You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@trafodion.apache.org by rm...@apache.org on 2016/09/28 14:50:47 UTC
[2/3] incubator-trafodion git commit: TRAFODION-2203 - a user can grant privileges that he doesn’t have ...
TRAFODION-2203 - a user can grant privileges that he doesn\u2019t have ...
... to other users/roles successfully
In this case, the user/role did not get the privilege requested even though the
operation successfully completed. So the requester is lead to believe that the
privilege was granted.
ANSI states that: "warning <privilege not granted>" should be displayed for
each combination of grantee<=>privilege that was not granted. However,
privileges that can be successfully granted should be granted. The grant code
does not grant any privileges it cannot grant but is not reporting warnings if
the privilege is not granted. Ditto for revoke.
The code now reports warnings if not all privileges were granted or revoked for
both object and column privileges.
Also As part of this fix, the next piece of unifying object and column
privileges has been performed. This task:
- Replaced ColPrivEntry with a PrivMgrCoreDesc - now object and column privs
have the same base structure.
- Create a new method that performs common functions between grant and revoke
statements
- Removed methods not longer needed
- Use column level privileges in the privsToGrant and privsToRevoke structs
- Fixed bug in showddl where privileges were not always displayed.
- Minor changes to make object and columns names more unified
Project: http://git-wip-us.apache.org/repos/asf/incubator-trafodion/repo
Commit: http://git-wip-us.apache.org/repos/asf/incubator-trafodion/commit/877a8e8a
Tree: http://git-wip-us.apache.org/repos/asf/incubator-trafodion/tree/877a8e8a
Diff: http://git-wip-us.apache.org/repos/asf/incubator-trafodion/diff/877a8e8a
Branch: refs/heads/master
Commit: 877a8e8a6d0fd8d4ed1ef808954eb95fb4834add
Parents: 58e0061
Author: Roberta Marton <ro...@apache.org>
Authored: Mon Sep 26 21:22:55 2016 +0000
Committer: Roberta Marton <ro...@apache.org>
Committed: Mon Sep 26 21:22:55 2016 +0000
----------------------------------------------------------------------
core/sql/bin/SqlciErrors.txt | 4 +-
core/sql/regress/privs2/EXPECTED129 | 16 +-
core/sql/regress/privs2/EXPECTED135 | 12 +-
core/sql/regress/privs2/EXPECTED140 | 4 +-
core/sql/sqlcomp/PrivMgrDesc.cpp | 36 +-
core/sql/sqlcomp/PrivMgrDesc.h | 22 +-
core/sql/sqlcomp/PrivMgrPrivileges.cpp | 1349 ++++++++++++---------------
core/sql/sqlcomp/PrivMgrPrivileges.h | 78 +-
8 files changed, 668 insertions(+), 853 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/incubator-trafodion/blob/877a8e8a/core/sql/bin/SqlciErrors.txt
----------------------------------------------------------------------
diff --git a/core/sql/bin/SqlciErrors.txt b/core/sql/bin/SqlciErrors.txt
index 78b026b..2d6166b 100644
--- a/core/sql/bin/SqlciErrors.txt
+++ b/core/sql/bin/SqlciErrors.txt
@@ -12,9 +12,9 @@
1010 0A000 99999 ADVANCED MINOR DBADMIN The statement just entered is currently not supported.
1011 ZZZZZ 99999 ADVANCED MINOR DBADMIN Only one grantee per grant or revoke is allowed.
1012 01007 99999 BEGINNER MAJOR DBADMIN No privileges were granted. You lack grant option on the specified privileges.
-1013 01007 99999 BEGINNER MAJOR DBADMIN Not all privileges were granted. You lack grant option on some of the specified privileges.
+1013 01007 99999 BEGINNER MAJOR DBADMIN Not all privileges were granted. You lack grant option for the $0~string0 privilege.
1014 2B000 99999 BEGINNER MAJOR DBADMIN Privileges were not revoked. Dependent privilege descriptors still exist.
-1015 01006 99999 BEGINNER MAJOR DBADMIN Some of the specified privileges could not be revoked.
+1015 01006 99999 BEGINNER MAJOR DBADMIN Not all privileges were revoked. You lack the grant option for the $0~string0 privilege.
1016 ZZZZZ 99999 BEGINNER MAJOR DBADMIN Redundant references to column $0~ColumnName were specified in the constraint or trigger definition.
1017 ZZZZZ 99999 BEGINNER MAJOR DBADMIN You are not authorized to perform this operation.
1018 ZZZZZ 99999 BEGINNER MAJOR DBADMIN Grant of role or privilege $0~String0 from $1~String1 to $2~String2 not found, revoke request ignored.
http://git-wip-us.apache.org/repos/asf/incubator-trafodion/blob/877a8e8a/core/sql/regress/privs2/EXPECTED129
----------------------------------------------------------------------
diff --git a/core/sql/regress/privs2/EXPECTED129 b/core/sql/regress/privs2/EXPECTED129
index 848826e..aa0f688 100644
--- a/core/sql/regress/privs2/EXPECTED129
+++ b/core/sql/regress/privs2/EXPECTED129
@@ -815,18 +815,18 @@ CREATE TABLE TRAFODION.US4.T4
>>-- Negative tests: revoking from table
>>revoke select (c) on t3 from sql_user3;
-*** ERROR[1018] Grant of role or privilege SELECT on TRAFODION.US4.T3 from SQL_USER4 to SQL_USER3 not found, revoke request ignored.
+*** WARNING[1018] Grant of role or privilege SELECT WITH GRANT OPTION (columm number 2) on TRAFODION.US4.T3 from SQL_USER4 to SQL_USER3 not found, revoke request ignored.
---- SQL operation failed with errors.
+--- SQL operation complete.
>>revoke select (b) on t3 from sql_user3;
--- SQL operation complete.
>>
>>revoke grant option for select (c) on t3 from sql_user3;
-*** ERROR[1018] Grant of role or privilege SELECT on TRAFODION.US4.T3 from SQL_USER4 to SQL_USER3 not found, revoke request ignored.
+*** WARNING[1018] Grant of role or privilege SELECT WITH GRANT OPTION (columm number 2) on TRAFODION.US4.T3 from SQL_USER4 to SQL_USER3 not found, revoke request ignored.
---- SQL operation failed with errors.
+--- SQL operation complete.
>>
>>revoke grant option for select (d) on t3 from sql_user3;
@@ -834,14 +834,14 @@ CREATE TABLE TRAFODION.US4.T4
>>
>>revoke grant option for select (b) on t3 from sql_user3;
-*** ERROR[1018] Grant of role or privilege SELECT on TRAFODION.US4.T3 from SQL_USER4 to SQL_USER3 not found, revoke request ignored.
+*** WARNING[1018] Grant of role or privilege SELECT WITH GRANT OPTION (columm number 1) on TRAFODION.US4.T3 from SQL_USER4 to SQL_USER3 not found, revoke request ignored.
---- SQL operation failed with errors.
+--- SQL operation complete.
>>revoke grant option for select (b) on t3 from sql_user3 cascade;
-*** ERROR[1018] Grant of role or privilege SELECT on TRAFODION.US4.T3 from SQL_USER4 to SQL_USER3 not found, revoke request ignored.
+*** WARNING[1018] Grant of role or privilege SELECT WITH GRANT OPTION (columm number 1) on TRAFODION.US4.T3 from SQL_USER4 to SQL_USER3 not found, revoke request ignored.
---- SQL operation failed with errors.
+--- SQL operation complete.
>>showddl t3;
CREATE TABLE TRAFODION.US4.T3
http://git-wip-us.apache.org/repos/asf/incubator-trafodion/blob/877a8e8a/core/sql/regress/privs2/EXPECTED135
----------------------------------------------------------------------
diff --git a/core/sql/regress/privs2/EXPECTED135 b/core/sql/regress/privs2/EXPECTED135
index 7aa3fc9..f07ad76 100644
--- a/core/sql/regress/privs2/EXPECTED135
+++ b/core/sql/regress/privs2/EXPECTED135
@@ -400,10 +400,10 @@ CREATE TABLE TRAFODION.T135SCH.T135_T1
;
-- GRANT SELECT, INSERT, DELETE, UPDATE, REFERENCES ON TRAFODION.T135SCH.T135_T1 TO DB__ROOT WITH GRANT OPTION;
- GRANT SELECT, INSERT, DELETE, UPDATE, USAGE, REFERENCES ON
- TRAFODION.T135SCH.T135_T1 TO SQL_USER1;
-GRANT SELECT, INSERT, DELETE, UPDATE,
- USAGE, REFERENCES ON TRAFODION.T135SCH.T135_T1 TO SQL_USER2;
+ GRANT SELECT, INSERT, DELETE, UPDATE, REFERENCES ON TRAFODION.T135SCH.T135_T1
+ TO SQL_USER1;
+GRANT SELECT, INSERT, DELETE, UPDATE, REFERENCES ON
+ TRAFODION.T135SCH.T135_T1 TO SQL_USER2;
--- SQL operation complete.
>>showddl t135_t2;
@@ -417,8 +417,8 @@ CREATE TABLE TRAFODION.T135SCH.T135_T2
;
-- GRANT SELECT, INSERT, DELETE, UPDATE, REFERENCES ON TRAFODION.T135SCH.T135_T2 TO DB__ROOT WITH GRANT OPTION;
- GRANT SELECT, INSERT, DELETE, UPDATE, USAGE, REFERENCES ON
- TRAFODION.T135SCH.T135_T2 TO SQL_USER2;
+ GRANT SELECT, INSERT, DELETE, UPDATE, REFERENCES ON TRAFODION.T135SCH.T135_T2
+ TO SQL_USER2;
--- SQL operation complete.
>>-- user can create view but just have select and references, it is
http://git-wip-us.apache.org/repos/asf/incubator-trafodion/blob/877a8e8a/core/sql/regress/privs2/EXPECTED140
----------------------------------------------------------------------
diff --git a/core/sql/regress/privs2/EXPECTED140 b/core/sql/regress/privs2/EXPECTED140
index b31683f..72d899e 100644
--- a/core/sql/regress/privs2/EXPECTED140
+++ b/core/sql/regress/privs2/EXPECTED140
@@ -9,7 +9,7 @@ LIST_COUNT 4294967295
LOG FILE LOG140
MESSAGEFILE /mnt/rmarton/gitws/incubator-trafodion/core/sqf/export/ ...
MESSAGEFILE LANG US English
-MESSAGEFILE VRSN {2016-02-08 16:33 LINUX:EDEV05/rmarton}
+MESSAGEFILE VRSN {2016-09-23 23:03 LINUX:EDEV05/rmarton}
SQL CATALOG TRAFODION
SQL SCHEMA T140_SHARED_VIEWS
SQL USER CONNECTED user not connected
@@ -616,6 +616,8 @@ Tom White Socks
>>-- user3 can propagate select but no insert on table teams
>>grant select, insert on teams to sql_user4;
+*** WARNING[1013] Not all privileges were granted. You lack grant option for the INSERT privilege.
+
--- SQL operation complete.
>>
>>-- user3 can propagate insert on table players
http://git-wip-us.apache.org/repos/asf/incubator-trafodion/blob/877a8e8a/core/sql/sqlcomp/PrivMgrDesc.cpp
----------------------------------------------------------------------
diff --git a/core/sql/sqlcomp/PrivMgrDesc.cpp b/core/sql/sqlcomp/PrivMgrDesc.cpp
index 8065f8a..0bd4679 100644
--- a/core/sql/sqlcomp/PrivMgrDesc.cpp
+++ b/core/sql/sqlcomp/PrivMgrDesc.cpp
@@ -61,10 +61,14 @@ void PrivMgrCoreDesc::setPriv(const PrivType which,
priv_.set(SELECT_PRIV, value);
priv_.set(INSERT_PRIV, value);
priv_.set(UPDATE_PRIV, value);
- priv_.set(USAGE_PRIV, value);
priv_.set(DELETE_PRIV, value);
priv_.set(REFERENCES_PRIV, value);
- priv_.set(EXECUTE_PRIV, value);
+
+ // ANSI describes USAGE as a DML priv but it is only
+ // valid in Trafodion for sequence generators. For now,
+ // don't include in DML
+ //priv_.set(USAGE_PRIV, value);
+ //priv_.set(EXECUTE_PRIV, value);
break;
@@ -550,14 +554,28 @@ void PrivMgrCoreDesc::interpretChanges( const bool before, // in
// ----------------------------------------------------------------------------
bool PrivMgrDesc::limitToGrantable( const PrivMgrDesc& other )
{
-
bool result = false;
- PrivMgrCoreDesc logicalTablePrivs(other.tableLevel_);
- // TDB - include column level privileges
-
- if ( tableLevel_.limitToGrantable(logicalTablePrivs) )
- result = TRUE;
+ if ( tableLevel_.limitToGrantable(other.tableLevel_) )
+ result = true;
- return result;
+ // Consider table level privileges when checking column privs
+ PrivMgrCoreDesc temp = other.tableLevel_;
+ for (int i = 0; i < columnLevel_.entries(); i++)
+ {
+ // Find associated column in other Desc list
+ int index = other.getColumnPriv(columnLevel_[i].getColumnOrdinal());
+ if (index >= 0)
+ {
+ temp.unionOfPrivs(other.columnLevel_[index]);
+ if (columnLevel_[i].limitToGrantable(temp))
+ result = true;
+ }
+ else
+ {
+ if (columnLevel_[i].limitToGrantable(temp))
+ result = true;
+ }
+ }
+ return result;
}
http://git-wip-us.apache.org/repos/asf/incubator-trafodion/blob/877a8e8a/core/sql/sqlcomp/PrivMgrDesc.h
----------------------------------------------------------------------
diff --git a/core/sql/sqlcomp/PrivMgrDesc.h b/core/sql/sqlcomp/PrivMgrDesc.h
index e0e2e11..832255b 100644
--- a/core/sql/sqlcomp/PrivMgrDesc.h
+++ b/core/sql/sqlcomp/PrivMgrDesc.h
@@ -393,7 +393,6 @@ public:
grantee_(grantee)
{}
- //PrivMgrDesc(const int32_t nbrCols); // preset constructor
PrivMgrDesc(const PrivMgrDesc &privs, // preset constructor
const int32_t grantee)
: tableLevel_(privs.tableLevel_),
@@ -461,10 +460,18 @@ public:
// isNull - returns True iff no privs or wgos
bool isNull() const
{
- return ( tableLevel_.isNull());
- // TBD: add columnLevel_.isNull()
+ if (tableLevel_.isNull() )
+ return isColumnLevelNull();
+ return false;
}
+ bool isColumnLevelNull() const
+ {
+ for (int i = 0; i < columnLevel_.entries(); i++)
+ if (!columnLevel_[i].isNull())
+ return false;
+ return true;
+ }
// isNullWgo - returns True iff no wgos are set
bool isNullWgo() const;
@@ -483,6 +490,15 @@ public:
PrivMgrCoreDesc getTablePrivs() const { return tableLevel_; }
NAList<PrivMgrCoreDesc> getColumnPrivs() const { return columnLevel_; }
+
+ // Get the PrivMgrCoreDesc based on the columnOrdinal (column number)
+ int getColumnPriv(int32_t columnOrdinal) const
+ {
+ for (int i = 0; i < columnLevel_.entries(); i++)
+ if (columnLevel_[i].getColumnOrdinal() == columnOrdinal) return i;
+ return -1;
+ }
+
int32_t getGrantee() const { return grantee_; }
PrivMgrCoreDesc & fetchTablePrivs();
bool getOneTablePriv(const PrivType which) const;