, `docker:read`, `docker:write`, `cron:read`, `cron:write`, `sysctl:read`, `sysctl:write`, `ntp:read`, `ntp:write`, `timezone:read`, `timezone:write`, `process:read`, `user:read`, `user:write`, `package:read`, `package:write`, `log:read`, `certificate:read`, `certificate:write`, `service:read`, `service:write` | -| `read` | `agent:read`, `node:read`, `network:read`, `job:read`, `health:read`, `file:read`, `docker:read`, `cron:read`, `sysctl:read`, `ntp:read`, `timezone:read`, `process:read`, `user:read`, `package:read`, `log:read`, `certificate:read`, `service:read` | +| `write` | `agent:read`, `node:read`, `node:write`, `network:read`, `network:write`, `job:read`, `job:write`, `health:read`, `file:read`, `file:write`, `docker:read`, `docker:write`, `cron:read`, `cron:write`, `sysctl:read`, `sysctl:write`, `ntp:read`, `ntp:write`, `timezone:read`, `timezone:write`, `process:read`, `user:read`, `user:write`, `package:read`, `package:write`, `log:read`, `certificate:read`, `certificate:write`, `service:read`, `service:write` | +| `read` | `agent:read`, `node:read`, `network:read`, `job:read`, `health:read`, `file:read`, `docker:read`, `cron:read`, `sysctl:read`, `ntp:read`, `timezone:read`, `process:read`, `user:read`, `package:read`, `log:read`, `certificate:read`, `service:read` | `command:execute` and `command:shell` are two distinct permissions: the former guards the argv-only `exec` endpoint, the latter guards the `/bin/sh -c` based diff --git a/docs/docs/sidebar/features/command-execution.md b/docs/docs/sidebar/features/command-execution.md index d6fbc281c..56962976e 100644 --- a/docs/docs/sidebar/features/command-execution.md +++ b/docs/docs/sidebar/features/command-execution.md @@ -78,10 +78,9 @@ role can be scoped to structured commands without also granting shell access: Only the built-in `admin` role includes either permission by default. The `write` and `read` roles do not. -> **Upgrading?** A custom role or token that was granted only -> `command:execute` no longer reaches the `shell` endpoint -- it now also needs -> `command:shell`. Add `command:shell` to any custom role or token that should -> keep shell access. +> **Upgrading?** A custom role or token that was granted only `command:execute` +> no longer reaches the `shell` endpoint -- it now also needs `command:shell`. +> Add `command:shell` to any custom role or token that should keep shell access. To grant command execution to a custom role: @@ -113,13 +112,13 @@ NATS, agent, and authentication settings. ## Permissions -| Operation | Permission | -| --------- | ---------------- | +| Operation | Permission | +| --------- | ----------------- | | Exec | `command:execute` | | Shell | `command:shell` | -Only the `admin` role includes `command:execute` or `command:shell` by -default. Grant them to other roles or tokens explicitly when needed. +Only the `admin` role includes `command:execute` or `command:shell` by default. +Grant them to other roles or tokens explicitly when needed. ## Related diff --git a/docs/docs/sidebar/usage/cli/client/node/user/create.md b/docs/docs/sidebar/usage/cli/client/node/user/create.md index 3da34b9dc..3dbe3b83a 100644 --- a/docs/docs/sidebar/usage/cli/client/node/user/create.md +++ b/docs/docs/sidebar/usage/cli/client/node/user/create.md @@ -36,14 +36,14 @@ $ osapi client node user create --target _all \ ## Flags | Flag | Description | Default | -| -------------- | ----------------------------------------------------------- | ------- | -| `-T, --target` | Target: `_any`, `_all`, hostname, or label (`group:web`) | `_all` | -| `--name` | Username for the new account (required) | | -| `--uid` | Numeric user ID (system assigns if omitted) | | -| `--gid` | Primary group ID (system assigns if omitted) | | -| `--home` | Home directory path | | -| `--shell` | Login shell path | | -| `--groups` | Supplementary groups (comma-separated) | | -| `--password` | Initial password (hashed by the controller before storage) | | -| `--system` | Create a system account | `false` | -| `-j, --json` | Output raw JSON response | | +| -------------- | ---------------------------------------------------------- | ------- | +| `-T, --target` | Target: `_any`, `_all`, hostname, or label (`group:web`) | `_all` | +| `--name` | Username for the new account (required) | | +| `--uid` | Numeric user ID (system assigns if omitted) | | +| `--gid` | Primary group ID (system assigns if omitted) | | +| `--home` | Home directory path | | +| `--shell` | Login shell path | | +| `--groups` | Supplementary groups (comma-separated) | | +| `--password` | Initial password (hashed by the controller before storage) | | +| `--system` | Create a system account | `false` | +| `-j, --json` | Output raw JSON response | | diff --git a/docs/docs/sidebar/usage/cli/client/node/user/password.md b/docs/docs/sidebar/usage/cli/client/node/user/password.md index 4ccd4ffcb..a7c9341c2 100644 --- a/docs/docs/sidebar/usage/cli/client/node/user/password.md +++ b/docs/docs/sidebar/usage/cli/client/node/user/password.md @@ -39,9 +39,9 @@ $ osapi client node user password --target _all \ ## Flags -| Flag | Description | Default | -| -------------- | ------------------------------------------------------------------ | ------- | -| `-T, --target` | Target: `_any`, `_all`, hostname, or label (`group:web`) | `_all` | +| Flag | Description | Default | +| -------------- | ----------------------------------------------------------------- | ------- | +| `-T, --target` | Target: `_any`, `_all`, hostname, or label (`group:web`) | `_all` | | `--name` | Username to change password for (required) | | | `--password` | New password (hashed by the controller before storage) (required) | | -| `-j, --json` | Output raw JSON response | | +| `-j, --json` | Output raw JSON response | | diff --git a/docs/docs/sidebar/usage/configuration.md b/docs/docs/sidebar/usage/configuration.md index a0363d294..3f63ff5aa 100644 --- a/docs/docs/sidebar/usage/configuration.md +++ b/docs/docs/sidebar/usage/configuration.md @@ -185,11 +185,11 @@ OSAPI uses fine-grained `resource:verb` permissions for access control. Each API endpoint requires a specific permission. Built-in roles expand to a default set of permissions: -| Role | Permissions | -| ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | +| Role | Permissions | +| ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `admin` | `agent:read`, `agent:write`, `node:read`, `node:write`, `network:read`, `network:write`, `job:read`, `job:write`, `health:read`, `audit:read`, `command:execute`, `command:shell`, `file:read`, `file:write`, `docker:read`, `docker:write`, `docker:execute`, `cron:read`, `cron:write`, `sysctl:read`, `sysctl:write`, `ntp:read`, `ntp:write`, `timezone:read`, `timezone:write`, `power:execute`, `process:read`, `process:execute`, `user:read`, `user:write`, `package:read`, `package:write`, `log:read`, `certificate:read`, `certificate:write`, `service:read`, `service:write` | -| `write` | `agent:read`, `node:read`, `node:write`, `network:read`, `network:write`, `job:read`, `job:write`, `health:read`, `file:read`, `file:write`, `docker:read`, `docker:write`, `cron:read`, `cron:write`, `sysctl:read`, `sysctl:write`, `ntp:read`, `ntp:write`, `timezone:read`, `timezone:write`, `process:read`, `user:read`, `user:write`, `package:read`, `package:write`, `log:read`, `certificate:read`, `certificate:write`, `service:read`, `service:write` | -| `read` | `agent:read`, `node:read`, `network:read`, `job:read`, `health:read`, `file:read`, `docker:read`, `cron:read`, `sysctl:read`, `ntp:read`, `timezone:read`, `process:read`, `user:read`, `package:read`, `log:read`, `certificate:read`, `service:read` | +| `write` | `agent:read`, `node:read`, `node:write`, `network:read`, `network:write`, `job:read`, `job:write`, `health:read`, `file:read`, `file:write`, `docker:read`, `docker:write`, `cron:read`, `cron:write`, `sysctl:read`, `sysctl:write`, `ntp:read`, `ntp:write`, `timezone:read`, `timezone:write`, `process:read`, `user:read`, `user:write`, `package:read`, `package:write`, `log:read`, `certificate:read`, `certificate:write`, `service:read`, `service:write` | +| `read` | `agent:read`, `node:read`, `network:read`, `job:read`, `health:read`, `file:read`, `docker:read`, `cron:read`, `sysctl:read`, `ntp:read`, `timezone:read`, `process:read`, `user:read`, `package:read`, `log:read`, `certificate:read`, `service:read` | ### Custom Roles