Restrict Resource Dump Creation to service user#1408
Draft
asmithakarun wants to merge 1 commit intoibm-openbmc:1120from
Draft
Restrict Resource Dump Creation to service user#1408asmithakarun wants to merge 1 commit intoibm-openbmc:1120from
asmithakarun wants to merge 1 commit intoibm-openbmc:1120from
Conversation
This change ensures that resource dump creation requests are permitted
to admin and service user — specifically, a user with the
"priv-oemibmserviceagent" and "priv-admin" privilege.
Admin users must be allowed to issue resource dumps without any password
string, and PHYP checks their authority based on the exact macro they
invoked.
Requests from any other users will be denied with an "Insufficient
Privilege" error response from bmcweb.
The rationale behind this restriction is that resource dumps are
intended solely for debugging issues in resources of the host, which
are to be collected exclusively by service user. As such, access is
limited to service und admin sers and explicitly restricted for all
others.
Tested By:
[1] POST https://${bmc}/redfish/v1/Systems/system/LogServices/Dump/Actions/LogService.CollectDiagnosticData -d '{"DiagnosticDataType":"OEM","OEMDiagnosticDataType":"Resource_<string>_<pwd>"}'
Performed above operation for service user and admin user and verified
the following cases:
1. From a session with Role=Administrator, initiate a resource dump and
do not supply the service user password - Dump collected successfully
2. From a session with Role=Administrator, initiate a resource dump with
a non-empty service user password - Insufficient privilege error
3. From a session with the service user, initiate a resource dump with a
non-empty service user password - Dump collected successfully
4. From a session with the service user, initiate a resource dump with
no password - Dump collected successfully
Signed-off-by: Asmitha Karunanithi <asmitk01@in.ibm.com>
Contributor
Author
|
This is a missed PR during rebase of 1120. 1110 PR: #1262 |
Contributor
Author
|
I am yet to verify it. Will update once done. |
baemyung
approved these changes
Mar 4, 2026
Contributor
baemyung
left a comment
There was a problem hiding this comment.
It looks good as this makes the same as 1110.
(the part was missing during 1120 rebase)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This change ensures that resource dump creation requests are permitted to admin and service user — specifically, a user with the "priv-oemibmserviceagent" and "priv-admin" privilege.
Admin users must be allowed to issue resource dumps without any password string, and PHYP checks their authority based on the exact macro they invoked.
Requests from any other users will be denied with an "Insufficient Privilege" error response from bmcweb.
The rationale behind this restriction is that resource dumps are intended solely for debugging issues in resources of the host, which are to be collected exclusively by service user. As such, access is limited to service und admin sers and explicitly restricted for all others.
Tested By:
[1] POST https://${bmc}/redfish/v1/Systems/system/LogServices/Dump/Actions/LogService.CollectDiagnosticData -d '{"DiagnosticDataType":"OEM","OEMDiagnosticDataType":"Resource__"}'
Performed above operation for service user and admin user and verified the following cases: