commit bd604760285e3def12c59e84f4d0b933827ab775
author ankita prasad <ankita.prasad@intel.com> Wed Jan 18 10:56:43 2023 +0000
committer Vernon Mauery <vernon.mauery@linux.intel.com> Wed Feb 15 16:59:33 2023 +0000
tree 8692e3a52b0f43d255e8f9aced4e6e19355c1d17
parent a42ee6be9b65c30505e53a7311f1be8494a06b65

Revoking the GetUserAccess privilege for Operator

In IPMITOOL, operator can see all the accounts for "user list 3" command. This
poses a security issue. It not consistent with Redfish beheviour where the
Operator user is unable to view other users. This change revokes the Operator
to see other users over IPMITOOL.

Tested: Operator unable to view the users through IPMI
ipmitool -I lanplus -H <ip-address> -U <userid> -P <password> -L Operator -C 17 user list 3
IPMI command failed: Insufficient privilege level

Change-Id: I5b200a85662a05bfdf1fce395e7acff6bbf1a22e
Signed-off-by: Ankita Prasad <ankita.prasad@intel.com>

user_channel/usercommands.cpp

diff --git a/user_channel/usercommands.cpp b/user_channel/usercommands.cpp
index 901e4a6..4ea8c4b 100644
--- a/user_channel/usercommands.cpp
+++ b/user_channel/usercommands.cpp
@@ -652,11 +652,11 @@
 
     ipmi::registerHandler(ipmi::prioOpenBmcBase, ipmi::netFnApp,
                           ipmi::app::cmdGetUserAccessCommand,
-                          ipmi::Privilege::Operator, ipmiGetUserAccess);
+                          ipmi::Privilege::Admin, ipmiGetUserAccess);
 
     ipmi::registerHandler(ipmi::prioOpenBmcBase, ipmi::netFnApp,
                           ipmi::app::cmdGetUserNameCommand,
-                          ipmi::Privilege::Operator, ipmiGetUserName);
+                          ipmi::Privilege::Admin, ipmiGetUserName);
 
     ipmi::registerHandler(ipmi::prioOpenBmcBase, ipmi::netFnApp,
                           ipmi::app::cmdSetUserName, ipmi::Privilege::Admin,