From: Konstantin Osipov <kostja@tarantool.org> To: tarantool-patches@freelists.org Cc: Serge Petrenko <sergepetrenko@tarantool.org> Subject: [tarantool-patches] Re: [PATCH] Add entities user, role to access control. Date: Thu, 26 Jul 2018 23:15:52 +0300 [thread overview] Message-ID: <20180726201552.GB26714@chai> (raw) In-Reply-To: <20180712152932.60750-1-sergepetrenko@tarantool.org> * Serge Petrenko <sergepetrenko@tarantool.org> [18/07/12 20:54]: > + /* Do not allow changes for system users and roles. */ > + struct credentials *cr = effective_user(); > + if ((uid <= (uint32_t) BOX_SYSTEM_USER_ID_MAX || uid == SUPER) && > + cr->uid != ADMIN) { > + struct user *current_user = user_find_xc(cr->uid); > + tnt_raise(AccessDeniedError, "alter", "user or role", > + old_user->def->name, current_user->def->name); > + } It should be possible to change these system objects, provided the person knows what they are doing, please remove this check, esp. since it's outside the scope of this bug fix. > case SC_ROLE: > { > - struct user *role = user_by_id(priv->object_id); > - if (role == NULL || role->def->type != SC_ROLE) { > - tnt_raise(ClientError, ER_NO_SUCH_ROLE, > - role ? role->def->name : > - int2str(priv->object_id)); > - } > - /* > - * Only the creator of the role can grant or revoke it. > - * Everyone can grant 'PUBLIC' role. > - */ > - if (role->def->owner != grantor->def->uid && > - grantor->def->uid != ADMIN && > - (role->def->uid != PUBLIC || priv->access != PRIV_X)) { > + if (priv->object_id != 0) { > + struct user *role = user_by_id(priv->object_id); > + if (role == NULL || role->def->type != SC_ROLE) { > + tnt_raise(ClientError, ER_NO_SUCH_ROLE, > + role ? role->def->name : > + int2str(priv->object_id)); > + } > + /* > + * Only the creator of the role can grant or revoke it. > + * Everyone can grant 'PUBLIC' role. > + */ > + if (role->def->owner != grantor->def->uid && > + grantor->def->uid != ADMIN && > + (role->def->uid != PUBLIC || priv->access != PRIV_X)) { > + tnt_raise(AccessDeniedError, > + priv_name(priv_type), > + schema_object_name(SC_ROLE), name, > + grantor->def->name); > + } > + /* Not necessary to do during revoke, but who cares. */ > + role_check(grantee, role); > + } else if (grantor->def->uid != ADMIN) { > + /* only admin may grant privileges on an entire entity. */ > tnt_raise(AccessDeniedError, > priv_name(priv_type), > schema_object_name(SC_ROLE), name, > grantor->def->name); > } > - /* Not necessary to do during revoke, but who cares. */ > - role_check(grantee, role); Why no 'break;'? Instead of changing indent level you could have added a break. > + case SC_USER: > + { > + /* > + * user ID 0 is shared between user 'guest' and granting > + * privileges upon whole entity user. This is not a problem, > + * since we don't want to grant privileges on any system user, > + * including 'guest'. > + */ > + if(priv->object_id == 0) { > + access = entity_access.user; > + break; > + } Hm, does it mean that now it's not possible to grant some privileges to 'guest'? Looks like we should be using a different identifier for entity-level grants then? Are you testing this at all? (I found no test for this). -- Konstantin Osipov, Moscow, Russia, +7 903 626 22 32 http://tarantool.io - www.twitter.com/kostja_osipov
next prev parent reply other threads:[~2018-07-26 20:15 UTC|newest] Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top 2018-07-12 15:29 [tarantool-patches] " Serge Petrenko 2018-07-26 20:15 ` Konstantin Osipov [this message] 2018-07-30 7:52 ` [tarantool-patches] " Sergey Petrenko
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20180726201552.GB26714@chai \ --to=kostja@tarantool.org \ --cc=sergepetrenko@tarantool.org \ --cc=tarantool-patches@freelists.org \ --subject='[tarantool-patches] Re: [PATCH] Add entities user, role to access control.' \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox