[che-dev] Question about Uses, Roles and Workspace access

["Cohen, Dror" <dror.cohen@xxxxxxx>]

Hi,

I would appreciate an explanation on Che Workspace permissions:

 

I am creating che users with the following roles: "workspace/admin", "workspace/developer"

Currently,

User A can read and even modify a file in user B's workspace, even if I created the file in a 'visibility=private'  project.

 

When debugging (in che_core_vfs_impl) , I see that read or write permission is granted based on ACLs, on the user's "workspace/developer" role,

even though that user is not a member of that workspace…

Could it be that this check is missing?

 

Or am I doing something wrong here…

I am trying to restrict a user's write access to another workspace.

 

I appreciate your help

Regards,

Dror