627d3f5ff5
Endpoint locks -------------- Adds EndpointLock so an admin can hold an endpoint against automated and operator action, with migration 0018 and enforcement in the enqueue path rather than only in the UI, so a lock cannot be bypassed by calling the API directly. Split endpoints.deploy ---------------------- endpoints.deploy bundled three actions of very different risk behind a single name: scheduledtask_run -> starts a task already registered and allowlisted update_app -> runs a pinned installer run_script -> arbitrary code as SYSTEM unless the descriptor pins a user context Because they shared one grant there was no way to let an operator push an application update without also handing them arbitrary SYSTEM code execution on every endpoint they could reach. The permission name described the lightest of the three while silently carrying the heaviest. commands.ELEVATED_ACTION_PERMISSIONS now maps each action to its own permission (endpoints.corptools, endpoints.updateapp, endpoints.runscript). The enqueue route reads that table, so no route logic changed. Migration 7d42 preserves existing access exactly: anyone holding endpoints.deploy receives all three replacements.
19 lines
562 B
Python
19 lines
562 B
Python
"""Endpoints plugin models."""
|
|
|
|
from .endpoint import (
|
|
EndpointState, EndpointEvent, EndpointCommand, EndpointApplication,
|
|
EndpointLock,
|
|
)
|
|
from .monitor import EndpointMonitor
|
|
from .operatorreport import OperatorReport
|
|
from .health import (
|
|
EndpointHealthState, EndpointHealthTransition, EndpointMonitorImpact,
|
|
)
|
|
|
|
__all__ = [
|
|
'EndpointState', 'EndpointEvent', 'EndpointCommand', 'EndpointApplication',
|
|
'EndpointLock',
|
|
'EndpointMonitor', 'OperatorReport',
|
|
'EndpointHealthState', 'EndpointHealthTransition', 'EndpointMonitorImpact',
|
|
]
|