[SOLR-16671] Explicitly call out library permissions for config-edit

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Done
• Fix Version/s: 8.11.3, 9.2
• Component/s: Authorization, documentation, security
• Assignee: Houston Putman
• Reporter: Houston Putman
• Created: 17/Feb/23 19:54
• Updated: 27/Mar/23 18:07
• Resolved: 20/Feb/23 03:07

Description

A lot of security questions arise from various options to add custom libraries via a solrconfig.xml. When using the recommended solr auth plugin, a user requires the config-edit permission to edit this file. And custom libraries will only be used when the solrconfig is trusted by Solr.

Right now the  config-edit permission documentation does not explicitly spell out that the permission gives users the ability to install any custom library to Solr. We should fix this to reduce confusion around RCEs.

With our antora docs, I suggest we backport this documentation change to 9.0 and 9.1, and also update 8.11 for the next patch release.

Issue Links

• links to: GitHub Pull Request #1370