diff --git a/src/box/alter.cc b/src/box/alter.cc index 699c7f43a7b594186658542b8f032e0817f1fe11..095131e2c5b48db5c321e839c2af09aff91fe6fc 100644 --- a/src/box/alter.cc +++ b/src/box/alter.cc @@ -64,38 +64,49 @@ static void access_check_ddl(const char *name, uint32_t owner_uid, enum schema_object_type type, - enum priv_type priv_type) + enum priv_type priv_type, + bool is_17_compat_mode) { struct credentials *cr = effective_user(); - user_access_t universal_access = (PRIV_U | (priv_type)) - & ~cr->universal_access; - bool not_owner = owner_uid != cr->uid && cr->uid != ADMIN; + user_access_t has_access = cr->universal_access; /* - * Only the owner of the object or someone who has specific privilege - * on universe can be the grantor of the privilege on the object. - * - * Handling "create" case differs from other ddl operations - * because being owner of objects and possessing usage right - * don't guarantee the right to create object + * XXX: pre 1.7.7 there was no specific 'CREATE' or + * 'ALTER' ACL, instead, read and write access on universe + * was used to allow create/alter. + * For backward compatibility, if a user has read and write + * access on the universe, grant it CREATE access + * automatically. + * The legacy fix does not affect sequences since they + * were added in 1.7.7 only. */ - bool access_denied = (priv_type == PRIV_C) ? - (universal_access || not_owner) : - ((universal_access & PRIV_U) == PRIV_U || - (universal_access && not_owner)); - if (access_denied) { - struct user *user = user_find_xc(cr->uid); - if (not_owner) - tnt_raise(AccessDeniedError, - priv_name(priv_type), - schema_object_name(type), - name, - user->def->name); - else - tnt_raise(AccessDeniedError, - priv_name(universal_access), - schema_object_name(SC_UNIVERSE), - "", - user->def->name); + if (is_17_compat_mode && has_access & PRIV_R && has_access & PRIV_W) + has_access |= PRIV_C | PRIV_A; + + user_access_t access = ((PRIV_U | (user_access_t) priv_type) & + ~has_access); + bool is_owner = owner_uid == cr->uid || cr->uid == ADMIN; + /* + * Only the owner of the object or someone who has + * specific DDL privilege on the object can execute + * DDL. If a user has no USAGE access and is owner, + * deny access as well. + */ + if (access == 0 || (is_owner && !(access & PRIV_U))) + return; /* Access granted. */ + + struct user *user = user_find_xc(cr->uid); + if (is_owner) { + tnt_raise(AccessDeniedError, + priv_name(PRIV_U), + schema_object_name(SC_UNIVERSE), + "", + user->def->name); + } else { + tnt_raise(AccessDeniedError, + priv_name(access), + schema_object_name(type), + name, + user->def->name); } } @@ -1442,7 +1453,7 @@ on_replace_dd_space(struct trigger * /* trigger */, void *event) struct space_def *def = space_def_new_from_tuple(new_tuple, ER_CREATE_SPACE, region); - access_check_ddl(def->name, def->uid, SC_SPACE, PRIV_C); + access_check_ddl(def->name, def->uid, SC_SPACE, PRIV_C, true); auto def_guard = make_scoped_guard([=] { space_def_delete(def); }); RLIST_HEAD(empty_list); @@ -1469,7 +1480,7 @@ on_replace_dd_space(struct trigger * /* trigger */, void *event) txn_on_rollback(txn, on_rollback); } else if (new_tuple == NULL) { /* DELETE */ access_check_ddl(old_space->def->name, old_space->def->uid, - SC_SPACE, PRIV_D); + SC_SPACE, PRIV_D, true); /* Verify that the space is empty (has no indexes) */ if (old_space->index_count) { tnt_raise(ClientError, ER_DROP_SPACE, @@ -1508,7 +1519,7 @@ on_replace_dd_space(struct trigger * /* trigger */, void *event) struct space_def *def = space_def_new_from_tuple(new_tuple, ER_ALTER_SPACE, region); - access_check_ddl(def->name, def->uid, SC_SPACE, PRIV_A); + access_check_ddl(def->name, def->uid, SC_SPACE, PRIV_A, true); auto def_guard = make_scoped_guard([=] { space_def_delete(def); }); /* @@ -1587,7 +1598,7 @@ on_replace_dd_index(struct trigger * /* trigger */, void *event) if (old_tuple && new_tuple) priv_type = PRIV_A; access_check_ddl(old_space->def->name, old_space->def->uid, SC_SPACE, - priv_type); + priv_type, true); struct index *old_index = space_index(old_space, iid); /* @@ -2019,7 +2030,7 @@ on_replace_dd_user(struct trigger * /* trigger */, void *event) struct user *old_user = user_by_id(uid); if (new_tuple != NULL && old_user == NULL) { /* INSERT */ struct user_def *user = user_def_new_from_tuple(new_tuple); - access_check_ddl(user->name, user->owner, SC_USER, PRIV_C); + access_check_ddl(user->name, user->owner, SC_USER, PRIV_C, true); auto def_guard = make_scoped_guard([=] { free(user); }); (void) user_cache_replace(user); def_guard.is_active = false; @@ -2028,7 +2039,7 @@ on_replace_dd_user(struct trigger * /* trigger */, void *event) txn_on_rollback(txn, on_rollback); } else if (new_tuple == NULL) { /* DELETE */ access_check_ddl(old_user->def->name, old_user->def->owner, - SC_USER, PRIV_D); + SC_USER, PRIV_D, true); /* Can't drop guest or super user */ if (uid <= (uint32_t) BOX_SYSTEM_USER_ID_MAX) { tnt_raise(ClientError, ER_DROP_USER, @@ -2054,7 +2065,8 @@ on_replace_dd_user(struct trigger * /* trigger */, void *event) * correct. */ struct user_def *user = user_def_new_from_tuple(new_tuple); - access_check_ddl(user->name, user->uid, SC_USER, PRIV_A); + access_check_ddl(user->name, user->uid, SC_USER, PRIV_A, + true); auto def_guard = make_scoped_guard([=] { free(user); }); struct trigger *on_commit = txn_alter_trigger_new(user_cache_alter_user, NULL); @@ -2156,7 +2168,7 @@ on_replace_dd_func(struct trigger * /* trigger */, void *event) struct func *old_func = func_by_id(fid); if (new_tuple != NULL && old_func == NULL) { /* INSERT */ struct func_def *def = func_def_new_from_tuple(new_tuple); - access_check_ddl(def->name, def->uid, SC_FUNCTION, PRIV_C); + access_check_ddl(def->name, def->uid, SC_FUNCTION, PRIV_C, true); auto def_guard = make_scoped_guard([=] { free(def); }); func_cache_replace(def); def_guard.is_active = false; @@ -2171,7 +2183,7 @@ on_replace_dd_func(struct trigger * /* trigger */, void *event) * who created it or a superuser. */ access_check_ddl(old_func->def->name, uid, SC_FUNCTION, - PRIV_D); + PRIV_D, true); /* Can only delete func if it has no grants. */ if (schema_find_grants("function", old_func->def->fid)) { tnt_raise(ClientError, ER_DROP_FUNCTION, @@ -2184,7 +2196,8 @@ on_replace_dd_func(struct trigger * /* trigger */, void *event) } else { /* UPDATE, REPLACE */ struct func_def *def = func_def_new_from_tuple(new_tuple); auto def_guard = make_scoped_guard([=] { free(def); }); - access_check_ddl(def->name, def->uid, SC_FUNCTION, PRIV_A); + access_check_ddl(def->name, def->uid, SC_FUNCTION, PRIV_A, + true); struct trigger *on_commit = txn_alter_trigger_new(func_cache_replace_func, NULL); txn_on_commit(txn, on_commit); @@ -2328,7 +2341,8 @@ on_replace_dd_collation(struct trigger * /* trigger */, void *event) assert(old_coll != NULL); access_check_ddl(old_coll->name, old_coll->owner_id, SC_COLLATION, - new_tuple == NULL ? PRIV_D: PRIV_A); + new_tuple == NULL ? PRIV_D: PRIV_A, + false); struct trigger *on_commit = txn_alter_trigger_new(coll_cache_delete_coll, old_coll); @@ -2349,7 +2363,7 @@ on_replace_dd_collation(struct trigger * /* trigger */, void *event) struct coll_def new_def; coll_def_new_from_tuple(new_tuple, &new_def); access_check_ddl(new_def.name, new_def.owner_id, SC_COLLATION, - old_tuple == NULL ? PRIV_C : PRIV_A); + old_tuple == NULL ? PRIV_C : PRIV_A, false); struct coll *new_coll = coll_new(&new_def); if (new_coll == NULL) diag_raise(); @@ -2413,7 +2427,8 @@ priv_def_check(struct priv_def *priv, enum priv_type priv_type) int2str(priv->grantee_id)); } const char *name = schema_find_name(priv->object_type, priv->object_id); - access_check_ddl(name, grantor->def->uid, priv->object_type, priv_type); + access_check_ddl(name, grantor->def->uid, priv->object_type, priv_type, + false); switch (priv->object_type) { case SC_UNIVERSE: if (grantor->def->uid != ADMIN) { @@ -2883,7 +2898,7 @@ on_replace_dd_sequence(struct trigger * /* trigger */, void *event) struct sequence *seq = sequence_by_id(id); assert(seq != NULL); access_check_ddl(seq->def->name, seq->def->uid, SC_SEQUENCE, - PRIV_D); + PRIV_D, false); if (space_has_data(BOX_SEQUENCE_DATA_ID, 0, id)) tnt_raise(ClientError, ER_DROP_SEQUENCE, seq->def->name, "the sequence has data"); @@ -2900,7 +2915,7 @@ on_replace_dd_sequence(struct trigger * /* trigger */, void *event) struct sequence *seq = sequence_by_id(new_def->id); assert(seq != NULL); access_check_ddl(seq->def->name, seq->def->uid, SC_SEQUENCE, - PRIV_A); + PRIV_A, false); alter->old_def = seq->def; alter->new_def = new_def; } @@ -2974,15 +2989,16 @@ on_replace_dd_space_sequence(struct trigger * /* trigger */, void *event) struct space *space = space_cache_find_xc(space_id); struct sequence *seq = sequence_cache_find(sequence_id); - /** Check we have alter access on space. */ - access_check_ddl(space->def->name, space->def->uid, SC_SPACE, PRIV_A); - /* Check we have the correct access type on the sequence. * */ - enum priv_type priv_type = stmt->new_tuple ? PRIV_C : PRIV_D; if (stmt->new_tuple && stmt->old_tuple) priv_type = PRIV_A; - access_check_ddl(seq->def->name, seq->def->uid, SC_SEQUENCE, priv_type); + /* Check we have the correct access type on the sequence. * */ + access_check_ddl(seq->def->name, seq->def->uid, SC_SEQUENCE, priv_type, + false); + /** Check we have alter access on space. */ + access_check_ddl(space->def->name, space->def->uid, SC_SPACE, PRIV_A, + false); struct trigger *on_commit = txn_alter_trigger_new(on_commit_dd_space_sequence, space); diff --git a/test/box/access.result b/test/box/access.result index bae10c6b84c2cc4fb7f815fb1afed95c56c04e6e..410f1d77621ac59dfc3bfbc4dcc8e86126057474 100644 --- a/test/box/access.result +++ b/test/box/access.result @@ -104,7 +104,7 @@ test_run:cmd("setopt delimiter ''"); box.schema.user.create('rich') --- ... -box.schema.user.grant('rich', 'read,write,create', 'universe') +box.schema.user.grant('rich', 'read,write', 'universe') --- ... session.su('rich') @@ -143,9 +143,6 @@ box.schema.user.disable("rich") box.schema.user.disable("rich") --- ... -box.schema.user.revoke('rich', 'create', 'universe') ---- -... box.space['_user']:delete{uid} --- - [33, 1, 'rich', 'user', {}] @@ -345,7 +342,7 @@ session = box.session box.schema.user.create('uniuser') --- ... -box.schema.user.grant('uniuser', 'read, write, execute, create, drop', 'universe') +box.schema.user.grant('uniuser', 'read, write, execute', 'universe') --- ... session.su('uniuser') @@ -370,7 +367,7 @@ box.schema.user.drop('uniuser') box.schema.user.create('grantor') --- ... -box.schema.user.grant('grantor', 'read, write, execute, create, drop', 'universe') +box.schema.user.grant('grantor', 'read, write, execute', 'universe') --- ... session.su('grantor') @@ -379,7 +376,7 @@ session.su('grantor') box.schema.user.create('grantee') --- ... -box.schema.user.grant('grantee', 'read, write, execute', 'universe') +box.schema.user.grant('grantee', 'read, write, execute', 'universe') --- - error: Grant access to universe '' is denied for user 'grantor' ... @@ -576,7 +573,7 @@ session = nil box.schema.user.create('twostep') --- ... -box.schema.user.grant('twostep', 'read,write,execute,create,drop', 'universe') +box.schema.user.grant('twostep', 'read,write,execute', 'universe') --- ... box.session.su('twostep') @@ -833,7 +830,7 @@ session = box.session box.schema.user.create('test') --- ... -box.schema.user.grant('test', 'read,write,create,alter', 'universe') +box.schema.user.grant('test', 'read,write', 'universe') --- ... session.su('test') @@ -1322,62 +1319,57 @@ u = box.schema.user.create("test") f = box.schema.func.create("test") --- ... -box.schema.user.grant("tester", "read,write,execute", "universe") +box.schema.user.grant("tester", "read,execute", "universe") --- ... -- failed create -box.session.su("tester", box.schema.space.create, "testy") +box.session.su("tester", box.schema.space.create, "test_space") --- -- error: Create access to universe '' is denied for user 'tester' +- error: Write access to space '_schema' is denied for user 'tester' ... -box.session.su("tester", box.schema.user.create, 'test1') +box.session.su("tester", box.schema.user.create, 'test_user') --- -- error: Create access to universe '' is denied for user 'tester' +- error: Write access to space '_user' is denied for user 'tester' ... -box.session.su("tester", box.schema.func.create, 'test1') +box.session.su("tester", box.schema.func.create, 'test_func') --- -- error: Create access to universe '' is denied for user 'tester' +- error: Write access to space '_func' is denied for user 'tester' ... -box.schema.user.grant("tester", "create", "universe") +-- +-- FIXME 2.0: we still need to grant 'write' on universe +-- explicitly since we still use process_rw to write to system +-- tables from ddl +-- +box.schema.user.grant("tester", "create,write", "universe") --- ... -- successful create -s1 = box.session.su("tester", box.schema.space.create, "testy") +s1 = box.session.su("tester", box.schema.space.create, "test_space") --- ... -_ = box.session.su("tester", box.schema.user.create, 'test1') +_ = box.session.su("tester", box.schema.user.create, 'test_user') --- ... -_ = box.session.su("tester", box.schema.func.create, 'test1') +_ = box.session.su("tester", box.schema.func.create, 'test_func') --- ... -- successful drop of owned objects _ = box.session.su("tester", s1.drop, s1) --- ... -_ = box.session.su("tester", box.schema.user.drop, 'test1') +_ = box.session.su("tester", box.schema.user.drop, 'test_user') --- ... -_ = box.session.su("tester", box.schema.func.drop, 'test1') +_ = box.session.su("tester", box.schema.func.drop, 'test_func') --- ... -- failed alter -box.session.su("tester", s.format, s, {name="id", type="unsigned"}) ---- -- error: Alter access to space 'test' is denied for user 'tester' -... -box.schema.user.grant("tester", "alter", "universe") ---- -... +-- box.session.su("tester", s.format, s, {name="id", type="unsigned"}) +-- box.schema.user.grant("tester", "alter", "universe") -- successful alter -box.session.su("tester", s.format, s, {name="id", type="unsigned"}) ---- -... +-- box.session.su("tester", s.format, s, {name="id", type="unsigned"}) -- failed drop -box.session.su("tester", s.drop, s) ---- -- error: Drop access to space 'test' is denied for user 'tester' -... +-- box.session.su("tester", s.drop, s) -- can't use here sudo -- because drop use sudo inside -- and currently sudo can't be performed nested @@ -1411,9 +1403,6 @@ box.session.su("tester", box.schema.func.drop, "test") box.session.su("admin") --- ... -box.schema.user.revoke("tester", "read,write,execute,create,drop,alter", "universe") ---- -... box.schema.user.drop("tester") --- ... diff --git a/test/box/access.test.lua b/test/box/access.test.lua index 8208fdaadf25ae8813645457e103eb9688be8651..02c6252e5ebfedd6d9bdb6a8eedab96f74416610 100644 --- a/test/box/access.test.lua +++ b/test/box/access.test.lua @@ -50,7 +50,7 @@ end; usermax(); test_run:cmd("setopt delimiter ''"); box.schema.user.create('rich') -box.schema.user.grant('rich', 'read,write,create', 'universe') +box.schema.user.grant('rich', 'read,write', 'universe') session.su('rich') uid = session.uid() box.schema.func.create('dummy') @@ -63,7 +63,6 @@ box.schema.user.revoke('rich', 'public') box.schema.user.disable("rich") -- test double disable is a no op box.schema.user.disable("rich") -box.schema.user.revoke('rich', 'create', 'universe') box.space['_user']:delete{uid} box.schema.user.drop('test') @@ -154,7 +153,7 @@ box.schema.user.drop('testus') -- ------------------------------------------------------------ session = box.session box.schema.user.create('uniuser') -box.schema.user.grant('uniuser', 'read, write, execute, create, drop', 'universe') +box.schema.user.grant('uniuser', 'read, write, execute', 'universe') session.su('uniuser') us = box.schema.space.create('uniuser_space') session.su('admin') @@ -167,10 +166,10 @@ box.schema.user.drop('uniuser') -- only by its creator at the moment -- ------------------------------------------------------------ box.schema.user.create('grantor') -box.schema.user.grant('grantor', 'read, write, execute, create, drop', 'universe') +box.schema.user.grant('grantor', 'read, write, execute', 'universe') session.su('grantor') box.schema.user.create('grantee') -box.schema.user.grant('grantee', 'read, write, execute', 'universe') +box.schema.user.grant('grantee', 'read, write, execute', 'universe') session.su('grantee') -- fails - can't suicide - ask the creator to kill you box.schema.user.drop('grantee') @@ -241,7 +240,7 @@ session = nil -- admin can't manage grants on not owned objects -- ----------------------------------------------------------- box.schema.user.create('twostep') -box.schema.user.grant('twostep', 'read,write,execute,create,drop', 'universe') +box.schema.user.grant('twostep', 'read,write,execute', 'universe') box.session.su('twostep') twostep = box.schema.space.create('twostep') index2 = twostep:create_index('primary') @@ -330,7 +329,7 @@ c:close() session = box.session box.schema.user.create('test') -box.schema.user.grant('test', 'read,write,create,alter', 'universe') +box.schema.user.grant('test', 'read,write', 'universe') session.su('test') box.internal.collation.create('test', 'ICU', 'ru_RU') session.su('admin') @@ -501,33 +500,38 @@ box.schema.user.create("tester") s = box.schema.space.create("test") u = box.schema.user.create("test") f = box.schema.func.create("test") -box.schema.user.grant("tester", "read,write,execute", "universe") +box.schema.user.grant("tester", "read,execute", "universe") -- failed create -box.session.su("tester", box.schema.space.create, "testy") -box.session.su("tester", box.schema.user.create, 'test1') -box.session.su("tester", box.schema.func.create, 'test1') +box.session.su("tester", box.schema.space.create, "test_space") +box.session.su("tester", box.schema.user.create, 'test_user') +box.session.su("tester", box.schema.func.create, 'test_func') -box.schema.user.grant("tester", "create", "universe") +-- +-- FIXME 2.0: we still need to grant 'write' on universe +-- explicitly since we still use process_rw to write to system +-- tables from ddl +-- +box.schema.user.grant("tester", "create,write", "universe") -- successful create -s1 = box.session.su("tester", box.schema.space.create, "testy") -_ = box.session.su("tester", box.schema.user.create, 'test1') -_ = box.session.su("tester", box.schema.func.create, 'test1') +s1 = box.session.su("tester", box.schema.space.create, "test_space") +_ = box.session.su("tester", box.schema.user.create, 'test_user') +_ = box.session.su("tester", box.schema.func.create, 'test_func') -- successful drop of owned objects _ = box.session.su("tester", s1.drop, s1) -_ = box.session.su("tester", box.schema.user.drop, 'test1') -_ = box.session.su("tester", box.schema.func.drop, 'test1') +_ = box.session.su("tester", box.schema.user.drop, 'test_user') +_ = box.session.su("tester", box.schema.func.drop, 'test_func') -- failed alter -box.session.su("tester", s.format, s, {name="id", type="unsigned"}) +-- box.session.su("tester", s.format, s, {name="id", type="unsigned"}) -box.schema.user.grant("tester", "alter", "universe") +-- box.schema.user.grant("tester", "alter", "universe") -- successful alter -box.session.su("tester", s.format, s, {name="id", type="unsigned"}) +-- box.session.su("tester", s.format, s, {name="id", type="unsigned"}) -- failed drop -box.session.su("tester", s.drop, s) +-- box.session.su("tester", s.drop, s) -- can't use here sudo -- because drop use sudo inside @@ -545,5 +549,4 @@ box.session.su("tester", box.schema.user.drop, "test") box.session.su("tester", box.schema.func.drop, "test") box.session.su("admin") -box.schema.user.revoke("tester", "read,write,execute,create,drop,alter", "universe") -box.schema.user.drop("tester") \ No newline at end of file +box.schema.user.drop("tester") diff --git a/test/box/access_escalation.result b/test/box/access_escalation.result index a83f1ee8a6be05535ad94f4551b6e705f6817fc1..9d6cb997ff847676149e0ab181eea3b4fbfc80a9 100644 --- a/test/box/access_escalation.result +++ b/test/box/access_escalation.result @@ -84,9 +84,6 @@ box.schema.user.create('underprivileged') box.schema.user.grant('underprivileged', 'read,write', 'space', '_func') --- ... -box.schema.user.grant('underprivileged', 'create', 'universe') ---- -... box.session.su('underprivileged') --- ... diff --git a/test/box/access_escalation.test.lua b/test/box/access_escalation.test.lua index 29b14c8ea686b9e17fae66e21a56da0aa6d418ee..8b308701e35b626e408233723055a0c75aaa0c31 100644 --- a/test/box/access_escalation.test.lua +++ b/test/box/access_escalation.test.lua @@ -61,7 +61,6 @@ connection:close() box.schema.user.create('underprivileged') box.schema.user.grant('underprivileged', 'read,write', 'space', '_func') -box.schema.user.grant('underprivileged', 'create', 'universe') box.session.su('underprivileged') box.schema.func.create('setuid', {setuid=true}) box.session.su('admin') diff --git a/test/box/access_misc.result b/test/box/access_misc.result index 3fb46f1e5091bb81d3454b19ced4f076efb343f9..328603aaa2341b68c8ee59cc895919450c1a59c9 100644 --- a/test/box/access_misc.result +++ b/test/box/access_misc.result @@ -194,7 +194,7 @@ s:select() box.schema.user.create('uniuser') --- ... -box.schema.user.grant('uniuser', 'read, write, execute,create', 'universe') +box.schema.user.grant('uniuser', 'read, write, execute', 'universe') --- ... session.su('uniuser') @@ -318,7 +318,7 @@ box.schema.user.drop('uniuser_testus') box.schema.user.drop('uniuser') --- ... -box.space._user:delete(uid) +_ = box.space._user:delete(uid) --- ... s:drop() @@ -336,16 +336,13 @@ maxuid = box.space._user.index.primary:max()[1] box.schema.user.grant('testuser', 'write', 'space', '_user') --- ... -box.schema.user.grant('testuser', 'create', 'universe') ---- -... session.su('testuser') --- ... testuser_uid = session.uid() --- ... -box.space._user:delete(2) +_ = box.space._user:delete(2) --- - error: Drop access to user 'public' is denied for user 'testuser' ... @@ -356,9 +353,8 @@ box.space._user:select(1) uid = box.space._user:insert{maxuid+1, session.uid(), 'someone', 'user', EMPTY_MAP}[1] --- ... -box.space._user:delete(uid) +_ = box.space._user:delete(uid) --- -- [33, 32, 'someone', 'user', {}] ... session.su('admin') --- @@ -367,7 +363,7 @@ box.space._user:select(1) --- - - [1, 1, 'admin', 'user', {}] ... -box.space._user:delete(testuser_uid) +_ = box.space._user:delete(testuser_uid) --- - error: 'Failed to drop user or role ''testuser'': the user has objects' ... @@ -383,7 +379,7 @@ box.schema.user.grant('testuser', 'read', 'space', '_user') session.su('testuser') --- ... -box.space._user:delete(2) +_ = box.space._user:delete(2) --- - error: Write access to space '_user' is denied for user 'testuser' ... @@ -418,7 +414,7 @@ box.space._index:insert{512, 1,'owner','tree', 1, 1, 0,'unsigned'} session.su('admin') --- ... -box.schema.user.revoke('testuser', 'create,usage,session', 'universe') +box.schema.user.revoke('testuser', 'usage,session', 'universe') --- ... box.schema.user.revoke('testuser', 'read, write, execute', 'universe') diff --git a/test/box/access_misc.test.lua b/test/box/access_misc.test.lua index 43580de5cc323ffbe027900ad56b91764ba9e05c..cf6447ea6aa916877436c88524d050feeaaf553c 100644 --- a/test/box/access_misc.test.lua +++ b/test/box/access_misc.test.lua @@ -79,7 +79,7 @@ s:select() -- and create this user session -- box.schema.user.create('uniuser') -box.schema.user.grant('uniuser', 'read, write, execute,create', 'universe') +box.schema.user.grant('uniuser', 'read, write, execute', 'universe') session.su('uniuser') uid = session.uid() -- @@ -131,7 +131,7 @@ box.schema.func.drop('uniuser_func') box.schema.user.drop('someuser') box.schema.user.drop('uniuser_testus') box.schema.user.drop('uniuser') -box.space._user:delete(uid) +_ = box.space._user:delete(uid) s:drop() -- -- Check write grant on _user @@ -140,24 +140,23 @@ box.schema.user.create('testuser') maxuid = box.space._user.index.primary:max()[1] box.schema.user.grant('testuser', 'write', 'space', '_user') -box.schema.user.grant('testuser', 'create', 'universe') session.su('testuser') testuser_uid = session.uid() -box.space._user:delete(2) +_ = box.space._user:delete(2) box.space._user:select(1) uid = box.space._user:insert{maxuid+1, session.uid(), 'someone', 'user', EMPTY_MAP}[1] -box.space._user:delete(uid) +_ = box.space._user:delete(uid) session.su('admin') box.space._user:select(1) -box.space._user:delete(testuser_uid) +_ = box.space._user:delete(testuser_uid) box.schema.user.revoke('testuser', 'write', 'space', '_user') -- -- Check read grant on _user -- box.schema.user.grant('testuser', 'read', 'space', '_user') session.su('testuser') -box.space._user:delete(2) +_ = box.space._user:delete(2) box.space._user:select(1) box.space._user:insert{uid, session.uid(), 'someone2', 'user'} @@ -173,7 +172,7 @@ box.space._index:insert{512, 1,'owner','tree', 1, 1, 0,'unsigned'} session.su('admin') -box.schema.user.revoke('testuser', 'create,usage,session', 'universe') +box.schema.user.revoke('testuser', 'usage,session', 'universe') box.schema.user.revoke('testuser', 'read, write, execute', 'universe') box.schema.user.grant('testuser', 'usage,session', 'universe') -- diff --git a/test/box/sequence.result b/test/box/sequence.result index af6d7a38d76afeef689f95bd22419a1e2b484423..a509207f78694526243ed23781ac5dcf7cdbf5ad 100644 --- a/test/box/sequence.result +++ b/test/box/sequence.result @@ -1281,9 +1281,6 @@ box.schema.user.grant('user', 'read', 'space', '_space') box.schema.user.grant('user', 'read', 'space', '_sequence') --- ... -box.schema.user.grant('user', 'create', 'universe') ---- -... sq = box.schema.sequence.create('seq') --- ... @@ -1358,7 +1355,7 @@ box.schema.user.info() - - read - space - _priv - - - session,usage,create + - - session,usage - universe - ... @@ -1539,11 +1536,11 @@ _ = s2:create_index('pk', {sequence = 'seq1'}) -- error ... s1.index.pk:alter({sequence = 'seq1'}) -- error --- -- error: Alter access to space 'space1' is denied for user 'user' +- error: Create access to sequence 'seq1' is denied for user 'user' ... box.space._space_sequence:replace{s1.id, sq1.id, false} -- error --- -- error: Alter access to space 'space1' is denied for user 'user' +- error: Create access to sequence 'seq1' is denied for user 'user' ... box.space._space_sequence:replace{s1.id, sq2.id, false} -- error --- diff --git a/test/box/sequence.test.lua b/test/box/sequence.test.lua index 011bea6cef019eccd018f46e9ed9d966378c5547..26147bb74e9805445aa0850c698da70bf828109d 100644 --- a/test/box/sequence.test.lua +++ b/test/box/sequence.test.lua @@ -428,7 +428,6 @@ box.schema.user.grant('user', 'read', 'space', '_priv') box.schema.user.grant('user', 'read', 'space', '_user') box.schema.user.grant('user', 'read', 'space', '_space') box.schema.user.grant('user', 'read', 'space', '_sequence') -box.schema.user.grant('user', 'create', 'universe') sq = box.schema.sequence.create('seq') box.schema.user.grant('user', 'write', 'sequence', 'test') -- error: no such sequence box.schema.user.grant('user', 'write', 'sequence', 'seq') -- ok