It's coming from https://github.com/theforeman/foreman/blob/develop/app/models/permission.rb#L13. https://github.com/theforeman/foreman/blob/develop/app/views/filters/_form.html.erb#L27 is where the list is being rendered.