# Rancher Permissions in Projects **URL:** \ **Category:** SUSE Rancher Prime\ **Created:** [April 23, 2019, 4:04am UTC](https://forums.suse.com/t/rancher-permissions-in-projects/14047 "2019-04-23T04:04:20Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![mossko](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/mossko/32/4709_2.png) [@mossko](https://forums.suse.com/u/mossko)\ **Post date:** [April 23, 2019, 4:04am UTC](https://forums.suse.com/t/rancher-permissions-in-projects/14047/1 "2019-04-23T04:04:20Z")
Hi All, I’m using Rancher 2.1.8 and creating a Rancher Project with Kubernetes Namespaces. These Projects are managed by an individual called a Tech Lead. The Tech Lead has the effective permissions of Member + User Modification. I have created a custom set of permissions for Projects called “Tech Lead” which reflects the above permissions. There is a privilege escalation issue, where the Tech Lead can add a new user to the Project, and can add the new user at any level including Privileges above their own level (Owner etc) How can we prevent this Privilege Escalation? ---
**Author:** ![cjellick](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/cjellick/32/2876_2.png) [@cjellick](https://forums.suse.com/u/cjellick)\ **Post date:** [April 23, 2019, 3:48pm UTC](https://forums.suse.com/t/rancher-permissions-in-projects/14047/2 "2019-04-23T15:48:30Z")
Currently, the only thing you could do would be to disable the Project Owner role. This would mean that that role could no longer be assigned by anyone to anyone. ---
**Author:** ![mossko](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/mossko/32/4709_2.png) [@mossko](https://forums.suse.com/u/mossko)\ **Post date:** [April 24, 2019, 12:45am UTC](https://forums.suse.com/t/rancher-permissions-in-projects/14047/3 "2019-04-24T00:45:00Z")
Thanks very much for that, i’ll give it a shot! ---
**Author:** ![mossko](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/mossko/32/4709_2.png) [@mossko](https://forums.suse.com/u/mossko)\ **Post date:** [April 24, 2019, 5:35am UTC](https://forums.suse.com/t/rancher-permissions-in-projects/14047/4 "2019-04-24T05:35:27Z")
That’s worked a charm (hiding the other permissions) – thank you so much for your help there! I have another couple of questions: - How can I disable the “Execute CLI” functionality for a particular role? – (We have Developers and Testers. Testers are not supposed to modify their Containers as it invalidates tests) - How can I allow a Developer to scale/restart their Container but not modify the settings/parameters? – ( We are using Templated Deployments and using ISTIO Ingress Gateway which will break if modified ) ---
**Author:** ![mossko](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/mossko/32/4709_2.png) [@mossko](https://forums.suse.com/u/mossko)\ **Post date:** [May 13, 2019, 1:36am UTC](https://forums.suse.com/t/rancher-permissions-in-projects/14047/5 "2019-05-13T01:36:14Z")
Was there any update on this? It would be great to have a toggle for the “Execute CLI” feature somehow ---
**Author:** ![vincent](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/vincent/32/7156_2.png) [@vincent](https://forums.suse.com/u/vincent)\ **Post date:** [May 13, 2019, 5:44am UTC](https://forums.suse.com/t/rancher-permissions-in-projects/14047/6 "2019-05-13T05:44:00Z")
Exec is the `create` verb for the `pods/exec` resource. Roles are strictly additive, so you’d have to make a role that doesn’t have that and assign it to developers. ---
**Author:** ![mossko](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/mossko/32/4709_2.png) [@mossko](https://forums.suse.com/u/mossko)\ **Post date:** [May 13, 2019, 6:28am UTC](https://forums.suse.com/t/rancher-permissions-in-projects/14047/7 "2019-05-13T06:28:45Z")
Hi Vincent, thanks so much for that I’ll start work on another permission group for the Testers so they do not have that specific permission Is this all available through the Rancher Project permission system, or is this a Kubernetes role? ---
**Author:** ![KeithTt](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/keithtt/32/7313_2.png) [@KeithTt](https://forums.suse.com/u/KeithTt)\ **Post date:** [February 19, 2022, 12:02am UTC](https://forums.suse.com/t/rancher-permissions-in-projects/14047/8 "2022-02-19T00:02:45Z")
There is no this perm in the new version v2.6.3, what is the new option of this perm?