natas_hw
/
cassandra
mirror of https://github.com/apache/cassandra
0
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

allow grant permission on virtual keyspaces 

Patch by Tibor Répási; reviewed by Francisco Guerrero, Maxwell Guo for CASSANDRA-20171
This commit is contained in:
Tibor Répási 2025-02-19 13:59:36 +01:00 committed by Francisco Guerrero
parent 78290bed45
commit 348ffb0ba0
3 changed files with 18 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
CHANGES.txt
View File

@ -1,4 +1,5 @@
4.0.18
* Grant permission on keyspaces system_views and system_virtual_schema not possible (CASSANDRA-20171)
* Avoid computing prepared statement size for unprepared batches (CASSANDRA-20556)
* Fix Dropwizard Meter causes timeouts when infrequently used (CASSANDRA-19332)
* Update OWASP dependency checker to version 12.1.0 (CASSANDRA-20501)

4
src/java/org/apache/cassandra/auth/DataResource.java
View File

@ -24,6 +24,7 @@ import com.google.common.collect.Sets;
import org.apache.commons.lang3.StringUtils;
import org.apache.cassandra.schema.Schema;
import org.apache.cassandra.schema.SchemaConstants;
/**
* The primary type of resource in Cassandra.
@ -209,7 +210,8 @@ public class DataResource implements IResource
case ROOT:
return true;
case KEYSPACE:
return Schema.instance.getKeyspaces().contains(keyspace);
return SchemaConstants.isVirtualSystemKeyspace(keyspace) ||
Schema.instance.getKeyspaces().contains(keyspace);
case TABLE:
return Schema.instance.getTableMetadata(keyspace, table) != null;
}

14
test/unit/org/apache/cassandra/auth/GrantAndRevokeTest.java
View File

@ -40,6 +40,7 @@ import org.apache.cassandra.schema.TableMetadata;
import org.apache.cassandra.cql3.CQLTester;
import org.apache.cassandra.db.SystemKeyspace;
import org.apache.cassandra.utils.Pair;
import org.apache.cassandra.service.CassandraDaemon;
import static java.lang.String.format;
import static org.apache.cassandra.schema.SchemaConstants.LOCAL_SYSTEM_KEYSPACE_NAMES;
@ -66,6 +67,7 @@ public class GrantAndRevokeTest extends CQLTester
DatabaseDescriptor.getRoleManager().setup();
DatabaseDescriptor.getAuthenticator().setup();
DatabaseDescriptor.getAuthorizer().setup();
CassandraDaemon.getInstanceForTesting().setupVirtualKeyspaces();
}
@After
@ -302,6 +304,18 @@ public class GrantAndRevokeTest extends CQLTester
}
@Test
public void testGrantOnVirtualKeyspaces() throws Throwable
{
Session superuser = session(SUPERUSER);
superuser.execute(String.format("CREATE ROLE %s WITH LOGIN = TRUE AND password='%s'", user, pass));
superuser.execute(String.format("GRANT SELECT PERMISSION ON KEYSPACE system_virtual_schema TO %s", user));
superuser.execute(String.format("GRANT SELECT PERMISSION ON KEYSPACE system_views TO %s", user));
superuser.execute(String.format("REVOKE SELECT PERMISSION ON KEYSPACE system_virtual_schema FROM %s", user));
superuser.execute(String.format("REVOKE SELECT PERMISSION ON KEYSPACE system_views FROM %s", user));
}
private void maybeReadSystemTables(Session session, boolean isSuper) throws Throwable
{
Set<String> readableKeyspaces = new HashSet<>(Arrays.asList(SchemaConstants.SCHEMA_KEYSPACE_NAME, SchemaConstants.TRACE_KEYSPACE_NAME));