ACL: model-change and audit events reach Server-object (i=2253) items ungated #588

New Issue

2026-10-07T23:51:29-04:00

dohertj2 commented

2026-10-07 23:51:29 -04:00

Found by the independent review of the #586 fix. Residual named in docs/security.md + CLAUDE.md.

With Security:Acl:Enabled=true, events that go straight to the core Server object still reach every Server-object (i=2253) event item without an ACL decision:

GeneralModelChange events — RaiseNodesAddedModelChange (~OtOpcUaNodeManager.cs:2462) and ReportModelChangeOutsideLock (~2648) call Server.ReportEvent with the affected NodeIds, so a session with no grant learns the names (RawPaths) of nodes it cannot browse.
Audit events — ReportAuditEvent (~2055) would carry written values to any i=2253 session if Server.Auditing were enabled (requires an encrypted channel).

A node manager has no hook on the core Server object's delivery, so this needs a different seam (e.g. filter affected-node lists per session, suppress model-change NodeIds the session cannot Browse, or route these through our own per-session delivery like #586 did for conditions).

Decide the shape; gate model-change payloads per session (Browse) when ACL is on.
Audit events: confirm they stay off by default; gate or document.
Over-the-wire test: a no-grant i=2253 session receives no model-change event naming a node it cannot browse.

Found by the independent review of the #586 fix. Residual named in docs/security.md + CLAUDE.md. With `Security:Acl:Enabled=true`, events that go straight to the core Server object still reach every Server-object (i=2253) event item without an ACL decision: - **GeneralModelChange** events — `RaiseNodesAddedModelChange` (~`OtOpcUaNodeManager.cs:2462`) and `ReportModelChangeOutsideLock` (~2648) call `Server.ReportEvent` with the affected NodeIds, so a session with no grant learns the names (RawPaths) of nodes it cannot browse. - **Audit** events — `ReportAuditEvent` (~2055) would carry written values to any i=2253 session if `Server.Auditing` were enabled (requires an encrypted channel). A node manager has no hook on the core Server object's delivery, so this needs a different seam (e.g. filter affected-node lists per session, suppress model-change NodeIds the session cannot Browse, or route these through our own per-session delivery like #586 did for conditions). - [ ] Decide the shape; gate model-change payloads per session (Browse) when ACL is on. - [ ] Audit events: confirm they stay off by default; gate or document. - [ ] Over-the-wire test: a no-grant i=2253 session receives no model-change event naming a node it cannot browse.

dohertj2 referenced this issue from a commit

2026-10-08 01:53:39 -04:00

fix(alarms,acl): one condition event per Part 9 method call; gate Server-object model-change/audit events (#587, #588)

dohertj2 referenced this issue

2026-10-08 01:53:58 -04:00

ACL: Server-object (i=2253) event subscriptions bypass the data-plane ACL #586

dohertj2 commented

2026-10-08 01:53:59 -04:00

Fixed: all four Server.ReportEvent sites go through ReportToServerObject; with ACL on, GeneralModelChange events are narrowed to nodes the session may Browse (dropped if none) and audit events also need Read on the source. ACL off unchanged. (merge 3803df04 on master, pushed 2026-10-08)

Fixed: all four Server.ReportEvent sites go through ReportToServerObject; with ACL on, GeneralModelChange events are narrowed to nodes the session may Browse (dropped if none) and audit events also need Read on the source. ACL off unchanged. (merge `3803df04` on master, pushed 2026-10-08)

dohertj2 closed this issue

2026-10-08 01:53:59 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: dohertj2/lmxopcua#588