diff --git a/changelogs/unreleased/gh-8967-creds-restore-defaults-for-default-user.md b/changelogs/unreleased/gh-8967-creds-restore-defaults-for-default-user.md new file mode 100644 index 0000000000000000000000000000000000000000..8ac282d66bb6a57a7c66a83a26ee257b0d7a91dc --- /dev/null +++ b/changelogs/unreleased/gh-8967-creds-restore-defaults-for-default-user.md @@ -0,0 +1,4 @@ +## feature/config + +* Non-default privileges are now revoked from default users and roles + when they are removed from the config (gh-8967). diff --git a/src/box/lua/config/applier/credentials.lua b/src/box/lua/config/applier/credentials.lua index e9ce2832aa2f790a24e05f84c4e6d780be6d64e4..03171f40f92dfa7f4922d357a894bff11eb82620 100644 --- a/src/box/lua/config/applier/credentials.lua +++ b/src/box/lua/config/applier/credentials.lua @@ -493,6 +493,35 @@ local function apply(config) return end + -- Tarantool has the following roles and users present by default on every + -- instance: + -- + -- Default roles: + -- * super + -- * public + -- * replication + -- + -- Default users: + -- * guest + -- * admin + -- + -- These roles and users have according privileges pre-granted by design. + -- Credentials applier adds such privileges with `priviliges_add_default()` + -- when syncing. So, for the excessive (non-default) privs to be removed, + -- these roles and users must be present inside configuration at least in a + -- form of an empty table. Otherwise, the privileges will be left unchanged, + -- similar to all used-defined roles and users. + + credentials.roles = credentials.roles or {} + credentials.roles['super'] = credentials.roles['super'] or {} + credentials.roles['public'] = credentials.roles['public'] or {} + credentials.roles['replication'] = credentials.roles['replication'] or {} + + credentials.users = credentials.users or {} + credentials.users['guest'] = credentials.users['guest'] or {} + credentials.users['admin'] = credentials.users['admin'] or {} + + -- Create roles and users and synchronise privileges for them. create_roles(credentials.roles) create_users(credentials.users) end diff --git a/test/config-luatest/credentials_applier_test.lua b/test/config-luatest/credentials_applier_test.lua index be2de2be8df684f356a2dbcc0d5baa4120ffebac..4ba7f2855234d13ead4887de0436d438fc995d42 100644 --- a/test/config-luatest/credentials_applier_test.lua +++ b/test/config-luatest/credentials_applier_test.lua @@ -636,3 +636,94 @@ g.test_remove_user_role = function(g) verify_2 = verify, }) end + +g.test_restore_defaults_for_default_user = function(g) + -- Verify that if the default users and roles are not present in config + -- their excessive privileges are revoked (restored to built-in defaults). + + helpers.reload_success_case(g, { + options = { + credentials = { + roles = { + dummy = { }, + super = { + roles = { 'dummy' }, + }, + public = { + roles = { 'dummy' }, + }, + replication = { + roles = { 'dummy' }, + }, + }, + users = { + guest = { + roles = { 'super', 'dummy' } + }, + admin = { + roles = { 'dummy' } + }, + } + } + }, + verify = function() + local internal = + require('internal.config.applier.credentials')._internal + + local default_identities = {{ + 'user', 'admin', + }, { + 'user', 'guest', + }, { + 'role', 'super', + }, { + 'role', 'public', + }, { + 'role', 'replication', + },} + + for _, id in ipairs(default_identities) do + local user_or_role, name = unpack(id) + + local perm = box.schema[user_or_role].info(name) + perm = internal.privileges_from_box(perm) + + t.assert_equals(perm['role']['dummy'], {execute = true}) + end + end, + options_2 = { + credentials = { + users = { + guest = { + roles = { 'super' } + } + } + } + }, + verify_2 = function() + local internal = + require('internal.config.applier.credentials')._internal + + local default_identities = {{ + 'user', 'admin', + }, { + 'user', 'guest', + }, { + 'role', 'super', + }, { + 'role', 'public', + }, { + 'role', 'replication', + },} + + for _, id in ipairs(default_identities) do + local user_or_role, name = unpack(id) + + local perm = box.schema[user_or_role].info(name) + perm = internal.privileges_from_box(perm) + + t.assert_not_equals(perm['role']['dummy'], {execute = true}) + end + end, + }) +end