Security

Is there a way to unimport roles or disable capabilities for a certain role?

the_wolverine
Champion

Is there a way to unimportRoles or disable capabilities for a certain role? I don't believe so based on the documentation:

[role_<roleName>]
<capability> = <enabled>
...
    * Roles inherit all capabilities from imported roles, and inherited
      capabilities cannot be disabled.
...

importRoles = <string>
* Semicolon delimited list of other roles and their associated capabilities
  that should be imported.
* Importing other roles also imports the other aspects of that role, such as
  allowed indexes to search.

We would like to create a custom role to override inherited capabilities. An example would be a system account which has less capabilities but has inherited user role capabilities. Right now it seems like an RFE.

0 Karma

phadnett_splunk
Splunk Employee
Splunk Employee

One solution might be to create a new role (ie. user-system) with fewer capabilities than the normal 'user' role. Then have your 'system-account' role inherit this new 'user-system' role along with the capabilities assigned to it.

Is this what you are looking to achieve?

0 Karma

the_wolverine
Champion

Thanks for your response but this is not what I'm looking for. Since group membership allows a group owner to add their system-account to their own group, the system-account then inherits user capabilities. Even if I find out about the system-account and drop it into a system-account-role, it doesn't uninherit the capabilities already granted by a user role.

This is why I am looking for a way to uninherit or disable capabilities.

0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! &#x1f308; In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...