Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Do not allow predefined server roles to be members of each other (#3292) #3294

Merged
merged 1 commit into from
Dec 20, 2024
Merged

Do not allow predefined server roles to be members of each other (#3292) #3294

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions contrib/babelfishpg_tsql/src/rolecmds.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1946,6 +1946,12 @@ check_alter_server_stmt(GrantRoleStmt *stmt)
(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
errmsg("'sysadmin' role cannot be granted to login: a user is already created in database '%s'", db_name)));

/* Restrict adding fixed server roles as member*/
if (IS_BBF_FIXED_SERVER_ROLE(grantee_name))
ereport(ERROR,
(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
errmsg("Cannot use the special principal '%s'", grantee_name)));

/*
* could not drop the last member of sysadmin excluding bbf_role_admin,
* which always needs to be its member.
Expand Down
71 changes: 71 additions & 0 deletions test/JDBC/expected/dbcreator_role-vu-verify.out
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -565,6 +565,77 @@ go
create role dummy_role
go

-- Do not allow predefined server roles to be members of each other
Alter server role sysadmin add member securityadmin
go
~~ERROR (Code: 33557097)~~

~~ERROR (Message: Cannot use the special principal 'securityadmin')~~


Alter server role sysadmin add member dbcreator
go
~~ERROR (Code: 33557097)~~

~~ERROR (Message: Cannot use the special principal 'dbcreator')~~


Alter server role securityadmin add member dbcreator
go
~~ERROR (Code: 33557097)~~

~~ERROR (Message: Cannot use the special principal 'dbcreator')~~


Alter server role securityadmin add member securityadmin
go
~~ERROR (Code: 33557097)~~

~~ERROR (Message: Cannot use the special principal 'securityadmin')~~


Alter server role dbcreator add member securityadmin
go
~~ERROR (Code: 33557097)~~

~~ERROR (Message: Cannot use the special principal 'securityadmin')~~


Alter server role dbcreator add member dbcreator
go
~~ERROR (Code: 33557097)~~

~~ERROR (Message: Cannot use the special principal 'dbcreator')~~


Alter server role dbcreator add member sysadmin
go
~~ERROR (Code: 33557097)~~

~~ERROR (Message: Cannot use the special principal 'sysadmin')~~


Alter server role securityadmin add member sysadmin
go
~~ERROR (Code: 33557097)~~

~~ERROR (Message: Cannot use the special principal 'sysadmin')~~


Alter server role dbcreator add member dbcreator
go
~~ERROR (Code: 33557097)~~

~~ERROR (Message: Cannot use the special principal 'dbcreator')~~


Alter server role sysadmin add member sysadmin
go
~~ERROR (Code: 33557097)~~

~~ERROR (Message: Cannot use the special principal 'sysadmin')~~


-- terminate-tsql-conn

-- tsql user=dbcreator_login1 password=123
Expand Down
71 changes: 71 additions & 0 deletions test/JDBC/expected/single_db/dbcreator_role-vu-verify.out
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -564,6 +564,77 @@ go
create role dummy_role
go

-- Do not allow predefined server roles to be members of each other
Alter server role sysadmin add member securityadmin
go
~~ERROR (Code: 33557097)~~

~~ERROR (Message: Cannot use the special principal 'securityadmin')~~


Alter server role sysadmin add member dbcreator
go
~~ERROR (Code: 33557097)~~

~~ERROR (Message: Cannot use the special principal 'dbcreator')~~


Alter server role securityadmin add member dbcreator
go
~~ERROR (Code: 33557097)~~

~~ERROR (Message: Cannot use the special principal 'dbcreator')~~


Alter server role securityadmin add member securityadmin
go
~~ERROR (Code: 33557097)~~

~~ERROR (Message: Cannot use the special principal 'securityadmin')~~


Alter server role dbcreator add member securityadmin
go
~~ERROR (Code: 33557097)~~

~~ERROR (Message: Cannot use the special principal 'securityadmin')~~


Alter server role dbcreator add member dbcreator
go
~~ERROR (Code: 33557097)~~

~~ERROR (Message: Cannot use the special principal 'dbcreator')~~


Alter server role dbcreator add member sysadmin
go
~~ERROR (Code: 33557097)~~

~~ERROR (Message: Cannot use the special principal 'sysadmin')~~


Alter server role securityadmin add member sysadmin
go
~~ERROR (Code: 33557097)~~

~~ERROR (Message: Cannot use the special principal 'sysadmin')~~


Alter server role dbcreator add member dbcreator
go
~~ERROR (Code: 33557097)~~

~~ERROR (Message: Cannot use the special principal 'dbcreator')~~


Alter server role sysadmin add member sysadmin
go
~~ERROR (Code: 33557097)~~

~~ERROR (Message: Cannot use the special principal 'sysadmin')~~


-- terminate-tsql-conn

-- tsql user=dbcreator_login1 password=123
Expand Down
31 changes: 31 additions & 0 deletions test/JDBC/input/dbcreator_role-vu-verify.mix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -398,6 +398,37 @@ go
create role dummy_role
go

-- Do not allow predefined server roles to be members of each other
Alter server role sysadmin add member securityadmin
go

Alter server role sysadmin add member dbcreator
go

Alter server role securityadmin add member dbcreator
go

Alter server role securityadmin add member securityadmin
go

Alter server role dbcreator add member securityadmin
go

Alter server role dbcreator add member dbcreator
go

Alter server role dbcreator add member sysadmin
go

Alter server role securityadmin add member sysadmin
go

Alter server role dbcreator add member dbcreator
go

Alter server role sysadmin add member sysadmin
go

-- terminate-tsql-conn

-- tsql user=dbcreator_login1 password=123
Expand Down
Loading