Tarantool development patches archive
 help / color / mirror / Atom feed
* [Tarantool-patches] [PATCH 0/2] Admin universe access
@ 2019-11-01 21:42 Vladislav Shpilevoy
  2019-11-01 21:42 ` [Tarantool-patches] [PATCH 1/2] replication: don't drop admin super privileges Vladislav Shpilevoy
                   ` (2 more replies)
  0 siblings, 3 replies; 7+ messages in thread
From: Vladislav Shpilevoy @ 2019-11-01 21:42 UTC (permalink / raw)
  To: tarantool-patches, kostja.osipov

The patchset makes so the admin user never can loose its universe
access rights. Apparently, Tarantool can't even bootstrap nor
recovery without universe granted to the admin, because this user
owns the fibers doing recovery and bootstrap.

First patch fixes the problem, which was revealed by the online
credentials update patch. Appeared, that admin user is very
fragile, and any update of its rights, before universe was
recovered, led to recovery/bootstrap error.

The second patch makes it impossible to break the admin user
explicitly.

Branch: http://github.com/tarantool/tarantool/tree/gerold103/gh-4606-replication-universe-v4
Issue: https://github.com/tarantool/tarantool/issues/4606

Vladislav Shpilevoy (2):
  replication: don't drop admin super privileges
  access: forbid to drop admin's universe access

 src/box/session.cc                            | 23 -------
 src/box/user.cc                               | 28 +++++++++
 test/box/access.result                        |  8 +++
 test/box/access.test.lua                      |  6 ++
 test/replication/gh-4606-admin-creds.result   | 63 +++++++++++++++++++
 test/replication/gh-4606-admin-creds.test.lua | 26 ++++++++
 test/replication/suite.cfg                    |  1 +
 7 files changed, 132 insertions(+), 23 deletions(-)
 create mode 100644 test/replication/gh-4606-admin-creds.result
 create mode 100644 test/replication/gh-4606-admin-creds.test.lua

-- 
2.21.0 (Apple Git-122.2)

^ permalink raw reply	[flat|nested] 7+ messages in thread

end of thread, other threads:[~2019-11-12  9:37 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-11-01 21:42 [Tarantool-patches] [PATCH 0/2] Admin universe access Vladislav Shpilevoy
2019-11-01 21:42 ` [Tarantool-patches] [PATCH 1/2] replication: don't drop admin super privileges Vladislav Shpilevoy
2019-11-05 12:40   ` Vladislav Shpilevoy
2019-11-05 18:20   ` Konstantin Osipov
2019-11-01 21:42 ` [Tarantool-patches] [PATCH 2/2] access: forbid to drop admin's universe access Vladislav Shpilevoy
2019-11-05 18:21   ` Konstantin Osipov
2019-11-12  9:37 ` [Tarantool-patches] [PATCH 0/2] Admin " Kirill Yukhin

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox