Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Do not allow predefined server roles to be members of each other #3292

Merged
merged 2 commits into from
Dec 20, 2024
Merged

Do not allow predefined server roles to be members of each other #3292

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
21e2d6e
Do not allow predefined server roles to be members of each other
Dec 20, 2024
c125588
Add more testcases
Dec 20, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions contrib/babelfishpg_tsql/src/rolecmds.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1946,6 +1946,12 @@ check_alter_server_stmt(GrantRoleStmt *stmt)
(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
errmsg("'sysadmin' role cannot be granted to login: a user is already created in database '%s'", db_name)));

/* Restrict adding fixed server roles as member*/
if (IS_BBF_FIXED_SERVER_ROLE(grantee_name))
ereport(ERROR,
(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
errmsg("Cannot use the special principal '%s'", grantee_name)));

/*
* could not drop the last member of sysadmin excluding bbf_role_admin,
* which always needs to be its member.
Expand Down
71 changes: 71 additions & 0 deletions test/JDBC/expected/dbcreator_role-vu-verify.out
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -565,6 +565,77 @@ go
create role dummy_role
go

-- Do not allow predefined server roles to be members of each other
Alter server role sysadmin add member securityadmin
go
~~ERROR (Code: 33557097)~~

~~ERROR (Message: Cannot use the special principal 'securityadmin')~~


Alter server role sysadmin add member dbcreator
go
~~ERROR (Code: 33557097)~~

~~ERROR (Message: Cannot use the special principal 'dbcreator')~~


Alter server role securityadmin add member dbcreator
go
~~ERROR (Code: 33557097)~~

~~ERROR (Message: Cannot use the special principal 'dbcreator')~~


Alter server role securityadmin add member securityadmin
go
~~ERROR (Code: 33557097)~~

~~ERROR (Message: Cannot use the special principal 'securityadmin')~~


Alter server role dbcreator add member securityadmin
go
~~ERROR (Code: 33557097)~~

~~ERROR (Message: Cannot use the special principal 'securityadmin')~~


Alter server role dbcreator add member dbcreator
go
~~ERROR (Code: 33557097)~~

~~ERROR (Message: Cannot use the special principal 'dbcreator')~~
Comment on lines +597 to +608
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  1. Please add dbcreator/secadmin <-> sysadmin combination.
  2. Are there existing testcases for PG endpoint?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  1. Added more testcases.
  2. no it's the behaviour from BBF endpoint and for PG we have already blocked operations on BBF created objects.



Alter server role dbcreator add member sysadmin
go
~~ERROR (Code: 33557097)~~

~~ERROR (Message: Cannot use the special principal 'sysadmin')~~


Alter server role securityadmin add member sysadmin
go
~~ERROR (Code: 33557097)~~

~~ERROR (Message: Cannot use the special principal 'sysadmin')~~


Alter server role dbcreator add member dbcreator
go
~~ERROR (Code: 33557097)~~

~~ERROR (Message: Cannot use the special principal 'dbcreator')~~


Alter server role sysadmin add member sysadmin
go
~~ERROR (Code: 33557097)~~

~~ERROR (Message: Cannot use the special principal 'sysadmin')~~


-- terminate-tsql-conn

-- tsql user=dbcreator_login1 password=123
Expand Down
71 changes: 71 additions & 0 deletions test/JDBC/expected/single_db/dbcreator_role-vu-verify.out
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -564,6 +564,77 @@ go
create role dummy_role
go

-- Do not allow predefined server roles to be members of each other
Alter server role sysadmin add member securityadmin
go
~~ERROR (Code: 33557097)~~

~~ERROR (Message: Cannot use the special principal 'securityadmin')~~


Alter server role sysadmin add member dbcreator
go
~~ERROR (Code: 33557097)~~

~~ERROR (Message: Cannot use the special principal 'dbcreator')~~


Alter server role securityadmin add member dbcreator
go
~~ERROR (Code: 33557097)~~

~~ERROR (Message: Cannot use the special principal 'dbcreator')~~


Alter server role securityadmin add member securityadmin
go
~~ERROR (Code: 33557097)~~

~~ERROR (Message: Cannot use the special principal 'securityadmin')~~


Alter server role dbcreator add member securityadmin
go
~~ERROR (Code: 33557097)~~

~~ERROR (Message: Cannot use the special principal 'securityadmin')~~


Alter server role dbcreator add member dbcreator
go
~~ERROR (Code: 33557097)~~

~~ERROR (Message: Cannot use the special principal 'dbcreator')~~


Alter server role dbcreator add member sysadmin
go
~~ERROR (Code: 33557097)~~

~~ERROR (Message: Cannot use the special principal 'sysadmin')~~


Alter server role securityadmin add member sysadmin
go
~~ERROR (Code: 33557097)~~

~~ERROR (Message: Cannot use the special principal 'sysadmin')~~


Alter server role dbcreator add member dbcreator
go
~~ERROR (Code: 33557097)~~

~~ERROR (Message: Cannot use the special principal 'dbcreator')~~


Alter server role sysadmin add member sysadmin
go
~~ERROR (Code: 33557097)~~

~~ERROR (Message: Cannot use the special principal 'sysadmin')~~


-- terminate-tsql-conn

-- tsql user=dbcreator_login1 password=123
Expand Down
31 changes: 31 additions & 0 deletions test/JDBC/input/dbcreator_role-vu-verify.mix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -398,6 +398,37 @@ go
create role dummy_role
go

-- Do not allow predefined server roles to be members of each other
Alter server role sysadmin add member securityadmin
go

Alter server role sysadmin add member dbcreator
go

Alter server role securityadmin add member dbcreator
go

Alter server role securityadmin add member securityadmin
go

Alter server role dbcreator add member securityadmin
go

Alter server role dbcreator add member dbcreator
go

Alter server role dbcreator add member sysadmin
go

Alter server role securityadmin add member sysadmin
go

Alter server role dbcreator add member dbcreator
go

Alter server role sysadmin add member sysadmin
go

-- terminate-tsql-conn

-- tsql user=dbcreator_login1 password=123
Expand Down
Loading