[Fix](auth) Restrict processlist visibility by user identity

[linrrzqqq]

Problem Summary:

Authenticated non-admin users could inspect sessions and active SQL statements belonging to other users through information_schema.processlist, SHOW PROCESSLIST, and information_schema.active_queries.

CREATE USER 'pl_victim' IDENTIFIED BY 'C123_567p';
CREATE USER 'pl_attacker' IDENTIFIED BY 'C123_567p';

GRANT SELECT_PRIV ON processlist_demo.* TO 'pl_victim';
GRANT SELECT_PRIV ON processlist_demo.* TO 'pl_attacker';

-- victim
SELECT SLEEP(120), 'victim_secret_token=demo-only-123';

-- attacker
SELECT User, Command, Info
FROM information_schema.processlist
WHERE User = 'pl_victim';
+-------------+---------+-------------------------------------------------------------------------------------------------------------------------+
| User        | Command | Info                                                                                                                    |
+-------------+---------+-------------------------------------------------------------------------------------------------------------------------+
| pl_attacker | Query   | SELECT User, Command, Info
FROM information_schema.processlist
WHERE User IN ('pl_victim', 'pl_attacker')
ORDER BY User |
| pl_victim   | Query   | SELECT SLEEP(120), 'victim_secret_token=demo-only-123'                                                                  |
+-------------+---------+-------------------------------------------------------------------------------------------------------------------------+

-- attacker
SELECT USER, SQL
FROM information_schema.active_queries;
+-------------+---------------------------------------------------------+
| USER        | SQL                                                     |
+-------------+---------------------------------------------------------+
| pl_victim   | SELECT SLEEP(120), 'victim_secret_token=demo-only-123'  |
| pl_attacker | SELECT USER, SQL
FROM information_schema.active_queries |
+-------------+---------------------------------------------------------+

The schema scanners did not consistently propagate the caller's user identity to FE, and the FE metadata handlers did not always enforce per-user visibility.

Release note

Non-admin users can now see only their own sessions and active queries through processlist and information_schema.active_queries. ADMIN users retain cluster-wide visibility.

[hello-stephen]

Thank you for your contribution to Apache Doris.
Don't know what should be done next? See How to process your PR.

Please clearly describe your PR:

1. What problem was fixed (it's best to include specific error reporting information). How it was fixed.
2. Which behaviors were modified. What was the previous behavior, what is it now, why was it modified, and what possible impacts might there be.
3. What features were added. Why was this function added?
4. Which code was refactored and why was this part of the code refactored?
5. Which functions were optimized and what is the difference before and after the optimization?

[linrrzqqq]

/review

[github-actions]

Request changes — capped/incomplete after the third and final review round.

The patch correctly filters homogeneous current-version schema/RPC results for native accounts with persisted roles, but it does not yet deliver the stated end-to-end visibility rule. The six inline threads cover eight independently verified issue families: rolling-version fail-open behavior; same-name/different-host SHOW and KILL authorization; loss of authentication-integration ADMIN roles; restricted Basic users reaching root sessions; inconsistent saved-profile ownership across v1, /api, v2, and SQL SHOW surfaces; and default-disabled ADMIN enforcement on live-query REST listing/cancellation. These are in-scope cross-user RBAC or authorization-correctness failures.

Critical checkpoint conclusions:

• Goal and proof: only partially achieved. The new unit/regression tests prove distinct-username behavior in a homogeneous native-role setup, but miss the accepted compatibility, exact-account, effective-role, HTTP, profile, and KILL cases. The identity-less tests explicitly preserve the fail-open behavior.
• Focus and size: the changed code is locally small and clear, but the fix is not end-to-end because functionally parallel authorization paths remain unchanged. There was no additional user-supplied focus beyond full-PR review.
• Concurrency: active-query maps and connection pools are concurrently accessed using their existing snapshot/concurrent-container contracts. The patch adds no unsafe mutation, new lock, lock-order change, heavy locked operation, or deadlock risk.
• Lifecycle/static state: scanner identity is retained by the runtime object pool through synchronous RPC use; query contexts remain valid while registered; the regression victim future is cancelled and joined. No new ownership cycle, leak, or cross-TU/static-initialization issue was found.
• Configuration: no new knob is added, but the existing supported default enable_all_http_auth=false makes checkAdminAuth() a no-op and is load-bearing for one accepted REST issue.
• Compatibility: unsafe in both relevant rolling directions. An old BE drops the caller identity before invoking a new FE, while old-FE active-query replay returns unfiltered rows that a new FE merges without re-filtering.
• Parallel paths and conditions: current exact UserIdentity equality is correct, but missing identity fails open, local SHOW/KILL collapse identity to username, profile code uses literal-name/username ownership, and several HTTP paths lack a real ADMIN/owner decision.
• Tests/results: coverage is narrow and lacks mixed versions, same-name host identities, integration-mapped ADMIN, restricted Basic credentials, legacy/v2 profile paths, SQL profile commands, and default-config REST cancellation. Per the review-runner instruction, no build or test command was executed; expected test code was inspected only.
• Observability/error handling: existing RPC status propagation and diagnostics are unchanged and adequate for this patch shape; no new metric or log is required. Authorization failures should fail or filter explicitly rather than silently grant legacy visibility.
• Transactions, persistence, and data writes: not applicable; no EditLog, transaction, storage-format, data-conversion, or committed-data path changes are present.
• FE/BE variables: caller identity is propagated on current BE scanner paths, but compatibility fallbacks and session-only effective roles are not propagated across all BE/FE and FE/FE hops.
• Performance: the added privilege check and row filtering do not introduce a material CPU, memory, or asymptotic regression beyond existing query/connection/profile scans.

Because new valuable findings remained in Round 3, this review is capped/incomplete rather than converged. Every candidate found within the allowed rounds was independently validated, consolidated/deduplicated, accepted, or dismissed with concrete evidence before submission.

[linrrzqqq]

run buildall

[hello-stephen]

TPC-H: Total hot run time: 17558 ms

machine: 'aliyun_ecs.c7a.8xlarge_32C64G'
scripts: https://github.com/apache/doris/tree/master/tools/tpch-tools
Tpch sf100 test result on commit 6e7b3d106e89aa7e9482d732846232f7bf7925cb, data reload: false

------ Round 1 ----------------------------------
============================================
q1	17564	3039	3024	3024
q2	1902	233	147	147
q3	10457	939	527	527
q4	4672	245	190	190
q5	7696	573	379	379
q6	140	111	94	94
q7	529	506	382	382
q8	9248	917	882	882
q9	3448	2356	2364	2356
q10	6482	871	734	734
q11	440	254	229	229
q12	695	394	334	334
q13	17885	1875	1552	1552
q14	163	150	143	143
q15	q16	437	393	367	367
q17	824	801	839	801
q18	3309	2258	2232	2232
q19	1101	958	765	765
q20	617	562	478	478
q21	5333	1710	1955	1710
q22	331	272	232	232
Total cold run time: 93273 ms
Total hot run time: 17558 ms

----- Round 2, with runtime_filter_mode=off -----
============================================
q1	3491	3437	3423	3423
q2	210	218	158	158
q3	2194	2317	2203	2203
q4	1195	1156	896	896
q5	2186	2120	2088	2088
q6	174	122	86	86
q7	1012	900	854	854
q8	1620	1421	1405	1405
q9	3079	3093	3070	3070
q10	1831	1829	1650	1650
q11	362	280	252	252
q12	458	449	349	349
q13	1830	1859	1509	1509
q14	173	170	173	170
q15	q16	396	411	352	352
q17	1044	1044	1037	1037
q18	4927	4382	4734	4382
q19	878	853	852	852
q20	969	930	797	797
q21	3858	3163	3264	3163
q22	422	356	424	356
Total cold run time: 32309 ms
Total hot run time: 29052 ms

[hello-stephen]

TPC-DS: Total hot run time: 85534 ms

machine: 'aliyun_ecs.c7a.8xlarge_32C64G'
scripts: https://github.com/apache/doris/tree/master/tools/tpcds-tools
TPC-DS sf100 test result on commit 6e7b3d106e89aa7e9482d732846232f7bf7925cb, data reload: false

query5	4224	407	335	335
query6	391	160	155	155
query7	4903	458	267	267
query8	299	124	114	114
query9	8708	2905	2898	2898
query10	397	269	233	233
query11	5396	1039	920	920
query12	120	71	70	70
query13	1200	473	340	340
query14	5943	2039	1883	1883
query14_1	1800	1773	1780	1773
query15	177	118	114	114
query16	940	391	370	370
query17	799	460	374	374
query18	2339	335	257	257
query19	175	145	117	117
query20	73	73	71	71
query21	206	121	108	108
query22	5358	5267	5204	5204
query23	7199	6692	6449	6449
query23_1	6551	6611	6647	6611
query24	7282	1122	773	773
query24_1	769	766	776	766
query25	437	309	264	264
query26	1249	268	167	167
query27	2715	446	273	273
query28	4642	1527	1544	1527
query29	943	467	359	359
query30	276	184	153	153
query31	977	689	601	601
query32	100	48	48	48
query33	449	196	173	173
query34	988	836	482	482
query35	401	386	332	332
query36	565	565	521	521
query37	119	83	73	73
query38	991	838	796	796
query39	528	535	504	504
query39_1	487	541	522	522
query40	235	134	108	108
query41	51	49	49	49
query42	74	70	74	70
query43	253	246	212	212
query44	1059	576	578	576
query45	114	103	98	98
query46	788	868	533	533
query47	988	960	911	911
query48	322	314	234	234
query49	527	238	187	187
query50	825	336	251	251
query51	8090	8248	8122	8122
query52	68	68	61	61
query53	214	219	155	155
query54	238	193	180	180
query55	75	57	54	54
query56	230	213	233	213
query57	645	631	588	588
query58	224	215	181	181
query59	1109	1138	1002	1002
query60	257	217	208	208
query61	116	132	107	107
query62	382	203	192	192
query63	176	165	149	149
query64	2704	648	547	547
query65	1611	1500	1509	1500
query66	1804	279	241	241
query67	9414	9737	9713	9713
query68	2740	1253	806	806
query69	343	227	203	203
query70	654	607	566	566
query71	287	262	241	241
query72	2446	1707	1529	1529
query73	663	583	359	359
query74	1574	1208	1146	1146
query75	1215	1139	997	997
query76	2285	739	562	562
query77	247	261	223	223
query78	5039	4727	4517	4517
query79	1332	883	600	600
query80	1213	399	337	337
query81	493	197	169	169
query82	631	137	106	106
query83	314	250	238	238
query84	303	119	103	103
query85	836	430	363	363
query86	383	171	169	169
query87	1028	959	898	898
query88	2825	2150	2129	2129
query89	309	232	209	209
query90	1860	153	146	146
query91	153	143	120	120
query92	50	47	45	45
query93	1409	1082	839	839
query94	634	264	228	228
query95	624	435	379	379
query96	842	618	293	293
query97	1054	1055	1057	1055
query98	140	137	130	130
query99	411	342	304	304
Total cold run time: 177479 ms
Total hot run time: 85534 ms

[hello-stephen]

ClickBench: Total hot run time: 14.64 s

machine: 'aliyun_ecs.c7a.8xlarge_32C64G'
scripts: https://github.com/apache/doris/tree/master/tools/clickbench-tools
ClickBench test result on commit 6e7b3d106e89aa7e9482d732846232f7bf7925cb, data reload: false

query1	0.00	0.00	0.01
query2	0.08	0.03	0.03
query3	0.24	0.11	0.12
query4	1.60	0.11	0.10
query5	0.16	0.16	0.16
query6	1.27	0.69	0.72
query7	0.04	0.01	0.00
query8	0.05	0.03	0.02
query9	0.30	0.20	0.21
query10	0.33	0.35	0.35
query11	0.15	0.12	0.12
query12	0.15	0.14	0.11
query13	0.30	0.31	0.30
query14	0.46	0.46	0.45
query15	0.35	0.34	0.36
query16	0.22	0.23	0.22
query17	0.70	0.74	0.71
query18	0.18	0.16	0.17
query19	1.23	1.19	1.08
query20	0.01	0.01	0.01
query21	15.48	0.14	0.12
query22	5.08	0.04	0.04
query23	16.18	0.25	0.10
query24	2.95	0.29	0.28
query25	0.10	0.03	0.03
query26	0.86	0.16	0.13
query27	0.03	0.03	0.03
query28	3.72	0.55	0.28
query29	12.45	3.17	2.58
query30	0.26	0.11	0.13
query31	2.76	0.38	0.18
query32	3.52	0.31	0.24
query33	1.37	1.43	1.38
query34	15.37	2.27	1.75
query35	1.75	1.74	1.75
query36	0.45	0.27	0.30
query37	0.05	0.04	0.04
query38	0.05	0.03	0.03
query39	0.03	0.02	0.02
query40	0.11	0.09	0.07
query41	0.07	0.03	0.02
query42	0.03	0.03	0.02
query43	0.04	0.02	0.03
Total cold run time: 90.53 s
Total hot run time: 14.64 s

[hello-stephen]

BE UT Coverage Report

Increment line coverage 🎉

Increment coverage report
Complete coverage report

Category	Coverage
Function Coverage	60.44% (26586/43990)
Line Coverage	44.83% (271060/604650)
Region Coverage	40.56% (216146/532908)
Branch Coverage	42.02% (99521/236851)

[hello-stephen]

FE UT Coverage Report

Increment line coverage 33.33% (1/3) 🎉
Increment coverage report
Complete coverage report

[hello-stephen]

BE Regression && UT Coverage Report

Increment line coverage 100% (0/0) 🎉

Increment coverage report
Complete coverage report

Category	Coverage
Function Coverage	74.82% (32064/42857)
Line Coverage	59.26% (355670/600167)
Region Coverage	55.63% (296950/533775)
Branch Coverage	56.44% (133627/236747)

[hello-stephen]

FE Regression Coverage Report

Increment line coverage 33.33% (1/3) 🎉
Increment coverage report
Complete coverage report

[hello-stephen]

FE Regression Coverage Report

Increment line coverage 33.33% (1/3) 🎉
Increment coverage report
Complete coverage report

[hello-stephen]

BE Regression && UT Coverage Report

Increment line coverage 100% (0/0) 🎉

Increment coverage report
Complete coverage report

Category	Coverage
Function Coverage	74.77% (32046/42857)
Line Coverage	59.24% (355518/600167)
Region Coverage	55.59% (296738/533775)
Branch Coverage	56.42% (133571/236747)

[linrrzqqq]

run buildall

[hello-stephen]

TPC-H: Total hot run time: 17795 ms

machine: 'aliyun_ecs.c7a.8xlarge_32C64G'
scripts: https://github.com/apache/doris/tree/master/tools/tpch-tools
Tpch sf100 test result on commit 2f662cd364efb35ecc47ef259c7c5d82fc3c32dd, data reload: false

------ Round 1 ----------------------------------
============================================
q1	17587	3040	3038	3038
q2	1999	236	151	151
q3	10360	872	537	537
q4	4667	247	201	201
q5	7682	584	377	377
q6	142	120	96	96
q7	545	517	390	390
q8	9258	950	925	925
q9	3450	2374	2371	2371
q10	6527	848	743	743
q11	441	263	241	241
q12	693	386	328	328
q13	17884	1902	1538	1538
q14	160	152	142	142
q15	q16	434	399	365	365
q17	891	827	756	756
q18	3177	2294	2275	2275
q19	1201	841	824	824
q20	676	525	469	469
q21	5505	1794	1924	1794
q22	329	271	234	234
Total cold run time: 93608 ms
Total hot run time: 17795 ms

----- Round 2, with runtime_filter_mode=off -----
============================================
q1	3408	3336	3342	3336
q2	211	231	156	156
q3	2316	2509	2185	2185
q4	1195	1165	889	889
q5	2201	2178	2160	2160
q6	171	125	88	88
q7	1057	952	848	848
q8	1603	1410	1411	1410
q9	3136	3097	3082	3082
q10	1894	1817	1626	1626
q11	359	269	254	254
q12	462	453	348	348
q13	1841	1862	1559	1559
q14	180	176	155	155
q15	q16	405	396	359	359
q17	1049	1036	1024	1024
q18	4968	4515	4803	4515
q19	878	871	858	858
q20	969	938	823	823
q21	3919	3180	3365	3180
q22	402	353	329	329
Total cold run time: 32624 ms
Total hot run time: 29184 ms

[hello-stephen]

TPC-DS: Total hot run time: 86260 ms

machine: 'aliyun_ecs.c7a.8xlarge_32C64G'
scripts: https://github.com/apache/doris/tree/master/tools/tpcds-tools
TPC-DS sf100 test result on commit 2f662cd364efb35ecc47ef259c7c5d82fc3c32dd, data reload: false

query5	4232	406	321	321
query6	410	163	150	150
query7	4898	484	287	287
query8	297	126	111	111
query9	8691	2887	2906	2887
query10	381	253	211	211
query11	5378	1040	913	913
query12	116	73	71	71
query13	1205	453	348	348
query14	5946	2032	1864	1864
query14_1	1788	1773	1761	1761
query15	175	122	110	110
query16	929	388	375	375
query17	953	474	374	374
query18	2355	332	241	241
query19	171	144	112	112
query20	88	71	69	69
query21	211	121	103	103
query22	5436	5318	5384	5318
query23	7431	6732	6658	6658
query23_1	6701	6614	6706	6614
query24	7249	1141	779	779
query24_1	793	795	771	771
query25	432	306	260	260
query26	1261	268	164	164
query27	2710	453	272	272
query28	4625	1534	1541	1534
query29	940	451	362	362
query30	272	178	154	154
query31	965	669	610	610
query32	103	53	51	51
query33	462	231	177	177
query34	990	878	464	464
query35	402	396	332	332
query36	561	550	533	533
query37	128	92	73	73
query38	996	837	814	814
query39	528	511	540	511
query39_1	525	539	532	532
query40	226	128	123	123
query41	61	61	57	57
query42	82	76	73	73
query43	290	248	222	222
query44	1026	579	580	579
query45	108	105	103	103
query46	766	828	564	564
query47	1011	998	981	981
query48	325	304	227	227
query49	522	246	198	198
query50	873	328	259	259
query51	8195	8212	8183	8183
query52	76	71	63	63
query53	209	218	168	168
query54	229	207	165	165
query55	69	58	52	52
query56	217	218	205	205
query57	666	656	609	609
query58	218	197	193	193
query59	1112	1117	983	983
query60	286	233	202	202
query61	132	126	120	120
query62	361	202	174	174
query63	200	179	154	154
query64	2626	651	548	548
query65	1592	1548	1596	1548
query66	1786	299	259	259
query67	10073	9844	9965	9844
query68	3024	1248	782	782
query69	390	223	191	191
query70	642	583	579	579
query71	303	265	239	239
query72	2326	1739	1566	1566
query73	662	651	363	363
query74	2006	1257	1145	1145
query75	1226	1151	1016	1016
query76	2372	735	538	538
query77	241	245	205	205
query78	5226	4863	4561	4561
query79	1181	786	585	585
query80	1189	391	335	335
query81	473	198	174	174
query82	615	138	113	113
query83	311	254	230	230
query84	269	121	110	110
query85	845	435	384	384
query86	391	175	168	168
query87	997	987	899	899
query88	2842	2155	2146	2146
query89	313	236	210	210
query90	1874	147	139	139
query91	150	143	127	127
query92	49	51	43	43
query93	1407	1164	836	836
query94	638	255	235	235
query95	616	435	346	346
query96	859	576	300	300
query97	1062	1038	1045	1038
query98	149	137	133	133
query99	419	347	310	310
Total cold run time: 179584 ms
Total hot run time: 86260 ms

[hello-stephen]

ClickBench: Total hot run time: 14.81 s

machine: 'aliyun_ecs.c7a.8xlarge_32C64G'
scripts: https://github.com/apache/doris/tree/master/tools/clickbench-tools
ClickBench test result on commit 2f662cd364efb35ecc47ef259c7c5d82fc3c32dd, data reload: false

query1	0.01	0.00	0.01
query2	0.08	0.03	0.03
query3	0.24	0.11	0.11
query4	1.59	0.10	0.09
query5	0.19	0.16	0.15
query6	1.25	0.69	0.69
query7	0.03	0.00	0.01
query8	0.04	0.02	0.02
query9	0.28	0.22	0.20
query10	0.36	0.35	0.34
query11	0.15	0.12	0.12
query12	0.15	0.12	0.12
query13	0.32	0.31	0.31
query14	0.47	0.47	0.47
query15	0.37	0.35	0.35
query16	0.20	0.22	0.23
query17	0.75	0.69	0.69
query18	0.19	0.16	0.16
query19	1.19	1.20	1.21
query20	0.01	0.01	0.01
query21	15.43	0.16	0.11
query22	5.08	0.04	0.05
query23	16.16	0.26	0.10
query24	2.97	0.32	0.26
query25	0.10	0.04	0.03
query26	0.77	0.16	0.12
query27	0.02	0.02	0.03
query28	3.64	0.59	0.29
query29	12.43	3.18	2.55
query30	0.24	0.12	0.13
query31	2.75	0.37	0.18
query32	3.53	0.32	0.23
query33	1.39	1.52	1.46
query34	15.40	2.22	1.79
query35	1.75	1.74	1.73
query36	0.46	0.29	0.29
query37	0.06	0.04	0.04
query38	0.04	0.02	0.02
query39	0.03	0.03	0.02
query40	0.11	0.08	0.07
query41	0.07	0.02	0.03
query42	0.03	0.02	0.02
query43	0.04	0.03	0.02
Total cold run time: 90.37 s
Total hot run time: 14.81 s

[hello-stephen]

FE Regression Coverage Report

Increment line coverage 33.33% (1/3) 🎉
Increment coverage report
Complete coverage report

[hello-stephen]

BE Regression && UT Coverage Report

Increment line coverage 100% (0/0) 🎉

Increment coverage report
Complete coverage report

Category	Coverage
Function Coverage	74.80% (32058/42857)
Line Coverage	59.29% (355858/600167)
Region Coverage	55.64% (296990/533775)
Branch Coverage	56.46% (133675/236747)