Role-Based Access Control (RBAC)

JavaScript is not currently enabled, but is required for full CodeSonar manual search and browse functionality.

If you are viewing this file in your hub's Web GUI, enable JavaScript in your browser: you will also need it for GUI functionality.

If you opened this file directly from disk, your browser may be directly suppressing JavaScript functionality: certain browsers perform this suppression on local files (but not files delivered by web servers) for security reasons.

If you access the manual through the hub's Web GUI, the functionality will not be suppressed because the hub is a web server.
Alternatively, your browser may allow you to explicitly disable the security setting that suppresses functionality. See the CodeSonar FAQ for more information.

CodeSonar^® 9.2p0

CONFIDENTIAL

CodeSecure Inc

General

Role-Based Access Control (RBAC)

CodeSonar uses a Role Based Access Control (RBAC) scheme to restrict access to information and functionality.

This section provides an overview of RBAC in CodeSonar, with links to further information.

Overview
Viewing and Modifying RBAC Information
Immutable RBAC Elements
Permissions Required for RBAC Modifications
More Information

Overview

CodeSonar uses a Role Based Access Control (RBAC) scheme to restrict access to information and functionality. In brief, this works as follows.

The information (including analysis results and administrative information) on a CodeSonar hub is considered as a collection of securable resources.
The hub manages a set of roles, each of which has a set of role-permissions that describes the kinds of access (" permissions") the role has for each securable resource on the hub.
Each user on the hub is assigned a nonempty set of roles. The user is then considered to have all permissions that are held by at least one of the user's roles.
In a limited set of special cases CodeSonar will behave as if a user has certain permissions that are not conferred by their roles, or does not have certain permissions that would otherwise be conferred: see RBAC: Role-Permissions: Special User Permission Adjustments for details.

Note in particular that users are never assigned permissions directly: they can only acquire permissions through their role assignments (and special-case behavior).

See the manual pages about these individual RBAC element types for full details and examples.

Viewing and Modifying RBAC Information

RBAC-related information can be viewed and modified in the CodeSonar GUI as shown in the following table.

Element Type

Viewing and Modifying

Role-Permissions

Several GUI pages provide access to role-permission information.

Global Role-Permissions	[one]	View and modify the global role-permission assignments for all roles.
Resource Role-Permissions	[one per securable resource]	View and modify the role-permission assignments for single securable resource.

Resources

See the table entry on role-permissions for information about viewing and modifying role-permissions with respect to a specific securable resource.

Information about the resources themselves (plus the "global" resource that is the subject of global permissions) is presented throughout the CodeSonar GUI. See GUI Reference: CodeSonar Page Types for more information.

Roles

Several GUI pages provide access to role information.

Roles	[one]	List all roles on the hub, add roles, delete roles.
Role Users	[one per role]	List all users that are assigned a particular role, add users to this set, remove users from this set (dual of User Roles).
Role Ancestors	[one per role]	List all roles that are ancestors of a particular role, add roles to this set, remove roles from this set.
User Roles	[one per user]	View and modify role assignments for a user (dual of Role Users).

Permissions

The set of permission types is fixed. For a full list, see RBAC: Permissions.

Users

Several GUI pages provide access to user information.

Users	[one]	List all users on the hub.
Role Users	[one per role]	List all users that are assigned a particular role, add users to this set, remove users from this set (dual of User Roles).
User Roles	[one per user]	View and modify role assignments for a user (dual of Role Users).
Account Editor	[one per user]	View and modify other settings (including default role) for a user.

Immutable RBAC Elements

Certain elements within the CodeSonar RBAC framework are immutable; certain others are mutable but cannot be deleted. These are summarized in the following table, and described in detail in the corresponding manual pages.

Element Type	Immutable and Undeletable Elements
Role-Permissions	The Enabled, Anyone, and Administrator roles each have immutable role-permissions. For complete lists, see Default Role-Permissions and Immutable Role-Permissions. The special Anonymous user is always treated as if it does not have certain permissions, even if it would otherwise have those permissions through its assigned roles. For a complete list, see Role-Permissions: Negated Role-Permissions for Anonymous
Resources	The all named searches (there is one for each search domain) cannot be deleted or modified. The root project tree and root launchd group cannot be deleted.
Roles	The Enabled, Anyone, and Administrator roles cannot be renamed or deleted. The Enabled role cannot be assigned any parent roles. The Administrator user always has the Administrator role. All users always have the Anyone role.
Users	Special users Administrator and Anonymous cannot be deleted. The Administrator user always has the Administrator role. All users always have the Anyone role. The Anonymous user is always treated as if it does not have certain permissions.

Permissions Required for RBAC Modifications

The RBAC information managed by the CodeSonar hub is itself subject to access control.

The key permission is G_ADMINISTER_USERS, which is required for the following RBAC-related operations.

Adding and deleting roles, modifying parent roles, modifying user role assignments.
Modifying global role-permission assignments.
Modifying resource role-permission assignments (unless the user has the appropriate *_ADMINISTER permission for the resource in question, in which case they do not require G_ADMINISTER_USERS).
Adding and deleting users, modifying user settings.

More Information

The following manual sections provide more information on RBAC and related topics.

To report problems with this documentation, please visit https://support.codesecure.com/.