Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Grant 'execute' for a space object does not have an effect #9277

Closed
Lord-KA opened this issue Oct 19, 2023 · 2 comments · Fixed by #9293
Closed

Grant 'execute' for a space object does not have an effect #9277

Lord-KA opened this issue Oct 19, 2023 · 2 comments · Fixed by #9293
Assignees
@locker
Labels
3.0 Target is 3.0 and all newer release/master branches bug Something isn't working tmp

Comments

@Lord-KA
Copy link
Contributor

Lord-KA commented Oct 19, 2023

Now 'execute' permission for space objects can be granted to a user or role with the following command:

box.schema.user.grant('myuser', 'execute', 'space')

It doesn't seem to have any effect nor meaning.
@Lord-KA Lord-KA added the bug Something isn't working label Oct 19, 2023
@locker
Copy link
Member

locker commented Oct 20, 2023

According to the comment in schema.lua, this is a legacy bug, which should have been fixed in 2.0:

tarantool/src/box/lua/schema.lua

Lines 2938 to 2941 in 26d508d

-- sic: we allow to grant 'execute' on space. This is a legacy
-- bug, please fix it in 2.0
["space"] = bit.bxor(box.priv.ALL, box.priv.S,
box.priv.REVOKE, box.priv.GRANT),

@Totktonada Do you think we need a compat option for this change?

@Totktonada
Copy link
Member

@locker I guess that it is possible that read,write,execute on a space works as read,write now and it means that there is a positive scenario. So, it seems, that the compat option may be useful to run some existing code.

@locker locker added the 3.0 Target is 3.0 and all newer release/master branches label Oct 23, 2023
@locker locker self-assigned this Oct 23, 2023
locker added a commit to locker/tarantool that referenced this issue Oct 24, 2023
@locker
box: disallow granting execute privilege on space
e3e019b 
Closes tarantool#9277

@TarantoolBot document
Title: Document `box_space_execute_priv` compatibility option

Historically, it was possible to grant the `execte` privilege on
a space although this action had no effect. Since Tarantool 3.0
it isn't allowed anymore. The new `compat` module option
`box_space_execute_priv` was added to revert to the old behavior.

Example:

```
tarantool> box.cfg{log_level = 'error'}
---
...

tarantool> box.schema.user.create('alice')
---
...

tarantool> box.schema.user.grant('alice', 'execute', 'space')
---
- error: Unsupported space privilege 'execute'
...

tarantool> require('compat').box_space_execute_priv = 'old'
---
...

tarantool> box.schema.user.grant('alice', 'execute', 'space')
---
...
```
locker added a commit to locker/tarantool that referenced this issue Oct 24, 2023
@locker
box: disallow granting execute privilege on space
08ff7d3 
Closes tarantool#9277

@TarantoolBot document
Title: Document `box_space_execute_priv` compatibility option

Historically, it was possible to grant the `execte` privilege on
a space although this action had no effect. Since Tarantool 3.0
it isn't allowed anymore. The new `compat` module option
`box_space_execute_priv` was added to revert to the old behavior.

Please create a documentation page for the new compatibility option at
https://tarantool.io/compat/box_space_execute_priv

Example:

```
tarantool> box.cfg{log_level = 'error'}
---
...

tarantool> box.schema.user.create('alice')
---
...

tarantool> box.schema.user.grant('alice', 'execute', 'space')
---
- error: Unsupported space privilege 'execute'
...

tarantool> require('compat').box_space_execute_priv = 'old'
---
...

tarantool> box.schema.user.grant('alice', 'execute', 'space')
---
...
```
@locker locker mentioned this issue Oct 24, 2023
Merged
locker added a commit to locker/tarantool that referenced this issue Oct 24, 2023
@locker
box: disallow granting execute privilege on space
9672c9f 
Closes tarantool#9277

@TarantoolBot document
Title: Document `box_space_execute_priv` compatibility option

Historically, it was possible to grant the `execte` privilege on
a space although this action had no effect. Since Tarantool 3.0
it isn't allowed anymore. The new `compat` module option
`box_space_execute_priv` was added to revert to the old behavior.

Please create a documentation page for the new compatibility option at
https://tarantool.io/compat/box_space_execute_priv

Example:

```
tarantool> box.cfg{log_level = 'error'}
---
...

tarantool> box.schema.user.create('alice')
---
...

tarantool> box.schema.user.grant('alice', 'execute', 'space')
---
- error: Unsupported space privilege 'execute'
...

tarantool> require('compat').box_space_execute_priv = 'old'
---
...

tarantool> box.schema.user.grant('alice', 'execute', 'space')
---
...
```
locker added a commit that referenced this issue Oct 26, 2023
@locker
box: disallow granting execute privilege on space
21063b4 
Closes #9277

@TarantoolBot document
Title: Document `box_space_execute_priv` compatibility option

Historically, it was possible to grant the `execte` privilege on
a space although this action had no effect. Since Tarantool 3.0
it isn't allowed anymore. The new `compat` module option
`box_space_execute_priv` was added to revert to the old behavior.

Please create a documentation page for the new compatibility option at
https://tarantool.io/compat/box_space_execute_priv

Example:

```
tarantool> box.cfg{log_level = 'error'}
---
...

tarantool> box.schema.user.create('alice')
---
...

tarantool> box.schema.user.grant('alice', 'execute', 'space')
---
- error: Unsupported space privilege 'execute'
...

tarantool> require('compat').box_space_execute_priv = 'old'
---
...

tarantool> box.schema.user.grant('alice', 'execute', 'space')
---
...
```
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@locker locker

Labels
3.0 Target is 3.0 and all newer release/master branches bug Something isn't working tmp
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

box: disallow granting execute privilege on space locker/tarantool
4 participants
@Totktonada @locker @sergepetrenko @Lord-KA