Users are able to see search results from index that they don't have permission

[ps]

Hi,

I am using Splunk Enterprise Version:8.0.1

I bunch of indexes and roles for users. I created a role that has only one capability "search" and only permission to one index (included, default).

When I run search command eg. * from Search & Reporting's search I get expected result, only search results from the index that user has permission.

If I run search: index IN("<index_with_permission>" "<index_not_permission_in_role") I get all the results also from the index that user has no permission. Any idea what could be the issue?

[gcusello]

Hi @ps,

check if you inherited your role from another one (e.g. user), in this case you have all the grants of the other role.

Ciao.

Giuseppe

[ps]

Hi,

Role is newly generated for this test after I noticed this problem, not inherited any permissions and have only "search" capability in capability list.

[gcusello · Accepted solution]

Hi @ps,

inheritance is the only way because you have access to an index not directly grated.

Ciao.

Giuseppe

[ps]

Hi,

Thanks for quick answer. I checked user again and you were correct. Splunk default role "user" allows you to search from any index that you don't even have permission. After removing this search results are as expected.

[gcusello]

Hi @ps,

good for you!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉