-
Notifications
You must be signed in to change notification settings - Fork 4.1k
GRANT SYSTEM ALL removes login privilege from role #101292
Copy link
Copy link
Closed
Labels
C-bugCode not up to spec/doc, specs & docs deemed correct. Solution expected to change code/behavior.Code not up to spec/doc, specs & docs deemed correct. Solution expected to change code/behavior.O-communityOriginated from the communityOriginated from the communityT-sql-foundationsSQL Foundations Team (formerly SQL Schema + SQL Sessions)SQL Foundations Team (formerly SQL Schema + SQL Sessions)v23.1.5
Description
Describe the problem
The GRANT SYSTEM ALL statement removes login permission from a role.
To Reproduce
To reproduce
- Create a user
- Verify that the user can log in
- Grant
SYSTEM ALLprivileges to the user - Verify that the user can no longer log in
If possible, provide steps to reproduce the behavior:
▶ cockroach start-single-node --insecure --background
*
* WARNING: ALL SECURITY CONTROLS HAVE BEEN DISABLED!
*
* This mode is intended for non-production testing only.
*
* In this mode:
* - Your cluster is open to any client that can access any of your IP addresses.
* - Intruders with access to your machine or network can observe client-server traffic.
* - Intruders can log in without password and read or write any data in the cluster.
* - Intruders can consume all your server's resources and cause unavailability.
*
*
* INFO: To start a secure server without mandating TLS for clients,
* consider --accept-sql-without-tls instead. For other options, see:
*
* - https://go.crdb.dev/issue-v/53404/v22.2
* - https://www.cockroachlabs.com/docs/v22.2/secure-a-cluster.html
*
*
* WARNING: Running a server without --sql-addr, with a combined RPC/SQL listener, is deprecated.
* This feature will be removed in the next version of CockroachDB.
*
*
* WARNING: neither --listen-addr nor --advertise-addr was specified.
* The server will advertise "crlMBP-NRWLD7WPC6MTc1.local" to other nodes, is this routable?
*
* Consider using:
* - for local-only servers: --listen-addr=localhost:36257 --sql-addr=localhost:26257
* - for multi-node clusters: --listen-addr=:36257 --sql-addr=:26257 --advertise-addr=<host/IP addr>
*
*
▶ cockroach sql --insecure -e "show users";
username | options | member_of
-----------+---------+------------
admin | | {}
root | | {admin}
(2 rows)
Time: 20ms
▶ cockroach sql --insecure -e "create user abc";
CREATE ROLE
Time: 114ms
▶ cockroach sql --insecure --user abc -e "show databases";
database_name | owner | primary_region | secondary_region | regions | survival_goal
----------------+-------+----------------+------------------+---------+----------------
defaultdb | root | NULL | NULL | {} | NULL
postgres | root | NULL | NULL | {} | NULL
(2 rows)
Time: 2ms
▶ cockroach sql --insecure -e "grant system all to abc";
GRANT
Time: 88ms
▶ cockroach sql --insecure --user abc -e "show databases";
ERROR: abc does not have login privilege
SQLSTATE: 28000
Failed running "sql"
Expected behavior
The user should not lose the login privilege when they are granted all system privileges.
Environment:
- CockroachDB version: 22.2.7
- Server OS: reproduced on Linux and MacOS
- Client app:
cockroach sql
Jira issue: CRDB-26895
Epic CRDB-27601
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
C-bugCode not up to spec/doc, specs & docs deemed correct. Solution expected to change code/behavior.Code not up to spec/doc, specs & docs deemed correct. Solution expected to change code/behavior.O-communityOriginated from the communityOriginated from the communityT-sql-foundationsSQL Foundations Team (formerly SQL Schema + SQL Sessions)SQL Foundations Team (formerly SQL Schema + SQL Sessions)v23.1.5