You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ranger.apache.org by sn...@apache.org on 2014/10/22 04:56:14 UTC
git commit: ARGUS-116:Restrict permissions for xalogger and xaadmin
Repository: incubator-argus
Updated Branches:
refs/heads/master 547eab56c -> f1930dbc8
ARGUS-116:Restrict permissions for xalogger and xaadmin
Signed-off-by: sneethiraj <sn...@apache.org>
Project: http://git-wip-us.apache.org/repos/asf/incubator-argus/repo
Commit: http://git-wip-us.apache.org/repos/asf/incubator-argus/commit/f1930dbc
Tree: http://git-wip-us.apache.org/repos/asf/incubator-argus/tree/f1930dbc
Diff: http://git-wip-us.apache.org/repos/asf/incubator-argus/diff/f1930dbc
Branch: refs/heads/master
Commit: f1930dbc8c22adbf5c25abecd7b761847a1035e7
Parents: 547eab5
Author: vperiasamy <vp...@hortonworks.com>
Authored: Tue Oct 21 14:24:19 2014 -0400
Committer: sneethiraj <sn...@apache.org>
Committed: Tue Oct 21 22:56:02 2014 -0400
----------------------------------------------------------------------
security-admin/db/oracle/xa_audit_db_oracle.sql | 10 +-
security-admin/db/oracle/xa_core_db_oracle.sql | 174 ++++++++---------
security-admin/db/xa_core_db.sql | 8 +-
security-admin/scripts/install.sh | 189 ++++++++++++-------
.../java/com/xasecure/entity/XXAccessAudit.java | 4 +-
.../main/webapp/META-INF/applicationContext.xml | 4 +-
6 files changed, 219 insertions(+), 170 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/incubator-argus/blob/f1930dbc/security-admin/db/oracle/xa_audit_db_oracle.sql
----------------------------------------------------------------------
diff --git a/security-admin/db/oracle/xa_audit_db_oracle.sql b/security-admin/db/oracle/xa_audit_db_oracle.sql
index 32dc3fe..4e1a184 100644
--- a/security-admin/db/oracle/xa_audit_db_oracle.sql
+++ b/security-admin/db/oracle/xa_audit_db_oracle.sql
@@ -63,8 +63,8 @@ END;
/
call sp_dropobject('XA_ACCESS_AUDIT','TABLE');
call sp_dropobject('XA_ACCESS_AUDIT_SEQ','SEQUENCE');
-call sp_dropobject('xa_access_audit_FK_added_by_id','INDEX');
-call sp_dropobject('xa_access_audit_FK_upd_by_id','INDEX');
+call sp_dropobject('xa_access_audit_added_by_id','INDEX');
+call sp_dropobject('xa_access_audit_upd_by_id','INDEX');
call sp_dropobject('xa_access_audit_cr_time','INDEX');
call sp_dropobject('xa_access_audit_up_time','INDEX');
call sp_dropobject('xa_access_audit_event_time','INDEX');
@@ -95,9 +95,11 @@ CREATE TABLE xa_access_audit (
resource_type VARCHAR(255) DEFAULT NULL NULL ,
PRIMARY KEY (id)
);
-CREATE INDEX xa_access_audit_FK_added_by_id ON xa_access_audit(added_by_id);
-CREATE INDEX xa_access_audit_FK_upd_by_id ON xa_access_audit(upd_by_id);
+CREATE INDEX xa_access_audit_added_by_id ON xa_access_audit(added_by_id);
+CREATE INDEX xa_access_audit_upd_by_id ON xa_access_audit(upd_by_id);
CREATE INDEX xa_access_audit_cr_time ON xa_access_audit(create_time);
CREATE INDEX xa_access_audit_up_time ON xa_access_audit(update_time);
CREATE INDEX xa_access_audit_event_time ON xa_access_audit(event_time);
+CREATE OR REPLACE PUBLIC SYNONYM xa_access_audit FOR xa_access_audit;
+CREATE OR REPLACE PUBLIC SYNONYM XA_ACCESS_AUDIT_SEQ FOR XA_ACCESS_AUDIT_SEQ;
commit;
http://git-wip-us.apache.org/repos/asf/incubator-argus/blob/f1930dbc/security-admin/db/oracle/xa_core_db_oracle.sql
----------------------------------------------------------------------
diff --git a/security-admin/db/oracle/xa_core_db_oracle.sql b/security-admin/db/oracle/xa_core_db_oracle.sql
index b87a4c7..449c461 100644
--- a/security-admin/db/oracle/xa_core_db_oracle.sql
+++ b/security-admin/db/oracle/xa_core_db_oracle.sql
@@ -89,7 +89,7 @@ call sp_dropobject('X_TRX_LOG_SEQ','SEQUENCE');
call sp_dropobject('X_USER_SEQ','SEQUENCE');
call sp_dropobject('X_DB_VERSION_H_SEQ','SEQUENCE');
call sp_dropobject('V_TRX_LOG_SEQ','SEQUENCE');
-
+call sp_dropobject('XA_ACCESS_AUDIT_SEQ','SEQUENCE');
commit;
/* drop table */
@@ -132,6 +132,7 @@ CREATE SEQUENCE X_TRX_LOG_SEQ START WITH 1 INCREMENT BY 1 NOCACHE NOCYCLE;
CREATE SEQUENCE X_USER_SEQ START WITH 1 INCREMENT BY 1 NOCACHE NOCYCLE;
CREATE SEQUENCE X_DB_VERSION_H_SEQ START WITH 1 INCREMENT BY 1 NOCACHE NOCYCLE;
CREATE SEQUENCE V_TRX_LOG_SEQ START WITH 1 INCREMENT BY 1 NOCACHE NOCYCLE;
+CREATE SEQUENCE XA_ACCESS_AUDIT_SEQ START WITH 1 INCREMENT BY 1 NOCACHE NOCYCLE;
commit;
@@ -197,9 +198,7 @@ CREATE TABLE xa_access_audit (
request_data VARCHAR(2000) DEFAULT NULL NULL ,
resource_path VARCHAR(2000) DEFAULT NULL NULL ,
resource_type VARCHAR(255) DEFAULT NULL NULL ,
- PRIMARY KEY (id),
- CONSTRAINT xa_access_audit_FK_added_by_id FOREIGN KEY (added_by_id) REFERENCES x_portal_user (id),
- CONSTRAINT xa_access_audit_FK_upd_by_id FOREIGN KEY (upd_by_id) REFERENCES x_portal_user (id)
+ PRIMARY KEY (id)
);
CREATE TABLE x_asset (
@@ -447,88 +446,91 @@ commit;
CREATE VIEW vx_trx_log AS select x_trx_log.id AS id,x_trx_log.create_time AS create_time,x_trx_log.update_time AS update_time,x_trx_log.added_by_id AS added_by_id,x_trx_log.upd_by_id AS upd_by_id,x_trx_log.class_type AS class_type,x_trx_log.object_id AS object_id,x_trx_log.parent_object_id AS parent_object_id,x_trx_log.parent_object_class_type AS parent_object_class_type,x_trx_log.attr_name AS attr_name,x_trx_log.parent_object_name AS parent_object_name,x_trx_log.object_name AS object_name,x_trx_log.prev_val AS prev_val,x_trx_log.new_val AS new_val,x_trx_log.trx_id AS trx_id,x_trx_log.action AS action,x_trx_log.sess_id AS sess_id,x_trx_log.req_id AS req_id,x_trx_log.sess_type AS sess_type from x_trx_log where id in(select min(x_trx_log.id) from x_trx_log group by x_trx_log.trx_id);
commit;
-CREATE INDEX xa_access_audit_FK_added_by_id ON xa_access_audit(added_by_id);
-CREATE INDEX xa_access_audit_FK_upd_by_id ON xa_access_audit(upd_by_id);
-CREATE INDEX xa_access_audit_cr_time ON xa_access_audit(create_time);
-CREATE INDEX xa_access_audit_up_time ON xa_access_audit(update_time);
-CREATE INDEX xa_access_audit_event_time ON xa_access_audit(event_time);
-CREATE INDEX x_asset_FK_added_by_id ON x_asset(added_by_id);
-CREATE INDEX x_asset_FK_upd_by_id ON x_asset(upd_by_id);
-CREATE INDEX x_asset_cr_time ON x_asset (create_time);
-CREATE INDEX x_asset_up_time ON x_asset (update_time);
-CREATE INDEX x_audit_map_FK_added_by_id ON x_audit_map (added_by_id);
-CREATE INDEX x_audit_map_FK_upd_by_id ON x_audit_map (upd_by_id);
-CREATE INDEX x_audit_map_FK_res_id ON x_audit_map(res_id);
-CREATE INDEX x_audit_map_FK_group_id ON x_audit_map (group_id);
-CREATE INDEX x_audit_map_FK_user_id ON x_audit_map(user_id);
-CREATE INDEX x_audit_map_cr_time ON x_audit_map(create_time);
-CREATE INDEX x_audit_map_up_time ON x_audit_map (update_time);
-CREATE INDEX x_auth_sess_FK_added_by_id ON x_auth_sess (added_by_id);
-CREATE INDEX x_auth_sess_FK_upd_by_id ON x_auth_sess (upd_by_id);
-CREATE INDEX x_auth_sess_FK_user_id ON x_auth_sess (user_id);
-CREATE INDEX x_auth_sess_cr_time ON x_auth_sess (create_time);
-CREATE INDEX x_auth_sess_up_time ON x_auth_sess (update_time);
-CREATE INDEX x_cred_store_FK_added_by_id ON x_cred_store (added_by_id);
-CREATE INDEX x_cred_store_FK_upd_by_id ON x_cred_store (upd_by_id);
-CREATE INDEX x_cred_store_cr_time ON x_cred_store (create_time);
-CREATE INDEX x_cred_store_up_time ON x_cred_store (update_time);
-CREATE INDEX x_db_base_FK_added_by_id ON x_db_base (added_by_id);
-CREATE INDEX x_db_base_FK_upd_by_id ON x_db_base (upd_by_id);
-CREATE INDEX x_db_base_cr_time ON x_db_base (create_time);
-CREATE INDEX x_db_base_up_time ON x_db_base(update_time);
-CREATE INDEX x_group_FK_added_by_id ON x_group (added_by_id);
-CREATE INDEX x_group_FK_upd_by_id ON x_group (upd_by_id);
-CREATE INDEX x_group_FK_cred_store_id ON x_group (cred_store_id);
-CREATE INDEX x_group_cr_time ON x_group (create_time);
-CREATE INDEX x_group_up_time ON x_group (update_time);
-CREATE INDEX x_group_groups_FK_added_by_id ON x_group_groups (added_by_id);
-CREATE INDEX x_group_groups_FK_upd_by_id ON x_group_groups(upd_by_id);
-CREATE INDEX x_group_groups_FK_p_group_id ON x_group_groups (p_group_id);
-CREATE INDEX x_group_groups_FK_group_id ON x_group_groups(group_id);
-CREATE INDEX x_group_groups_cr_time ON x_group_groups (create_time);
-CREATE INDEX x_group_groups_up_time ON x_group_groups (update_time);
-CREATE INDEX x_group_users_FK_added_by_id ON x_group_users (added_by_id);
-CREATE INDEX x_group_users_FK_upd_by_id ON x_group_users(upd_by_id);
-CREATE INDEX x_group_users_FK_p_group_id ON x_group_users (p_group_id);
-CREATE INDEX x_group_users_FK_user_id ON x_group_users (user_id);
-CREATE INDEX x_group_users_cr_time ON x_group_users(create_time);
-CREATE INDEX x_group_users_up_time ON x_group_users(update_time);
-CREATE INDEX x_perm_map_FK_added_by_id ON x_perm_map (added_by_id);
-CREATE INDEX x_perm_map_FK_upd_by_id ON x_perm_map (upd_by_id);
-CREATE INDEX x_perm_map_FK_res_id ON x_perm_map(res_id);
-CREATE INDEX x_perm_map_FK_group_id ON x_perm_map(group_id);
-CREATE INDEX x_perm_map_FK_user_id ON x_perm_map(user_id);
-CREATE INDEX x_perm_map_cr_time ON x_perm_map (create_time);
-CREATE INDEX x_perm_map_up_time ON x_perm_map(update_time);
-CREATE INDEX x_policy_export_audit_FK_added ON x_policy_export_audit (added_by_id);
-CREATE INDEX x_policy_export_audit_FK_upd ON x_policy_export_audit (upd_by_id);
-CREATE INDEX x_policy_export_audit_cr_time ON x_policy_export_audit (create_time);
-CREATE INDEX x_policy_export_audit_up_time ON x_policy_export_audit(update_time);
-CREATE INDEX x_portal_user_FK_added_by_id ON x_portal_user (added_by_id);
-CREATE INDEX x_portal_user_FK_upd_by_id ON x_portal_user (upd_by_id);
-CREATE INDEX x_portal_user_cr_time ON x_portal_user(create_time);
-CREATE INDEX x_portal_user_up_time ON x_portal_user (update_time);
-CREATE INDEX x_portal_user_name ON x_portal_user(first_name);
-CREATE INDEX x_portal_user_role_FK_added ON x_portal_user_role(added_by_id);
-CREATE INDEX x_portal_user_role_FK_upd ON x_portal_user_role(upd_by_id);
-CREATE INDEX x_portal_user_role_FK_user_id ON x_portal_user_role(user_id);
-CREATE INDEX x_portal_user_role_cr_time ON x_portal_user_role(create_time);
-CREATE INDEX x_portal_user_role_up_time ON x_portal_user_role (update_time);
-CREATE INDEX x_resource_FK_added_by_id ON x_resource(added_by_id);
-CREATE INDEX x_resource_FK_upd_by_id ON x_resource(upd_by_id);
-CREATE INDEX x_resource_FK_asset_id ON x_resource (asset_id);
-CREATE INDEX x_resource_FK_parent_id ON x_resource (parent_id);
-CREATE INDEX x_resource_cr_time ON x_resource(create_time);
-CREATE INDEX x_resource_up_time ON x_resource (update_time);
-CREATE INDEX x_trx_log_FK_added_by_id ON x_trx_log (added_by_id);
-CREATE INDEX x_trx_log_FK_upd_by_id ON x_trx_log(upd_by_id);
-CREATE INDEX x_trx_log_cr_time ON x_trx_log (create_time);
-CREATE INDEX x_trx_log_up_time ON x_trx_log (update_time);
-CREATE INDEX x_user_FK_added_by_id ON x_user (added_by_id);
-CREATE INDEX x_user_FK_upd_by_id ON x_user (upd_by_id);
-CREATE INDEX x_user_FK_cred_store_id ON x_user (cred_store_id);
-CREATE INDEX x_user_cr_time ON x_user (create_time);
-CREATE INDEX x_user_up_time ON x_user(update_time);
+CREATE INDEX xa_access_audit_added_by_id ON xa_access_audit(added_by_id);
+CREATE INDEX xa_access_audit_upd_by_id ON xa_access_audit(upd_by_id);
+CREATE INDEX xa_access_audit_cr_time ON xa_access_audit(create_time);
+CREATE INDEX xa_access_audit_up_time ON xa_access_audit(update_time);
+CREATE INDEX xa_access_audit_event_time ON xa_access_audit(event_time);
+CREATE INDEX x_asset_FK_added_by_id ON x_asset(added_by_id);
+CREATE INDEX x_asset_FK_upd_by_id ON x_asset(upd_by_id);
+CREATE INDEX x_asset_cr_time ON x_asset (create_time);
+CREATE INDEX x_asset_up_time ON x_asset (update_time);
+CREATE INDEX x_audit_map_FK_added_by_id ON x_audit_map (added_by_id);
+CREATE INDEX x_audit_map_FK_upd_by_id ON x_audit_map (upd_by_id);
+CREATE INDEX x_audit_map_FK_res_id ON x_audit_map(res_id);
+CREATE INDEX x_audit_map_FK_group_id ON x_audit_map (group_id);
+CREATE INDEX x_audit_map_FK_user_id ON x_audit_map(user_id);
+CREATE INDEX x_audit_map_cr_time ON x_audit_map(create_time);
+CREATE INDEX x_audit_map_up_time ON x_audit_map (update_time);
+CREATE INDEX x_auth_sess_FK_added_by_id ON x_auth_sess (added_by_id);
+CREATE INDEX x_auth_sess_FK_upd_by_id ON x_auth_sess (upd_by_id);
+CREATE INDEX x_auth_sess_FK_user_id ON x_auth_sess (user_id);
+CREATE INDEX x_auth_sess_cr_time ON x_auth_sess (create_time);
+CREATE INDEX x_auth_sess_up_time ON x_auth_sess (update_time);
+CREATE INDEX x_cred_store_FK_added_by_id ON x_cred_store (added_by_id);
+CREATE INDEX x_cred_store_FK_upd_by_id ON x_cred_store (upd_by_id);
+CREATE INDEX x_cred_store_cr_time ON x_cred_store (create_time);
+CREATE INDEX x_cred_store_up_time ON x_cred_store (update_time);
+CREATE INDEX x_db_base_FK_added_by_id ON x_db_base (added_by_id);
+CREATE INDEX x_db_base_FK_upd_by_id ON x_db_base (upd_by_id);
+CREATE INDEX x_db_base_cr_time ON x_db_base (create_time);
+CREATE INDEX x_db_base_up_time ON x_db_base(update_time);
+CREATE INDEX x_group_FK_added_by_id ON x_group (added_by_id);
+CREATE INDEX x_group_FK_upd_by_id ON x_group (upd_by_id);
+CREATE INDEX x_group_FK_cred_store_id ON x_group (cred_store_id);
+CREATE INDEX x_group_cr_time ON x_group (create_time);
+CREATE INDEX x_group_up_time ON x_group (update_time);
+CREATE INDEX x_group_groups_FK_added_by_id ON x_group_groups (added_by_id);
+CREATE INDEX x_group_groups_FK_upd_by_id ON x_group_groups(upd_by_id);
+CREATE INDEX x_group_groups_FK_p_group_id ON x_group_groups (p_group_id);
+CREATE INDEX x_group_groups_FK_group_id ON x_group_groups(group_id);
+CREATE INDEX x_group_groups_cr_time ON x_group_groups (create_time);
+CREATE INDEX x_group_groups_up_time ON x_group_groups (update_time);
+CREATE INDEX x_group_users_FK_added_by_id ON x_group_users (added_by_id);
+CREATE INDEX x_group_users_FK_upd_by_id ON x_group_users(upd_by_id);
+CREATE INDEX x_group_users_FK_p_group_id ON x_group_users (p_group_id);
+CREATE INDEX x_group_users_FK_user_id ON x_group_users (user_id);
+CREATE INDEX x_group_users_cr_time ON x_group_users(create_time);
+CREATE INDEX x_group_users_up_time ON x_group_users(update_time);
+CREATE INDEX x_perm_map_FK_added_by_id ON x_perm_map (added_by_id);
+CREATE INDEX x_perm_map_FK_upd_by_id ON x_perm_map (upd_by_id);
+CREATE INDEX x_perm_map_FK_res_id ON x_perm_map(res_id);
+CREATE INDEX x_perm_map_FK_group_id ON x_perm_map(group_id);
+CREATE INDEX x_perm_map_FK_user_id ON x_perm_map(user_id);
+CREATE INDEX x_perm_map_cr_time ON x_perm_map (create_time);
+CREATE INDEX x_perm_map_up_time ON x_perm_map(update_time);
+CREATE INDEX x_policy_export_audit_FK_added ON x_policy_export_audit (added_by_id);
+CREATE INDEX x_policy_export_audit_FK_upd ON x_policy_export_audit (upd_by_id);
+CREATE INDEX x_policy_export_audit_cr_time ON x_policy_export_audit (create_time);
+CREATE INDEX x_policy_export_audit_up_time ON x_policy_export_audit(update_time);
+CREATE INDEX x_portal_user_FK_added_by_id ON x_portal_user (added_by_id);
+CREATE INDEX x_portal_user_FK_upd_by_id ON x_portal_user (upd_by_id);
+CREATE INDEX x_portal_user_cr_time ON x_portal_user(create_time);
+CREATE INDEX x_portal_user_up_time ON x_portal_user (update_time);
+CREATE INDEX x_portal_user_name ON x_portal_user(first_name);
+CREATE INDEX x_portal_user_role_FK_added ON x_portal_user_role(added_by_id);
+CREATE INDEX x_portal_user_role_FK_upd ON x_portal_user_role(upd_by_id);
+CREATE INDEX x_portal_user_role_FK_user_id ON x_portal_user_role(user_id);
+CREATE INDEX x_portal_user_role_cr_time ON x_portal_user_role(create_time);
+CREATE INDEX x_portal_user_role_up_time ON x_portal_user_role (update_time);
+CREATE INDEX x_resource_FK_added_by_id ON x_resource(added_by_id);
+CREATE INDEX x_resource_FK_upd_by_id ON x_resource(upd_by_id);
+CREATE INDEX x_resource_FK_asset_id ON x_resource (asset_id);
+CREATE INDEX x_resource_FK_parent_id ON x_resource (parent_id);
+CREATE INDEX x_resource_cr_time ON x_resource(create_time);
+CREATE INDEX x_resource_up_time ON x_resource (update_time);
+CREATE INDEX x_trx_log_FK_added_by_id ON x_trx_log (added_by_id);
+CREATE INDEX x_trx_log_FK_upd_by_id ON x_trx_log(upd_by_id);
+CREATE INDEX x_trx_log_cr_time ON x_trx_log (create_time);
+CREATE INDEX x_trx_log_up_time ON x_trx_log (update_time);
+CREATE INDEX x_user_FK_added_by_id ON x_user (added_by_id);
+CREATE INDEX x_user_FK_upd_by_id ON x_user (upd_by_id);
+CREATE INDEX x_user_FK_cred_store_id ON x_user (cred_store_id);
+CREATE INDEX x_user_cr_time ON x_user (create_time);
+CREATE INDEX x_user_up_time ON x_user(update_time);
+
+CREATE OR REPLACE PUBLIC SYNONYM xa_access_audit FOR xa_access_audit;
+CREATE OR REPLACE PUBLIC SYNONYM XA_ACCESS_AUDIT_SEQ FOR XA_ACCESS_AUDIT_SEQ;
insert into x_portal_user (
id,CREATE_TIME, UPDATE_TIME,
http://git-wip-us.apache.org/repos/asf/incubator-argus/blob/f1930dbc/security-admin/db/xa_core_db.sql
----------------------------------------------------------------------
diff --git a/security-admin/db/xa_core_db.sql b/security-admin/db/xa_core_db.sql
index a96fff3..9d889a0 100644
--- a/security-admin/db/xa_core_db.sql
+++ b/security-admin/db/xa_core_db.sql
@@ -707,13 +707,11 @@ CREATE TABLE `xa_access_audit` (
`resource_path` varchar(2000) DEFAULT NULL,
`resource_type` varchar(255) DEFAULT NULL,
PRIMARY KEY (`id`),
- KEY `xa_access_audit_FK_added_by_id` (`added_by_id`),
- KEY `xa_access_audit_FK_upd_by_id` (`upd_by_id`),
+ KEY `xa_access_audit_added_by_id` (`added_by_id`),
+ KEY `xa_access_audit_upd_by_id` (`upd_by_id`),
KEY `xa_access_audit_cr_time` (`create_time`),
KEY `xa_access_audit_up_time` (`update_time`),
- KEY `xa_access_audit_event_time` (`event_time`),
- CONSTRAINT `xa_access_audit_FK_added_by_id` FOREIGN KEY (`added_by_id`) REFERENCES `x_portal_user` (`id`),
- CONSTRAINT `xa_access_audit_FK_upd_by_id` FOREIGN KEY (`upd_by_id`) REFERENCES `x_portal_user` (`id`)
+ KEY `xa_access_audit_event_time` (`event_time`)
) ENGINE=InnoDB DEFAULT CHARSET=latin1;
/*!40101 SET character_set_client = @saved_cs_client */;
http://git-wip-us.apache.org/repos/asf/incubator-argus/blob/f1930dbc/security-admin/scripts/install.sh
----------------------------------------------------------------------
diff --git a/security-admin/scripts/install.sh b/security-admin/scripts/install.sh
index 100546c..9648fc4 100755
--- a/security-admin/scripts/install.sh
+++ b/security-admin/scripts/install.sh
@@ -250,7 +250,7 @@ create_db_user(){
strError="ERROR"
if [ "${DB_FLAVOR}" == "MYSQL" ]
then
- log "[I] Creating ${DB_FLAVOR} user '${db_user}' (using root priviledges)"
+ log "[I] Creating ${DB_FLAVOR} user '${db_user}'"
for thost in '%' localhost
do
usercount=`$SQL_COMMAND_INVOKER -B -u "$db_root_user" --password="$db_root_password" -h $DB_HOST --skip-column-names -e "select count(*) from mysql.user where user = '$db_user' and host = '$thost';"`
@@ -259,13 +259,11 @@ create_db_user(){
$SQL_COMMAND_INVOKER -B -u "$db_root_user" --password="$db_root_password" -h $DB_HOST -e "create user '$db_user'@'$thost' identified by '$db_password';"
log "[I] Creating user '$db_user' for host $thost done"
fi
- dbquery="GRANT ALL ON *.* TO '$db_user'@'$thost' ;
- grant all privileges on *.* to '$db_user'@'$thost' with grant option;
- FLUSH PRIVILEGES;"
+ dbquery="REVOKE ALL PRIVILEGES,GRANT OPTION FROM '$db_user'@'$thost';FLUSH PRIVILEGES;"
echo "${dbquery}" | $SQL_COMMAND_INVOKER -u "$db_root_user" --password="$db_root_password" -h $DB_HOST
- check_ret_status $? "'$DB_FLAVOR' create user failed"
+ check_ret_status $? "'$DB_FLAVOR' revoke *.* privileges from user '$db_user'@'$thost' failed"
done
- log "[I] Creating $DB_FLAVOR user '$db_user' (using root priviledges) DONE"
+ log "[I] Creating ${DB_FLAVOR} user '${db_user}' DONE"
fi
if [ "${DB_FLAVOR}" == "ORACLE" ]
then
@@ -289,7 +287,7 @@ create_db_user(){
log "[I] Creating User: ${db_user} Success";
fi
fi
- result5=`${SQL_COMMAND_INVOKER} -L -S "${db_root_user}"/"\"${db_root_password}\""@"${DB_HOST}" AS SYSDBA <<< "GRANT connect,resource,create view,sysdba TO ${db_user};"`
+ result5=`${SQL_COMMAND_INVOKER} -L -S "${db_root_user}"/"\"${db_root_password}\""@"${DB_HOST}" AS SYSDBA <<< "GRANT CREATE SESSION,CREATE PROCEDURE,CREATE TABLE,CREATE VIEW,CREATE SEQUENCE,CREATE PUBLIC SYNONYM,CREATE TRIGGER,UNLIMITED TABLESPACE TO ${db_user} WITH ADMIN OPTION;"`
if test "${result5#*$strError}" == "$result5"
then
log "[I] Granting User: ${db_user} Success";
@@ -298,7 +296,7 @@ create_db_user(){
log "[E] $result5"
exit 1
fi
- log "[I] Creating $DB_FLAVOR user '${db_user}' (using sysdba priviledges) DONE"
+ log "[I] Creating $DB_FLAVOR user '${db_user}' DONE"
fi
}
@@ -440,14 +438,11 @@ upgrade_db() {
if [ "${DB_FLAVOR}" == "MYSQL" ]
then
DBVERSION_CATALOG_CREATION=db/create_dbversion_catalog.sql
-
- #mysqlexec="${SQL_COMMAND_INVOKER} -u "${db_user}" --password="${db_password}" -h ${DB_HOST} ${db_name}"
-
if [ -f ${DBVERSION_CATALOG_CREATION} ]
then
log "[I] Verifying database version catalog table .... "
${mysqlexec} < ${DBVERSION_CATALOG_CREATION}
- `${SQL_COMMAND_INVOKER} -u "${db_user}" --password="${db_password}" -h ${DB_HOST} -D ${db_name} < ${DBVERSION_CATALOG_CREATION}`
+ `${SQL_COMMAND_INVOKER} -u "${db_root_user}" --password="${db_root_password}" -h ${DB_HOST} -D ${db_name} < ${DBVERSION_CATALOG_CREATION}`
check_ret_status $? "Verifying database version catalog table Failed."
fi
@@ -462,7 +457,7 @@ upgrade_db() {
version=`echo ${bn} | awk -F'-' '{ print $1 }'`
if [ "${version}" != "" ]
then
- c=`${SQL_COMMAND_INVOKER} -u "${db_user}" --password="${db_password}" -h ${DB_HOST} -D ${db_name} -B --skip-column-names -e "select count(id) from x_db_version_h where version = '${version}' and active = 'Y'"`
+ c=`${SQL_COMMAND_INVOKER} -u "${db_root_user}" --password="${db_root_password}" -h ${DB_HOST} -D ${db_name} -B --skip-column-names -e "select count(id) from x_db_version_h where version = '${version}' and active = 'Y'"`
check_ret_status $? "DBVerionCheck - ${version} Failed."
if [ ${c} -eq 0 ]
then
@@ -470,7 +465,7 @@ upgrade_db() {
echo >> ${tempFile}
echo "insert into x_db_version_h (version, inst_at, inst_by, updated_at, updated_by) values ( '${version}', now(), user(), now(), user()) ;" >> ${tempFile}
log "[I] - patch [${version}] is being applied."
- `${SQL_COMMAND_INVOKER} -u "${db_user}" --password="${db_password}" -h ${DB_HOST} -D ${db_name} < ${tempFile}`
+ `${SQL_COMMAND_INVOKER} -u "${db_root_user}" --password="${db_root_password}" -h ${DB_HOST} -D ${db_name} < ${tempFile}`
check_ret_status $? "Update patch - ${version} Failed. See sql file : [${tempFile}]"
rm -f ${tempFile}
else
@@ -553,24 +548,33 @@ import_db(){
if [ "${DB_FLAVOR}" == "MYSQL" ]
then
log "[I] Verifying Database: ${db_name}";
- existdb=`${SQL_COMMAND_INVOKER} -u "${db_user}" --password="${db_password}" -h $DB_HOST -B --skip-column-names -e "show databases like '${db_name}' ;"`
+ existdb=`${SQL_COMMAND_INVOKER} -u "${db_root_user}" --password="${db_root_password}" -h $DB_HOST -B --skip-column-names -e "show databases like '${db_name}' ;"`
if [ "${existdb}" = "${db_name}" ]
then
log "[I] - database ${db_name} already exists. Ignoring import_db ..."
else
log "[I] Creating Database: $db_name";
- $SQL_COMMAND_INVOKER -u "$db_user" --password="$db_password" -h $DB_HOST -e "create database $db_name"
+ $SQL_COMMAND_INVOKER -u "$db_root_user" --password="$db_root_password" -h $DB_HOST -e "create database $db_name"
check_ret_status $? "Creating database Failed.."
log "[I] Importing Core Database file: $mysql_core_file "
- $SQL_COMMAND_INVOKER -u "$db_user" --password="$db_password" -h $DB_HOST $db_name < $mysql_core_file
+ $SQL_COMMAND_INVOKER -u "$db_root_user" --password="$db_root_password" -h $DB_HOST $db_name < $mysql_core_file
check_ret_status $? "Importing Database Failed.."
if [ -f "${mysql_asset_file}" ]
then
- $SQL_COMMAND_INVOKER -u "$db_user" --password="$db_password" -h $DB_HOST ${db_name} < ${mysql_asset_file}
+ $SQL_COMMAND_INVOKER -u "$db_root_user" --password="$db_root_password" -h $DB_HOST ${db_name} < ${mysql_asset_file}
check_ret_status $? "Reset of DB repositories failed"
fi
log "[I] Importing Database file : $mysql_core_file DONE";
fi
+ for thost in '%' localhost
+ do
+ mysqlquery="GRANT ALL ON $db_name.* TO '$db_user'@'$thost' ;
+ GRANT ALL PRIVILEGES ON $db_name.* to '$db_user'@'$thost' WITH GRANT OPTION;
+ FLUSH PRIVILEGES;"
+ echo "${mysqlquery}" | $SQL_COMMAND_INVOKER -u "$db_root_user" --password="$db_root_password" -h $DB_HOST
+ check_ret_status $? "'$db_user' grant privileges on '$db_name' failed"
+ log "[I] Granting MYSQL user '$db_user' for host $thost DONE"
+ done
fi
if [ "${DB_FLAVOR}" == "ORACLE" ]
then
@@ -642,7 +646,7 @@ import_db(){
result8=`${SQL_COMMAND_INVOKER} -L -S "${db_root_user}"/"\"${db_root_password}\""@"${DB_HOST}" AS SYSDBA <<< "alter user ${db_user} identified by \"${db_password}\" DEFAULT TABLESPACE ${db_name};"`
#grant user
- result5=`${SQL_COMMAND_INVOKER} -L -S "${db_root_user}"/"\"${db_root_password}\""@"${DB_HOST}" AS SYSDBA <<< "GRANT connect,resource,create view,sysdba TO ${db_user};"`
+ result5=`${SQL_COMMAND_INVOKER} -L -S "${db_root_user}"/"\"${db_root_password}\""@"${DB_HOST}" AS SYSDBA <<< "GRANT CREATE SESSION,CREATE PROCEDURE,CREATE TABLE,CREATE VIEW,CREATE SEQUENCE,CREATE PUBLIC SYNONYM,CREATE TRIGGER,UNLIMITED TABLESPACE TO ${db_user} WITH ADMIN OPTION;"`
if test "${result5#*$strError}" == "$result5"
then
log "[I] Granting User: ${db_user} Success";
@@ -668,7 +672,7 @@ import_db(){
else
log "[I] - database ${db_name} already exists. Ignoring import_db ..." ;
fi
- fi
+ fi
}
extract_war () {
@@ -923,6 +927,7 @@ create_audit_db_user(){
log "[I] TABLESPACE $AUDIT_DB already exists."
fi
fi
+
#Verifying Users
log "[I] Verifying Audit User: $AUDIT_USER";
if [ "${DB_FLAVOR}" == "MYSQL" ]
@@ -930,25 +935,24 @@ create_audit_db_user(){
for thost in '%' localhost
do
usercount=`$SQL_COMMAND_INVOKER -B -u "$db_root_user" --password="$db_root_password" -h $DB_HOST --skip-column-names -e "select count(*) from mysql.user where user = '$AUDIT_USER' and host = '$thost';"`
-
if [ ${usercount} -eq 0 ]
then
- log "[I] Creating MYSQL user '$AUDIT_USER'@'$thost' (using root priviledges)"
+ log "[I] Creating ${DB_FLAVOR} user '$AUDIT_USER'@'$thost'"
$SQL_COMMAND_INVOKER -B -u "$db_root_user" --password="$db_root_password" -h $DB_HOST -e "create user '$AUDIT_USER'@'$thost' identified by '$AUDIT_PASSWORD';"
- check_ret_status $? "MYSQL create user failed"
+ check_ret_status $? "${DB_FLAVOR} create user failed"
+ fi
+ if [ "${AUDIT_USER}" != "${db_user}" ]
+ then
+ mysqlquery="REVOKE ALL PRIVILEGES,GRANT OPTION FROM '$AUDIT_USER'@'$thost' ;
+ FLUSH PRIVILEGES;"
+ echo "${mysqlquery}" | $SQL_COMMAND_INVOKER -u "$db_root_user" --password="$db_root_password" -h $DB_HOST
+ check_ret_status $? "'$DB_FLAVOR' revoke privileges from user '$AUDIT_USER'@'$thost' failed"
+ log "[I] '$DB_FLAVOR' revoke all privileges from user '$AUDIT_USER'@'$thost' DONE"
fi
- mysqlquery="GRANT ALL ON *.* TO '$AUDIT_USER'@'$thost' ;
- grant all privileges on *.* to '$AUDIT_USER'@'$thost' with grant option;
- FLUSH PRIVILEGES;"
-
- echo "${mysqlquery}" | $SQL_COMMAND_INVOKER -u "$db_root_user" --password="$db_root_password" -h $DB_HOST
- check_ret_status $? "'$DB_FLAVOR' create user failed"
- log "[I] Creating MYSQL user '$AUDIT_USER' for host $thost(using root priviledges) DONE"
done
fi
if [ "${DB_FLAVOR}" == "ORACLE" ]
then
-
result3=`${SQL_COMMAND_INVOKER} -L -S "${db_root_user}"/"\"${db_root_password}\""@"${DB_HOST}" AS SYSDBA <<< "select UPPER(username) from all_users where UPPER(username)=UPPER('${AUDIT_USER}');"`
username=`echo $AUDIT_USER | tr '[:lower:]' '[:upper:]'`
if test "${result3#*$username}" == "$result3" #does not contains username so create user
@@ -963,57 +967,100 @@ create_audit_db_user(){
log "[E] $result4"
exit 1
fi
- else
- log "[I] User: ${AUDIT_USER} exist";
- fi
- result5=`${SQL_COMMAND_INVOKER} -L -S "${db_root_user}"/"\"${db_root_password}\""@"${DB_HOST}" AS SYSDBA <<< "GRANT connect,resource,create view TO ${AUDIT_USER};"`
- if test "${result5#*$strError}" == "$result5"
- then
- log "[I] Granting User: $AUDIT_USER Success";
- else
- log "[E] Granting User: $AUDIT_USER Failed";
- log "[E] $result5"
- exit 1
- fi
- fi
+ else
+ log "[I] User: ${AUDIT_USER} exist";
+ fi
+ result5=`${SQL_COMMAND_INVOKER} -L -S "${db_root_user}"/"\"${db_root_password}\""@"${DB_HOST}" AS SYSDBA <<< "GRANT CREATE SESSION TO ${AUDIT_USER};"`
+ if test "${result5#*$strError}" == "$result5"
+ then
+ log "[I] Granting User: $AUDIT_USER Success";
+ else
+ log "[E] Granting User: $AUDIT_USER Failed";
+ log "[E] $result5"
+ exit 1
+ fi
+ fi
- AUDIT_TABLE=xa_access_audit
+ #Verifying audit table
+ AUDIT_TABLE=xa_access_audit
+ if [ "${DB_FLAVOR}" == "MYSQL" ]
+ then
log "[I] Verifying table $AUDIT_TABLE in audit database $AUDIT_DB";
- if [ "${DB_FLAVOR}" == "MYSQL" ]
+ existtbl=`${SQL_COMMAND_INVOKER} -u "$db_root_user" --password="$db_root_password" -D $AUDIT_DB -h $DB_HOST -B --skip-column-names -e "show tables like '$AUDIT_TABLE' ;"`
+ if [ "${existtbl}" != "$AUDIT_TABLE" ]
then
- existtbl=`${SQL_COMMAND_INVOKER} -u "$AUDIT_USER" --password="$AUDIT_PASSWORD" -D $AUDIT_DB -h $DB_HOST -B --skip-column-names -e "show tables like '$AUDIT_TABLE' ;"`
-
- if [ "${existtbl}" != "$AUDIT_TABLE" ]
+ log "[I] Importing Audit Database file: $mysql_audit_file..."
+ $SQL_COMMAND_INVOKER -u "$db_root_user" --password="$db_root_password" -h $DB_HOST $AUDIT_DB < $mysql_audit_file
+ check_ret_status $? "Importing Audit Database Failed.."
+ log "[I] Importing Audit Database file : $mysql_audit_file DONE";
+ else
+ log "[I] Table $AUDIT_TABLE already exists in audit database $AUDIT_DB"
+ fi
+ fi
+ if [ "${DB_FLAVOR}" == "ORACLE" ]
+ then
+ log "[I] Verifying table $AUDIT_TABLE in TABLESPACE $db_name";
+ # ASSIGN DEFAULT TABLESPACE ${db_name}
+ result8=`${SQL_COMMAND_INVOKER} -L -S "${db_root_user}"/"\"${db_root_password}\""@"${DB_HOST}" AS SYSDBA <<< "alter user ${AUDIT_USER} identified by \"${AUDIT_PASSWORD}\" DEFAULT TABLESPACE ${AUDIT_DB};"`
+ result6=`${SQL_COMMAND_INVOKER} -L -S "${db_root_user}"/"\"${db_root_password}\""@"${DB_HOST}" AS SYSDBA <<< "select UPPER(table_name) from all_tables where UPPER(tablespace_name)=UPPER('$db_name') and UPPER(table_name)=UPPER('${AUDIT_TABLE}');"`
+ tablename=`echo $AUDIT_TABLE | tr '[:lower:]' '[:upper:]'`
+ if test "${result6#*$tablename}" == "$result6" #does not contains tablename so create table
+ then
+ log "[I] Importing Audit Database file: $oracle_audit_file..."
+ result7=`echo "exit"|${SQL_COMMAND_INVOKER} -L -S "${db_user}"/"\"${db_password}\""@"${DB_HOST}" @$oracle_audit_file`
+ if test "${result7#*$strError}" == "$result7"
then
- log "[I] Importing Audit Database file: $mysql_audit_file..."
- $SQL_COMMAND_INVOKER -u "$AUDIT_USER" --password="$AUDIT_PASSWORD" -h $DB_HOST $AUDIT_DB < $mysql_audit_file
- check_ret_status $? "Importing Audit Database Failed.."
- log "[I] Importing Audit Database file : $mysql_audit_file DONE";
+ log "[I] Importing Audit Database file : $oracle_audit_file DONE";
else
- log "[I] Table $AUDIT_TABLE already exists in audit database $AUDIT_DB"
+ log "[E] Importing Audit Database file : $oracle_audit_file failed";
+ log "[E] $result7"
fi
+ else
+ log "[I] Table $AUDIT_TABLE already exists in TABLESPACE $db_name"
fi
- if [ "${DB_FLAVOR}" == "ORACLE" ]
+ fi
+
+ #Granting Users
+ log "[I] Granting Privileges to User: $AUDIT_USER";
+ if [ "${DB_FLAVOR}" == "MYSQL" ]
+ then
+ for thost in '%' localhost
+ do
+ mysqlquery="GRANT ALL ON $AUDIT_DB.* TO '$db_user'@'$thost' ;
+ GRANT ALL PRIVILEGES ON $AUDIT_DB.* to '$db_user'@'$thost' WITH GRANT OPTION;
+ FLUSH PRIVILEGES;"
+ echo "${mysqlquery}" | $SQL_COMMAND_INVOKER -u "$db_root_user" --password="$db_root_password" -h $DB_HOST
+ check_ret_status $? "'$db_user' grant privileges on '$AUDIT_DB' failed"
+ log "[I] Creating MYSQL user '$AUDIT_USER' for host $thost DONE"
+
+ mysqlquery="GRANT INSERT ON $AUDIT_DB.$AUDIT_TABLE TO '$AUDIT_USER'@'$thost' ;
+ FLUSH PRIVILEGES;"
+ echo "${mysqlquery}" | $SQL_COMMAND_INVOKER -u "$db_root_user" --password="$db_root_password" -h $DB_HOST
+ check_ret_status $? "'$DB_FLAVOR' grant INSERT privileges to user '$AUDIT_USER'@'$thost' on $AUDIT_TABLE failed"
+ log "[I] '$DB_FLAVOR' grant INSERT privileges to user '$AUDIT_USER'@'$thost' on $AUDIT_TABLE DONE"
+ done
+ fi
+ if [ "${DB_FLAVOR}" == "ORACLE" ]
+ then
+ if [ "${AUDIT_USER}" != "${db_user}" ]
then
- # ASSIGN DEFAULT TABLESPACE ${db_name}
- result8=`${SQL_COMMAND_INVOKER} -L -S "${db_root_user}"/"\"${db_root_password}\""@"${DB_HOST}" AS SYSDBA <<< "alter user ${AUDIT_USER} identified by \"${AUDIT_PASSWORD}\" DEFAULT TABLESPACE ${AUDIT_DB};"`
- result6=`${SQL_COMMAND_INVOKER} -L -S "${db_root_user}"/"\"${db_root_password}\""@"${DB_HOST}" AS SYSDBA <<< "select UPPER(table_name) from all_tables where tablespace_name='$AUDIT_DB' and UPPER(table_name)=UPPER('${AUDIT_TABLE}');"`
- tablename=`echo $AUDIT_TABLE | tr '[:lower:]' '[:upper:]'`
- if test "${result6#*$tablename}" == "$result6" #does not contains tablename so create table
+ result11=`${SQL_COMMAND_INVOKER} -L -S "${db_root_user}"/"\"${db_root_password}\""@"${DB_HOST}" AS SYSDBA <<< "GRANT SELECT ON ${db_user}.XA_ACCESS_AUDIT_SEQ TO ${AUDIT_USER};"`
+ result12=`${SQL_COMMAND_INVOKER} -L -S "${db_root_user}"/"\"${db_root_password}\""@"${DB_HOST}" AS SYSDBA <<< "GRANT INSERT ON ${db_user}.${AUDIT_TABLE} TO ${AUDIT_USER};"`
+ if test "${result11#*$strError}" != "$result11"
then
- log "[I] Importing Audit Database file: $oracle_audit_file..."
- result7=`echo "exit"|${SQL_COMMAND_INVOKER} -L -S "${AUDIT_USER}"/"\"${AUDIT_PASSWORD}\""@"${DB_HOST}" @$oracle_audit_file`
- if test "${result7#*$strError}" == "$result7"
- then
- log "[I] Importing Audit Database file : $oracle_audit_file DONE";
- else
- log "[E] Importing Audit Database file : $oracle_audit_file failed";
- log "[E] $result7"
- fi
+ log "[E] Granting User: $AUDIT_USER Failed";
+ log "[E] $result11";
+ exit1
+ elif test "${result12#*$strError}" != "$result12"
+ then
+ log "[E] Granting User: $AUDIT_USER Failed";
+ log "[E] $result12";
+ exit 1
else
- log "[I] Table $AUDIT_TABLE already exists in audit database $AUDIT_DB"
+ log "[I] Granting User: $AUDIT_USER Success";
fi
fi
+ fi
}
do_unixauth_setup() {
@@ -1224,7 +1271,7 @@ execute_java_patches(){
then
dt=`date '+%s'`
tempFile=/tmp/sql_${dt}_$$.sql
- mysqlexec="${SQL_COMMAND_INVOKER} -u ${db_user} --password="${db_password}" -h ${DB_HOST} ${db_name}"
+ mysqlexec="${SQL_COMMAND_INVOKER} -u ${db_root_user} --password="${db_root_password}" -h ${DB_HOST} ${db_name}"
javaFiles=`ls -1 $app_home/WEB-INF/classes/com/xasecure/patch/Patch*.class 2> /dev/null | awk -F/ '{ print $NF }' | awk -F_J '{ print $2, $0 }' | sort -k1 -n | awk '{ printf("%s\n",$2) ; }'`
for javaPatch in ${javaFiles}
do
http://git-wip-us.apache.org/repos/asf/incubator-argus/blob/f1930dbc/security-admin/src/main/java/com/xasecure/entity/XXAccessAudit.java
----------------------------------------------------------------------
diff --git a/security-admin/src/main/java/com/xasecure/entity/XXAccessAudit.java b/security-admin/src/main/java/com/xasecure/entity/XXAccessAudit.java
index e697d29..726c59e 100644
--- a/security-admin/src/main/java/com/xasecure/entity/XXAccessAudit.java
+++ b/security-admin/src/main/java/com/xasecure/entity/XXAccessAudit.java
@@ -38,8 +38,8 @@ public class XXAccessAudit extends XXDBBase implements java.io.Serializable {
private static final long serialVersionUID = 1L;
@Id
- @SequenceGenerator(name="X_ACCESS_AUDIT_SEQ",sequenceName="X_ACCESS_AUDIT_SEQ",allocationSize=1)
- @GeneratedValue(strategy=GenerationType.AUTO,generator="X_ACCESS_AUDIT_SEQ")
+ @SequenceGenerator(name="XA_ACCESS_AUDIT_SEQ",sequenceName="XA_ACCESS_AUDIT_SEQ",allocationSize=1)
+ @GeneratedValue(strategy=GenerationType.AUTO,generator="XA_ACCESS_AUDIT_SEQ")
@Column(name="ID")
protected Long id;
http://git-wip-us.apache.org/repos/asf/incubator-argus/blob/f1930dbc/security-admin/src/main/webapp/META-INF/applicationContext.xml
----------------------------------------------------------------------
diff --git a/security-admin/src/main/webapp/META-INF/applicationContext.xml b/security-admin/src/main/webapp/META-INF/applicationContext.xml
index 19a0c17..602dcb5 100644
--- a/security-admin/src/main/webapp/META-INF/applicationContext.xml
+++ b/security-admin/src/main/webapp/META-INF/applicationContext.xml
@@ -168,10 +168,10 @@ http://www.springframework.org/schema/util/spring-util.xsd">
<value>${auditDB.jdbc.url}</value>
</property>
<property name="user">
- <value>${auditDB.jdbc.user}</value>
+ <value>${jdbc.user}</value>
</property>
<property name="password">
- <value>${auditDB.jdbc.password}</value>
+ <value>${jdbc.password}</value>
</property>
<property name="maxPoolSize">
<value>20</value>