Skip to content

Restrict Resource Dump Creation to service user#1408

Draft
asmithakarun wants to merge 1 commit intoibm-openbmc:1120from
asmithakarun:rscDumpCheck1120
Draft

Restrict Resource Dump Creation to service user#1408
asmithakarun wants to merge 1 commit intoibm-openbmc:1120from
asmithakarun:rscDumpCheck1120

Conversation

@asmithakarun
Copy link
Copy Markdown
Contributor

This change ensures that resource dump creation requests are permitted to admin and service user — specifically, a user with the "priv-oemibmserviceagent" and "priv-admin" privilege.

Admin users must be allowed to issue resource dumps without any password string, and PHYP checks their authority based on the exact macro they invoked.

Requests from any other users will be denied with an "Insufficient Privilege" error response from bmcweb.

The rationale behind this restriction is that resource dumps are intended solely for debugging issues in resources of the host, which are to be collected exclusively by service user. As such, access is limited to service und admin sers and explicitly restricted for all others.

Tested By:
[1] POST https://${bmc}/redfish/v1/Systems/system/LogServices/Dump/Actions/LogService.CollectDiagnosticData -d '{"DiagnosticDataType":"OEM","OEMDiagnosticDataType":"Resource__"}'

Performed above operation for service user and admin user and verified the following cases:

  1. From a session with Role=Administrator, initiate a resource dump and do not supply the service user password - Dump collected successfully
  2. From a session with Role=Administrator, initiate a resource dump with a non-empty service user password - Insufficient privilege error
  3. From a session with the service user, initiate a resource dump with a non-empty service user password - Dump collected successfully
  4. From a session with the service user, initiate a resource dump with no password - Dump collected successfully

This change ensures that resource dump creation requests are permitted
to admin and service user — specifically, a user with the
"priv-oemibmserviceagent" and "priv-admin" privilege.

Admin users must be allowed to issue resource dumps without any password
string, and PHYP checks their authority based on the exact macro they
invoked.

Requests from any other users will be denied with an "Insufficient
Privilege" error response from bmcweb.

The rationale behind this restriction is that resource dumps are
intended solely for debugging issues in resources of the host, which
are to be collected exclusively by service user. As such, access is
limited to service und admin sers and explicitly restricted for all
others.

Tested By:
[1] POST https://${bmc}/redfish/v1/Systems/system/LogServices/Dump/Actions/LogService.CollectDiagnosticData -d '{"DiagnosticDataType":"OEM","OEMDiagnosticDataType":"Resource_<string>_<pwd>"}'

Performed above operation for service user and admin user and verified
the following cases:

1. From a session with Role=Administrator, initiate a resource dump and
   do not supply the service user password - Dump collected successfully
2. From a session with Role=Administrator, initiate a resource dump with
   a non-empty service user password  - Insufficient privilege error
3. From a session with the service user, initiate a resource dump with a
   non-empty service user password - Dump collected successfully
4. From a session with the service user, initiate a resource dump with
   no password - Dump collected successfully

Signed-off-by: Asmitha Karunanithi <asmitk01@in.ibm.com>
@asmithakarun
Copy link
Copy Markdown
Contributor Author

This is a missed PR during rebase of 1120.

1110 PR: #1262

@asmithakarun asmithakarun marked this pull request as draft March 2, 2026 07:01
@asmithakarun
Copy link
Copy Markdown
Contributor Author

I am yet to verify it. Will update once done.

@asmithakarun asmithakarun requested a review from raviteja-b March 2, 2026 07:22
Copy link
Copy Markdown
Contributor

@baemyung baemyung left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It looks good as this makes the same as 1110.
(the part was missing during 1120 rebase)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants