# User able to view vault path despite the deny

**URL:** <https://discuss.hashicorp.com/t/user-able-to-view-vault-path-despite-the-deny/55412>\
**Category:** Vault\
**Tags:** vault\
**Created:** [June 26, 2023, 9:34am UTC](https://discuss.hashicorp.com/t/user-able-to-view-vault-path-despite-the-deny/55412 "2023-06-26T09:34:03Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![pantelis-karamolegko](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/pantelis-karamolegko/32/9919_2.png) [@pantelis-karamolegko](https://discuss.hashicorp.com/u/pantelis-karamolegko)\
**Post date:** [June 26, 2023, 9:34am UTC](https://discuss.hashicorp.com/t/user-able-to-view-vault-path-despite-the-deny/55412/1 "2023-06-26T09:34:03Z")

</div>

I have applied the following `vault` policies

```plaintext
super-policy:
  - capabilities:
      - create
      - read
      - update
      - patch
      - delete
      - list
      - sudo
    path: /*
  - capabilities:
      - deny
    path: /specific
specific-policy:
  - capabilities:
      - create
      - read
      - update
      - patch
      - delete
      - list
    path: /specific
  - capabilities:
      - create
      - read
      - update
      - patch
      - delete
      - list
    path: /specific/*

```

A user has been assigned both the `specific-policy` **and** the `super-policy`.

Why is he able to see the `specific` path given that the `super-policy` has a `deny` capability` for this path?

**update 1** : each policy has been assigned to a group and the user I am talking about is a member of both groups FWIW

**update 2** : I have aggregated all the policies applied to the specific user here

```plaintext
path "/*" {
  capabilities = ["create", "delete", "list", "patch", "read", "sudo", "update"]
}

path "/specific" {
  capabilities = ["deny"]
}
path "/testing" {
  capabilities = ["create", "delete", "list", "patch", "read", "update"]
}

path "/testing/*" {
  capabilities = ["create", "delete", "list", "patch", "read", "update"]
}
path "/specific" {
  capabilities = ["create", "delete", "list", "patch", "read", "update"]
}

path "/specific/*" {
  capabilities = ["create", "delete", "list", "patch", "read", "update"]
}
path "/testing" {
  capabilities = ["list"]
}

path "/testing/*" {
  capabilities = ["list"]
}

```

Τhe user is able to

a) see the `/specific` path in the ui  
b) perform a ` vault kv get -mount=specific foo/bar/lala`

---

<div class="post-metadata">

**Author:** ![maxb](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/maxb/32/26655_2.png) [@maxb](https://discuss.hashicorp.com/u/maxb)\
**Post date:** [June 26, 2023, 9:40am UTC](https://discuss.hashicorp.com/t/user-able-to-view-vault-path-despite-the-deny/55412/2 "2023-06-26T09:40:50Z")

</div>

It’s kind of weird that you’re representing Vault policies as a custom YAML format, different from the native formats the product inherently supports.

Also your policies mention the path `specific` but then your question talks about the path `restricted`. Those paths are different so of course the `deny` does not apply.

---

<div class="post-metadata">

**Author:** ![pantelis-karamolegko](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/pantelis-karamolegko/32/9919_2.png) [@pantelis-karamolegko](https://discuss.hashicorp.com/u/pantelis-karamolegko)\
**Post date:** [June 26, 2023, 9:41am UTC](https://discuss.hashicorp.com/t/user-able-to-view-vault-path-despite-the-deny/55412/3 "2023-06-26T09:41:43Z")

</div>

That was a `typo`, updated to `specific`

---

<div class="post-metadata">

**Author:** ![maxb](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/maxb/32/26655_2.png) [@maxb](https://discuss.hashicorp.com/u/maxb)\
**Post date:** [June 26, 2023, 9:43am UTC](https://discuss.hashicorp.com/t/user-able-to-view-vault-path-despite-the-deny/55412/4 "2023-06-26T09:43:09Z")

</div>

I think you need to show us real Vault CLI commands or something, so we can see what is actually being invoked.

In the presented scenario, the user does **NOT** have access to `specific`, because it is denied. They do however have access to `specific/*`, which isn’t.

---

<div class="post-metadata">

**Author:** ![pantelis-karamolegko](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/pantelis-karamolegko/32/9919_2.png) [@pantelis-karamolegko](https://discuss.hashicorp.com/u/pantelis-karamolegko)\
**Post date:** [June 26, 2023, 10:20am UTC](https://discuss.hashicorp.com/t/user-able-to-view-vault-path-despite-the-deny/55412/5 "2023-06-26T10:20:38Z")

</div>

I tried to make the question a bit more clear, check my update whenever possible

---

<div class="post-metadata">

**Author:** ![maxb](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/maxb/32/26655_2.png) [@maxb](https://discuss.hashicorp.com/u/maxb)\
**Post date:** [June 26, 2023, 11:14am UTC](https://discuss.hashicorp.com/t/user-able-to-view-vault-path-despite-the-deny/55412/6 "2023-06-26T11:14:27Z")

</div>

Vault is behaving as expected given this policy input.

> [@pantelis-karamolegko](#):
>
> a) see the `/specific` path in the ui

IIRC, visibility in the UI is controlled by a test for “Does this user have access to any sub-path within the particular mount.” - which in this case they do.

> [@pantelis-karamolegko](#):
>
> b) perform a ` vault kv get -mount=specific foo/bar/lala`

That’s going to translate into a request to either:

- `specific/foo/bar/lala` (if a KV v1)
- `specific/data/foo/bar/lala` (if a KV v2)

Neither of these are exact matches of the string `specific`, which is what the `deny` rule is for.

I imagine you probably want to deny `specific/*`.

Although, do be aware that such a deny can still be overridden by allowing access on `specific/even-more-specific`.

---

<div class="post-metadata">

**Author:** ![pantelis-karamolegko](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/pantelis-karamolegko/32/9919_2.png) [@pantelis-karamolegko](https://discuss.hashicorp.com/u/pantelis-karamolegko)\
**Post date:** [June 26, 2023, 11:49am UTC](https://discuss.hashicorp.com/t/user-able-to-view-vault-path-despite-the-deny/55412/7 "2023-06-26T11:49:49Z")

</div>

> [@pantelis-karamolegko](#):
>
> ```auto
> path "/specific" {
> capabilities = ["deny"]
> }
> 
> ```

So this should deny access only to the `/specific` path and not to its subpaths. E.g. If I have this policy

```hcl
path "/*" {
  capabilities = ["create", "delete", "list", "patch", "read", "sudo", "update"]
}

path "/specific" {
  capabilities = ["deny"]
}

```

I should be able to

a) view the `/specific` path in the UI  
b) perform a `vault kv get -mount=specific foo/bar/lala