Giters

google / grr

GRR Rapid Response: remote live forensics for incident response

Home Page:https://grr-doc.readthedocs.io/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Removing a label created by another user doesn't work

atkinsj opened this issue · comments

commented

I'm unable to remove labels on hosts. v3.4.0.1 server and clients.

  1. Add label to host
  2. Try to remove label from host
  3. Label is not removed
commented

Thanks for the report!
I suppose you do it from the UI. If you open Chrome Dev tools, do you see anything suspicious, like Javascript errors in the console or network errors in the Network tab?

commented

Nothing in the console, I did try the API via Python as well: client.RemoveLabel(label) but it has no effect.

commented

Hm, I can't reproduce on a fresh v3.4.0.1 deployment.

Two questions:

  1. In the console, what is the output of client.data.labels? Who is the owner of the label?
  2. If you run the AdminUI in verbose mode (see https://grr-doc.readthedocs.io/en/latest/installing-grr-server/troubleshooting.html#any-some-of-the-grr-services-are-not-running-correctly), do you see anything suspicious logged to the terminal?
commented

Huh, so the owner of the label is a user other than me. Am I only able to remove labels added by myself?

Our deployment makes restarting the server with --verbose a little more difficult, will have to give that a shot later.

commented

@atkinsj - yes, I think the owner issue is the root cause:
https://github.com/google/grr/blob/master/grr/server/grr_response_server/gui/api_plugins/client.py#L641

The code removes the label only for the user who makes the request. This sounds like a regression: IIRC, we didn't have this limitation in AFF4.