Rudder

I just managed to delete some system Directives:

This was possible via the Node details screen, in the reports section where all Rules and Directives have an "Edit" icon:

By clicking on this Edit icon, I could delete Directives (but not Rules). I found this in Rudder 3.0 and 2.11 via the Edit icon, but I was also able to do this on Rudder 2.10 by accessing this URL directly: https://rudder-server-name/rudder/secure/configurationManager/directiveManagement#{"directiveId":"inventory-all"}.

I suspect this is actually two bugs:

1. We should not be able to delete system directives (at the internal API level)
2. We should not display edit links on any system directives or rules

Since this allows to delete system Directives this is quite a bad bug. However, I don't see that is has security implications, since we can only delete existing Directives, and even then only ones that keep Rudder running, and only as an admin user.