natas_hw
/
cassandra
mirror of https://github.com/apache/cassandra
0
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'cassandra-4.0' into cassandra-4.1 

* cassandra-4.0:
  allow grant permission on virtual keyspaces
This commit is contained in:
Francisco Guerrero 2025-04-18 09:14:19 -07:00
parent 8077f276c2 348ffb0ba0
commit 60ea852811
3 changed files with 18 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
CHANGES.txt
View File

@ -1,4 +1,5 @@
4.1.9 4.1.9
* Grant permission on keyspaces system_views and system_virtual_schema not possible (CASSANDRA-20171)
* Fix mixed mode paxos ttl commit hang (CASSANDRA-20514) * Fix mixed mode paxos ttl commit hang (CASSANDRA-20514)
* Fix paxos mixed mode infinite loop (CASSANDRA-20493) * Fix paxos mixed mode infinite loop (CASSANDRA-20493)
* Optionally skip exception logging on invalid legacy protocol magic exception (CASSANDRA-19483) * Optionally skip exception logging on invalid legacy protocol magic exception (CASSANDRA-19483)

4
src/java/org/apache/cassandra/auth/DataResource.java
View File

@ -24,6 +24,7 @@ import com.google.common.collect.Sets;
import org.apache.commons.lang3.StringUtils; import org.apache.commons.lang3.StringUtils;
import org.apache.cassandra.schema.Schema; import org.apache.cassandra.schema.Schema;
import org.apache.cassandra.schema.SchemaConstants;
/** /**
* The primary type of resource in Cassandra. * The primary type of resource in Cassandra.
@ -243,7 +244,8 @@ public class DataResource implements IResource
return true; return true;
case KEYSPACE: case KEYSPACE:
case ALL_TABLES: case ALL_TABLES:
return Schema.instance.getKeyspaces().contains(keyspace); return SchemaConstants.isVirtualSystemKeyspace(keyspace) ||
Schema.instance.getKeyspaces().contains(keyspace);
case TABLE: case TABLE:
return Schema.instance.getTableMetadata(keyspace, table) != null; return Schema.instance.getTableMetadata(keyspace, table) != null;
} }

14
test/unit/org/apache/cassandra/auth/GrantAndRevokeTest.java
View File

@ -35,6 +35,7 @@ import org.apache.cassandra.db.SystemKeyspace;
import org.apache.cassandra.schema.Schema; import org.apache.cassandra.schema.Schema;
import org.apache.cassandra.schema.SchemaConstants; import org.apache.cassandra.schema.SchemaConstants;
import org.apache.cassandra.schema.TableMetadata; import org.apache.cassandra.schema.TableMetadata;
import org.apache.cassandra.service.CassandraDaemon;
import org.apache.cassandra.transport.ProtocolVersion; import org.apache.cassandra.transport.ProtocolVersion;
import static java.lang.String.format; import static java.lang.String.format;
@ -58,6 +59,7 @@ public class GrantAndRevokeTest extends CQLTester
CQLTester.setUpClass(); CQLTester.setUpClass();
requireAuthentication(); requireAuthentication();
requireNetwork(); requireNetwork();
CassandraDaemon.getInstanceForTesting().setupVirtualKeyspaces();
} }
@After @After
@ -471,6 +473,18 @@ public class GrantAndRevokeTest extends CQLTester
executeNet(ProtocolVersion.CURRENT, "INSERT INTO system.peers_v2(peer, peer_port, data_center) VALUES ('127.0.100.100', 7012, 'invalid_dc')"); executeNet(ProtocolVersion.CURRENT, "INSERT INTO system.peers_v2(peer, peer_port, data_center) VALUES ('127.0.100.100', 7012, 'invalid_dc')");
} }
@Test
public void testGrantOnVirtualKeyspaces() throws Throwable
{
useSuperUser();
executeNet(String.format("CREATE ROLE %s WITH LOGIN = TRUE AND password='%s'", user, pass));
executeNet(ProtocolVersion.CURRENT, format("GRANT SELECT PERMISSION ON KEYSPACE system_virtual_schema TO %s", user));
executeNet(ProtocolVersion.CURRENT, format("GRANT SELECT PERMISSION ON KEYSPACE system_views TO %s", user));
executeNet(ProtocolVersion.CURRENT, format("REVOKE SELECT PERMISSION ON KEYSPACE system_virtual_schema FROM %s", user));
executeNet(ProtocolVersion.CURRENT, format("REVOKE SELECT PERMISSION ON KEYSPACE system_views FROM %s", user));
}
private void maybeReadSystemTables(boolean superuser) throws Throwable private void maybeReadSystemTables(boolean superuser) throws Throwable
{ {
if (superuser) if (superuser)