From b4e4e1425061518d25f89409ff67707148ff82de Mon Sep 17 00:00:00 2001 From: Julia Bardi Date: Wed, 6 Aug 2025 14:48:08 +0200 Subject: [PATCH] Revert "[Fleet] add privileges to `kibana_system` to read integrations data (#132400)" This reverts commit 364c70e02e036abd3aaca07a9b8eaa303f1c25bd. --- .../authz/store/KibanaOwnedReservedRoleDescriptors.java | 2 -- .../core/security/authz/store/ReservedRolesStoreTests.java | 5 +---- 2 files changed, 1 insertion(+), 6 deletions(-) diff --git a/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java b/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java index eb0c77deb86c2..96287843e6943 100644 --- a/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java +++ b/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java @@ -328,8 +328,6 @@ static RoleDescriptor kibanaSystem(String name) { "indices:admin/data_stream/lifecycle/put" ) .build(), - // Read datasets for auto install content packages feature in Fleet - RoleDescriptor.IndicesPrivileges.builder().indices("logs-*", "metrics-*", "traces-*").privileges("read").build(), // Endpoint specific action responses. Kibana reads and writes (for third party // agents) to the index to display action responses to the user. // `create_index`: is necessary in order to ensure that the DOT datastream index is diff --git a/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java b/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java index 04e0355f7a773..21e3d3ad0cd6c 100644 --- a/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java +++ b/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java @@ -1397,10 +1397,7 @@ public void testKibanaSystemRole() { || indexName.startsWith(".logs-endpoint.actions-") || indexName.startsWith(".logs-endpoint.action.responses-") || indexName.startsWith(".logs-endpoint.heartbeat-") - || indexName.startsWith(".logs-osquery_manager.actions-") - || indexName.startsWith("logs-") - || indexName.startsWith("metrics-") - || indexName.startsWith("traces-"); + || indexName.startsWith(".logs-osquery_manager.actions-"); assertThat( kibanaRole.indices().allowedIndicesMatcher(TransportGetAction.TYPE.name()).test(indexAbstraction), is(isAlsoReadIndex)