Update Job start / access permissions

awx/main/access.py

@@ -312,8 +312,15 @@ class InventoryAccess(BaseAccess):
         return qs.select_related('created_by', 'modified_by', 'organization').all()
 
     def can_read(self, obj):
+        if self.user.is_superuser:
+            return True
         return obj.accessible_by(self.user, {'read': True})
 
+    def can_use(self, obj):
+        if self.user.is_superuser:
+            return True
+        return obj.accessible_by(self.user, {'use': True})
+
     def can_add(self, data):
         # If no data is specified, just checking for generic add permission?
         if not data:
@@ -551,6 +558,11 @@ class CredentialAccess(BaseAccess):
         # Access enforced in our view where we have context enough to make a decision
         return True
 
+    def can_use(self, obj):
+        if self.user.is_superuser:
+            return True
+        return obj.accessible_by(self.user, {'use': True})
+
     def can_change(self, obj, data):
         if self.user.is_superuser:
             return True
@@ -770,6 +782,11 @@ class JobTemplateAccess(BaseAccess):
                 return False
         if obj.project is None:
             return False
+
+        # Given explicit execute access to this JobTemplate
+        if obj.accessible_by(self.user, {'execute':True}):
+            return True
+
         # If the user has admin access to the project they can start a job
         if obj.project.accessible_by(self.user, ALL_PERMISSIONS):
             return True

awx/main/migrations/0008_v300_rbac_changes.py

@@ -141,6 +141,11 @@ class Migration(migrations.Migration):
             name='updater_role',
             field=awx.main.fields.ImplicitRoleField(related_name='+', to='main.Role', null=b'True'),
         ),
+        migrations.AddField(
+            model_name='inventory',
+            name='usage_role',
+            field=awx.main.fields.ImplicitRoleField(related_name='+', to='main.Role', null=b'True'),
+        ),
         migrations.AddField(
             model_name='custominventoryscript',
             name='admin_role',

awx/main/models/inventory.py

@@ -113,6 +113,11 @@ class Inventory(CommonModel, ResourceMixin):
         role_description='May update the inventory',
         permissions = {'read': True, 'update': True}
     )
+    usage_role = ImplicitRoleField(
+        role_name='Inventory User',
+        role_description='May use this inventory, but not read sensitive portions or modify it',
+        permissions = {'use': True}
+    )
     executor_role = ImplicitRoleField(
         role_name='Inventory Executor',
         role_description='May execute jobs against this inventory',

awx/main/tests/functional/test_rbac_job_start.py

@@ -14,10 +14,10 @@ def test_admin_executing_permissions(deploy_jobtemplate, inventory, machine_cred
 
     admin_user = user('admin-user', True)
 
-    assert admin_user.can_access(Inventory, 'read', inventory)
+    assert admin_user.can_access(Inventory, 'use', inventory)
-    assert admin_user.can_access(Inventory, 'execute', inventory)  # for ad_hoc
+    assert admin_user.can_access(Inventory, 'run_ad_hoc_commands', inventory)  # for ad_hoc
     assert admin_user.can_access(JobTemplate, 'start', deploy_jobtemplate)
-    assert admin_user.can_access(Credential, 'read', machine_credential)
+    assert admin_user.can_access(Credential, 'use', machine_credential)
 
 @pytest.mark.django_db
 @pytest.mark.job_permissions
@@ -35,13 +35,13 @@ def test_credential_use_access(machine_credential, user):
     common_user = user('test-user', False)
     machine_credential.usage_role.members.add(common_user)
 
-    assert common_user.can_access(Credential, 'read', machine_credential)
+    assert common_user.can_access(Credential, 'use', machine_credential)
 
 @pytest.mark.django_db
 @pytest.mark.job_permissions
 def test_inventory_use_access(inventory, user):
 
     common_user = user('test-user', False)
-    inventory.executor_role.members.add(common_user)
+    inventory.usage_role.members.add(common_user)
 
-    assert common_user.can_access(Inventory, 'start', inventory)
+    assert common_user.can_access(Inventory, 'use', inventory)