Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Restrict grant to/from any babelfish created role #3382

Closed
wants to merge 7 commits into from
Closed

Restrict grant to/from any babelfish created role #3382

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
bc1f5a5
Restrict grant to/from any babelfish created role
lohia-shalini Jan 8, 2025
e6b825d
Fix the error message
lohia-shalini Jan 9, 2025
bdf9548
Any role which is a member of bbf_role_admin is a bbf role
lohia-shalini Jan 9, 2025
29a6f45
Nit: Fixed comments
lohia-shalini Jan 9, 2025
2031a2d
Update the check for bbf role
lohia-shalini Jan 9, 2025
b88bec8
Return false if oid is invalid
lohia-shalini Jan 9, 2025
2f32a21
Remove unused macro
lohia-shalini Jan 9, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 18 additions & 19 deletions contrib/babelfishpg_tds/src/backend/tds/tdsutils.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -935,34 +935,27 @@ check_babelfish_droprole_restrictions(char *role)
* that is only accessible in babelfish_db.
* Since role related DDLs could be executed in any PG databases,
* This function check the underlying assumption on the membership chain instead
* sysadmin <-- dbo* <--- db_owner* <--- users/roles
* bbf_admin_oid <-- dbo* <--- db_owner* <--- users/roles
*
* actual dbo and db_owner name varies across different babelfish logical databases
*/
static bool
is_babelfish_role(const char *role)
{
Oid sysadmin_oid;
Oid role_oid;
Oid bbf_master_guest_oid;
Oid bbf_tempdb_guest_oid;
Oid bbf_msdb_guest_oid;
Oid securityadmin;
Oid dbcreator;
Oid bbf_admin_oid;

sysadmin_oid = get_role_oid(BABELFISH_SYSADMIN, true); /* missing OK */
role_oid = get_role_oid(role, true); /* missing OK */
securityadmin = get_role_oid(BABELFISH_SECURITYADMIN, true); /* missing OK */
dbcreator = get_role_oid(BABELFISH_DBCREATOR, true); /* missing OK */
bbf_admin_oid = get_role_oid(BABELFISH_ROLE_ADMIN, true); /* missing OK */

if (!OidIsValid(sysadmin_oid) || !OidIsValid(role_oid)
|| !OidIsValid(securityadmin) || !OidIsValid(dbcreator))
if (!OidIsValid(role_oid) || !OidIsValid(bbf_admin_oid))
return false;

if (is_member_of_role(sysadmin_oid, role_oid) ||
is_member_of_role(securityadmin, role_oid) ||
is_member_of_role(dbcreator, role_oid) ||
pg_strcasecmp(role, BABELFISH_ROLE_ADMIN) == 0) /* check if it is bbf_role_admin */
/* check if it is bbf_role_admin */
if (pg_strcasecmp(role, BABELFISH_ROLE_ADMIN) == 0)
return true;

bbf_master_guest_oid = get_role_oid("master_guest", true);
Expand All @@ -973,8 +966,9 @@ is_babelfish_role(const char *role)
&& OidIsValid(bbf_msdb_guest_oid)
&& is_member_of_role(role_oid, bbf_master_guest_oid)
&& is_member_of_role(role_oid, bbf_tempdb_guest_oid)
&& is_member_of_role(role_oid, bbf_msdb_guest_oid))
return true;
&& is_member_of_role(role_oid, bbf_msdb_guest_oid)
&& is_member_of_role(bbf_admin_oid, role_oid)) /* If a role has 'bbf_role_admin' as a member, it's a Babelfish role. */
return true;

return false;
}
Expand Down Expand Up @@ -1231,7 +1225,7 @@ handle_grant_role(GrantRoleStmt *grant_stmt)
if (get_bbf_role_admin_oid() == GetUserId())
return true;

/* Restrict roles to added as a member of BBF default server roles */
/* Restrict roles to added as a member of babelfish created roles */
foreach(item, grant_stmt->granted_roles)
{
AccessPriv *priv = (AccessPriv *) lfirst(item);
Expand All @@ -1242,20 +1236,25 @@ handle_grant_role(GrantRoleStmt *grant_stmt)
continue;

roleid = get_role_oid(rolename, false);
if (OidIsValid(roleid) && IS_DEFAULT_BBF_SERVER_ROLE(rolename))
if (OidIsValid(roleid) && is_babelfish_role(rolename))
{
pfree(rolename);
check_babelfish_alterrole_restictions(false);
}
}

/* Restrict grant to/from bbf_role_admin, securityadmin or dbcreator role */
/* Restrict grant to/from any babelfish created role */

foreach(item, grant_stmt->grantee_roles)
{
RoleSpec *rolespec = lfirst_node(RoleSpec, item);
Oid roleid;

roleid = get_rolespec_oid(rolespec, false);
if (OidIsValid(roleid) && IS_DEFAULT_BBF_SERVER_ROLE(rolespec->rolename))
if (OidIsValid(roleid) && is_babelfish_role(rolespec->rolename))
{
check_babelfish_alterrole_restictions(false);
}
}

return true;
Expand Down
6 changes: 0 additions & 6 deletions contrib/babelfishpg_tds/src/include/tds_int.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -259,12 +259,6 @@ extern ProcessUtility_hook_type next_ProcessUtility;
#define BABELFISH_SECURITYADMIN "securityadmin"
#define BABELFISH_DBCREATOR "dbcreator"

#define IS_DEFAULT_BBF_SERVER_ROLE(rolename) \
((strlen(rolename) == 13 && strncmp(rolename, BABELFISH_SECURITYADMIN, 13) == 0) || \
(strlen(rolename) == 14 && strncmp(rolename, BABELFISH_ROLE_ADMIN, 14) == 0) || \
(strlen(rolename) == 9 && strncmp(rolename, BABELFISH_DBCREATOR, 9) == 0) || \
(strlen(rolename) == 8 && strncmp(rolename, BABELFISH_SYSADMIN, 8) == 0))

/* Functions in backend/tds/tdscomm.c */
extern void TdsSetMessageType(uint8_t msgType);
extern void TdsCommInit(uint32_t bufferSize,
Expand Down
18 changes: 6 additions & 12 deletions test/JDBC/expected/db_securityadmin-vu-verify.out
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1344,8 +1344,7 @@ GRANT db_securityadmin_restrictions_login TO master_db_securityadmin;
GO
~~ERROR (Code: 0)~~

~~ERROR (Message: ERROR: permission denied to grant role "db_securityadmin_restrictions_login"
Detail: Only roles with the ADMIN option on role "db_securityadmin_restrictions_login" may grant this role.
~~ERROR (Message: ERROR: Babelfish-created logins/users/roles cannot be altered outside of a Babelfish session
Server SQLState: 42501)~~


Expand All @@ -1356,8 +1355,7 @@ REVOKE master_dbo FROM master_db_securityadmin;
GO
~~ERROR (Code: 0)~~

~~ERROR (Message: ERROR: permission denied to revoke role "master_dbo"
Detail: Only roles with the ADMIN option on role "master_dbo" may revoke this role.
~~ERROR (Message: ERROR: Babelfish-created logins/users/roles cannot be altered outside of a Babelfish session
Server SQLState: 42501)~~


Expand Down Expand Up @@ -1418,35 +1416,31 @@ GRANT master_db_securityadmin TO db_securityadmin_restrictions_login;
GO
~~ERROR (Code: 0)~~

~~ERROR (Message: ERROR: permission denied to grant role "master_db_securityadmin"
Detail: Only roles with the ADMIN option on role "master_db_securityadmin" may grant this role.
~~ERROR (Message: ERROR: Babelfish-created logins/users/roles cannot be altered outside of a Babelfish session
Server SQLState: 42501)~~


GRANT db_securityadmin_restrictions_login TO master_db_securityadmin;
GO
~~ERROR (Code: 0)~~

~~ERROR (Message: ERROR: permission denied to grant role "db_securityadmin_restrictions_login"
Detail: Only roles with the ADMIN option on role "db_securityadmin_restrictions_login" may grant this role.
~~ERROR (Message: ERROR: Babelfish-created logins/users/roles cannot be altered outside of a Babelfish session
Server SQLState: 42501)~~


REVOKE master_db_securityadmin FROM master_dbo;
GO
~~ERROR (Code: 0)~~

~~ERROR (Message: ERROR: permission denied to revoke role "master_db_securityadmin"
Detail: Only roles with the ADMIN option on role "master_db_securityadmin" may revoke this role.
~~ERROR (Message: ERROR: Babelfish-created logins/users/roles cannot be altered outside of a Babelfish session
Server SQLState: 42501)~~


REVOKE master_dbo FROM master_db_securityadmin;
GO
~~ERROR (Code: 0)~~

~~ERROR (Message: ERROR: permission denied to revoke role "master_dbo"
Detail: Only roles with the ADMIN option on role "master_dbo" may revoke this role.
~~ERROR (Message: ERROR: Babelfish-created logins/users/roles cannot be altered outside of a Babelfish session
Server SQLState: 42501)~~


Expand Down
Loading