topic Re: permissions question in Security

permissions question

a212830 — Tue, 27 May 2014 13:03:00 GMT

Hi,

Once a view is created and made private, does a power user have the ability to change the permissions? I have some users who can't change permissions after saving the original item as private.

Re: permissions question

jkat54 — Tue, 27 May 2014 13:41:19 GMT

Does the view belong to the user who marked it private? If they didnt create the view they wont see it after they mark it private because it's private to owner not the person who marks it private.

Re: permissions question

a212830 — Tue, 27 May 2014 14:02:26 GMT

He is listed as the owner, but Permissions link isn't there.

Re: permissions question

jkat54 — Mon, 28 Sep 2020 16:43:54 GMT

My guess it's a file permissions issue:

If splunkd was running as root when the view was created. That would make the .conf file owned by root. Then if the current owner of splunkd has changed to something like splunk_daemon_service_account, splunkd wouldnt be able to edit the file.

Re: permissions question

jkat54 — Mon, 28 Sep 2020 16:43:57 GMT

I think this would reveal the permissions issue if it existed: index=_internal ( source="*splunkd.log" ) ( log_level="ERROR" )

You should see something like "file not found", "permission denied" etc.

Re: permissions question

ofrachon — Tue, 27 May 2014 15:30:44 GMT

Roles are implemented within Splunk with different capabilities : http://docs.splunk.com/Documentation/Splunk/6.1.1/Security/Rolesandcapabilities#List_of_available_capabilities

If the power user you're talking about has the proper capability, (s)he'll be able to change Permissions.

Another possibility is to do that directly by editing the .conf files within the user's directory.

Re: permissions question

a212830 — Tue, 27 May 2014 16:51:43 GMT

Bingo. We implemented new roles with 6.1.1 and this user was put in a different role. All set. Thanks.