RBAC: Securable Resources

• Resources and Applicable Permissions
• Relationships
• Special-Case Resources

Under role-based access control (RBAC), a role can be assigned a particular permission for a particular resource. We call this relationship a role-permission.

We say that:

• A CodeSonar element is a securable resource if it is subject to access control.
• A permission is applicable to a resource if the permission controls access to some operation on that resource.

Resource Types and Applicable Permissions

Relationships

The securable resource types can be divided into two groups.

• Independent resource types exist in isolation: there are no relationships between different independent resource types and no relationships between resources of any of these types. A role-permission involving a resource of independent type can be direct or role-inherited (or both): it cannot be resource-inherited, since there is no resource hierarchy to inherit through, nor can it be the source of a resource-inherited role-permission for another resource.
  The independent resource types are Warning Processor, Saved Chart, Named Search, Report Template, and Role.
  
• Hierarchical resource types exist in one of two hierarchies.
  • Project Tree / Project / Analysis : each Project Tree contains zero or more Project Trees and zero or more Projects; each Project contains zero or more Analyses. The root of the hierarchy is always the Root Project Tree.
    
  • Launchd Group / Launch Daemon : each Launchd Group contains zero or more Launchd Groups and zero or more Launch Daemons. The root of the hierarchy is always the Root Launchd Group.
    
  A role-permission involving a resource of hierarchical type can be direct, role-inherited, or resource-inherited (or any combination of these).

Special-Case Resources

Certain resources have special permission handling.

• Immutable securable resources cannot be deleted or modified.
• Undeletable securable resources cannot be deleted, but can be modified.
• A small number of resources that would otherwise be of securable type are treated as unsecurable: all users have the same degree of access to these resources, and this degree of access cannot be modified.

Immutable Securable Resources

An immutable securable resource is subject to access control but cannot be deleted or modified, even by a user that has the appropriate *_DELETE or *_MODIFY permission for that resource.

There is currently one set of immutable securable resources: the all named searches (there is one for each search domain).

Note also that some (mutable and immutable) resources have immutable role-permissions associated with them.

Undeletable Securable Resources

An undeletable securable resource is subject to access control but cannot be deleted, even by a user that has the appropriate *_DELETE permission for that resource. Note that all immutable resources are undeletable, but not all undeletable resources are immutable.

The following resources are undeletable.

• The root project tree.
• The root launchd group.

Unsecurable Resources

The following are not securable resources and are not subject to RBAC.

• Predefined management report templates are available to all users, but cannot be modified or deleted.
  Reports generated from the predefined templates are not themselves exempt from RBAC. For more information, see Management Reports: Permissions.
• Chart shortcuts are available to all users, but cannot be modified or deleted.
  The charts linked by the shortcuts are not themselves exempt from RBAC. For more information, see Charts and Tables: Permissions.