From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: From: Serge Petrenko Subject: [PATCH 2/2] box: autogrant CREATE,ALTER,DROP to users with READ+WRITE Date: Tue, 30 Oct 2018 16:32:01 +0300 Message-Id: <269e36d8ddf6cba1751da54ee66b9c895df40701.1540903773.git.sergepetrenko@tarantool.org> In-Reply-To: References: In-Reply-To: References: To: vdavydov.dev@gmail.com Cc: tarantool-patches@freelists.org, Serge Petrenko List-ID: This patch adds an upgrade script to grant CREATE, ALTER, DROP privileges to users which have READ+WRITE on respective objects. This is needed after removing 1.7 compatibility mode for privileges. Closes #3539 --- src/box/lua/upgrade.lua | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/src/box/lua/upgrade.lua b/src/box/lua/upgrade.lua index d9c2ae447..64f74f9d3 100644 --- a/src/box/lua/upgrade.lua +++ b/src/box/lua/upgrade.lua @@ -501,6 +501,35 @@ end -- Tarantool 2.1.0 -------------------------------------------------------------------------------- +local function upgrade_priv_to_2_1_0() + local _priv = box.space[box.schema.PRIV_ID] + local _user = box.space[box.schema.USER_ID] + -- Since we remove 1.7 compatibility in 2.1.0, we have to + -- grant ALTER and DROP to all users with READ + WRITE on + -- respective objects. We also grant CREATE on entities + -- or on universe if a user has READ and WRITE on an entity + -- or on universe respectively. We do not grant CREATE on + -- objects, since it has no effect. We also skip grants for + -- sequences since they were added after the new privileges + -- and compatibility mode was always off for them. + for _, user in _user:pairs() do + if user[0] ~= ADMIN and user[0] ~= SUPER then + for _, priv in _priv:pairs(user[0]) do + if priv[3] ~= 'sequence' and + bit.band(priv[5], box.priv.W) ~= 0 and + bit.band(priv[5], box.priv.R) ~= 0 then + local new_privs = bit.bor(box.priv.A, box.priv.D) + if priv[3] == 'universe' or priv[4] == '' then + new_privs = bit.bor(new_privs, box.priv.C) + end + _priv:update({priv[2], priv[3], priv[4]}, + {{"|", 5, new_privs}}) + end + end + end + end +end + local function upgrade_to_2_1_0() local _space = box.space[box.schema.SPACE_ID] local _index = box.space[box.schema.INDEX_ID] @@ -576,6 +605,8 @@ local function upgrade_to_2_1_0() format[1] = {type='string', name='key'} format[2] = {type='any', name='value', is_nullable=true} box.space._schema:format(format) + + upgrade_priv_to_2_1_0() end local function get_version() -- 2.17.1 (Apple Git-112)