box: add lua_call and lua_eval grant object types
Granting the execute privilege on the 'lua_eval' object enables evaluaing any Lua expression via IPROTO_EVAL. Granting the execute privilege on the 'lua_call' object enables calling any global Lua function via IPROTO_CALL except: - Functions from the _func system space (see box.schema.func.create). Access to them is still governed only by the 'function' object type. - Built-in functions. We assume that all functions that were added to _G before loading user modules are built-in. Note, after this change access_check_universe_object becoms unused so it's removed (merged with access_check_universe). Part of #8803 NO_DOC=later
Showing
- changelogs/unreleased/gh-8803-exec-priv.md 8 additions, 0 deletionschangelogs/unreleased/gh-8803-exec-priv.md
- src/box/call.c 42 additions, 4 deletionssrc/box/call.c
- src/box/lua/schema.lua 16 additions, 3 deletionssrc/box/lua/schema.lua
- src/box/schema_def.c 2 additions, 0 deletionssrc/box/schema_def.c
- src/box/schema_def.h 2 additions, 0 deletionssrc/box/schema_def.h
- src/box/session.c 2 additions, 10 deletionssrc/box/session.c
- src/box/session.h 0 additions, 10 deletionssrc/box/session.h
- src/box/user.cc 4 additions, 0 deletionssrc/box/user.cc
- src/box/user.h 4 additions, 0 deletionssrc/box/user.h
- src/lua/init.c 59 additions, 0 deletionssrc/lua/init.c
- src/lua/init.h 4 additions, 0 deletionssrc/lua/init.h
- test/box-luatest/gh_8803_exec_priv_test.lua 172 additions, 0 deletionstest/box-luatest/gh_8803_exec_priv_test.lua
Loading
Please register or sign in to comment