Skip to content

Commit 7ad99b7

Browse files
AlexPeshkoffAlexPeshkoff
committed
Added support for system privileges
1 parent 70e3848 commit 7ad99b7

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

80 files changed

+1796
-772
lines changed

‎doc/sql.extensions/README.builtin_functions.txt

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -681,6 +681,21 @@ Example:
681681
select * from x order by rand();
682682

683683

684+
--------------------
685+
RDB$SYSTEM_PRIVILEGE
686+
--------------------
687+
688+
(FB4 extension)
689+
Function:
690+
Returns true if current attachment has given system privilege.
691+
692+
Format:
693+
RDB$SYSTEM_PRIVILEGE( <privilege> )
694+
695+
Example:
696+
select rdb$system_privilege(user_management) from rdb$database;
697+
698+
684699
-------
685700
REPLACE
686701
-------

‎doc/sql.extensions/README.ddl.txt

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -509,3 +509,61 @@ ignoring it).
509509
ALTER DATABASE DECRYPT
510510

511511
Decrypts database.
512+
513+
514+
21) New clauses in CREATE and ALTER role operators.
515+
(Alex Peshkov)
516+
517+
Provide support for system privileges. One can:
518+
519+
CREATE ROLE <name> SET SYSTEM PRIVILEGES TO <privilege1> {, <privilege2> {, ... <privilegeN> }}
520+
ALTER ROLE <name> SET SYSTEM PRIVILEGES TO <privilege1> {, <privilege2> {, ... <privilegeN> }}
521+
522+
This forms assign non-empty list of system privileges to role <name>. Privileges previously assigned
523+
to role <name> are cleared when using second form.
524+
525+
ALTER ROLE <name> DROP SYSTEM PRIVILEGES
526+
527+
This form clears list of system privileges in role <name>.
528+
529+
System privileges make it possible to delegate part of DBO rights to other users.
530+
Pay attention taht system privileges provide very thin level of control, therefore sometimes
531+
you will need to give user >1 privilege to perform some task (for example add
532+
IGNORE_DB_TRIGGERS to USE_GSTAT_UTILITY cause gstat wants to ignore database triggers).
533+
534+
List of valid system privileges for FB4 is as follows:
535+
USER_MANAGEMENT Manage users
536+
READ_RAW_PAGES Read pages in raw format using Attachment::getInfo()
537+
CREATE_USER_TYPES Add/change/delete non-system records in RDB$TYPES
538+
USE_NBACKUP_UTILITY Use nbackup to create database's copies
539+
CHANGE_SHUTDOWN_MODE Shutdown DB and bring online
540+
TRACE_ANY_ATTACHMENT Trace other users' attachments
541+
MONITOR_ANY_ATTACHMENT Monitor (tables MON$) other users' attachments
542+
ACCESS_SHUTDOWN_DATABASE Access database when it's shut down
543+
CREATE_DATABASE Create new databases (given in security.db)
544+
DROP_DATABASE Drop this database
545+
USE_GBAK_UTILITY Use appropriate utility
546+
USE_GSTAT_UTILITY ...
547+
USE_GFIX_UTILITY ...
548+
IGNORE_DB_TRIGGERS Insruct engine not to run DB-level triggers
549+
CHANGE_HEADER_SETTINGS Modify parameters in DB header page
550+
SELECT_ANY_OBJECT_IN_DATABASE Use SELECT for any selectable object
551+
ACCESS_ANY_OBJECT_IN_DATABASE Access (in any possible way) any object
552+
MODIFY_ANY_OBJECT_IN_DATABASE Modify (up to drop) any object
553+
CHANGE_MAPPING_RULES Change authentication mappings
554+
USE_GRANTED_BY_CLAUSE Use GRANTED BY in GRANT and REVOKE operators
555+
GRANT_REVOKE_ON_ANY_OBJECT GRANT and REVOKE rights on any object in database
556+
GRANT_REVOKE_ANY_DDL_RIGHT GRANT and REVOKE any DDL rights
557+
CREATE_PRIVILEGED_ROLES Use SET SYSTEM PRIVILEGES in roles
558+
559+
560+
22) New grantee type in GRANT and REVOKE operators - SYSTEM PRIVILEGE.
561+
(Alex Peshkov)
562+
563+
With support for various system privileges in engine it's getting very convenient to grant some
564+
rights to users already having specific system privilege. Therefore appropriate grantee type is
565+
suppoprted now. Example:
566+
567+
GRANT ALL ON PLG$SRP_VIEW TO SYSTEM PRIVILEGE USER_MANAGEMENT
568+
569+
Grants all rights to view (used in SRP management plugin) to users having USER_MANAGEMENT privilege.

‎lang_helpers/gds_codes.ftn

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1632,6 +1632,10 @@ C --
16321632
PARAMETER (GDS__encrypt_error = 335545109)
16331633
INTEGER*4 GDS__max_idx_depth
16341634
PARAMETER (GDS__max_idx_depth = 335545110)
1635+
INTEGER*4 GDS__wrong_prvlg
1636+
PARAMETER (GDS__wrong_prvlg = 335545111)
1637+
INTEGER*4 GDS__miss_prvlg
1638+
PARAMETER (GDS__miss_prvlg = 335545112)
16351639
INTEGER*4 GDS__gfix_db_name
16361640
PARAMETER (GDS__gfix_db_name = 335740929)
16371641
INTEGER*4 GDS__gfix_invalid_sw

‎lang_helpers/gds_codes.pas

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1627,6 +1627,10 @@
16271627
gds_encrypt_error = 335545109;
16281628
isc_max_idx_depth = 335545110;
16291629
gds_max_idx_depth = 335545110;
1630+
isc_wrong_prvlg = 335545111;
1631+
gds_wrong_prvlg = 335545111;
1632+
isc_miss_prvlg = 335545112;
1633+
gds_miss_prvlg = 335545112;
16301634
isc_gfix_db_name = 335740929;
16311635
gds_gfix_db_name = 335740929;
16321636
isc_gfix_invalid_sw = 335740930;

‎src/auth/SecureRemotePassword/manage/SrpManagement.cpp

Lines changed: 17 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -87,16 +87,18 @@ class SrpManagement FB_FINAL : public Firebird::StdPlugin<Firebird::IManagementI
8787
"CREATE VIEW PLG$SRP_VIEW AS "
8888
"SELECT PLG$USER_NAME, PLG$VERIFIER, PLG$SALT, PLG$COMMENT, "
8989
" PLG$FIRST, PLG$MIDDLE, PLG$LAST, PLG$ATTRIBUTES, PLG$ACTIVE "
90-
"FROM PLG$SRP WHERE CURRENT_USER = 'SYSDBA' "
91-
" OR CURRENT_ROLE = '" ADMIN_ROLE "' OR CURRENT_USER = PLG$SRP.PLG$USER_NAME"
90+
"FROM PLG$SRP WHERE RDB$SYSTEM_PRIVILEGE(USER_MANAGEMENT) "
91+
" OR CURRENT_USER = PLG$SRP.PLG$USER_NAME"
9292
,
93-
"GRANT ALL ON PLG$SRP to VIEW PLG$SRP_VIEW"
93+
"GRANT ALL ON PLG$SRP TO VIEW PLG$SRP_VIEW"
9494
,
95-
"GRANT SELECT ON PLG$SRP_VIEW to PUBLIC"
95+
"GRANT SELECT ON PLG$SRP_VIEW TO PUBLIC"
9696
,
9797
"GRANT UPDATE(PLG$VERIFIER, PLG$SALT, PLG$FIRST, PLG$MIDDLE, PLG$LAST, "
9898
" PLG$COMMENT, PLG$ATTRIBUTES) ON PLG$SRP_VIEW TO PUBLIC"
9999
,
100+
"GRANT ALL ON PLG$SRP_VIEW TO SYSTEM PRIVILEGE USER_MANAGEMENT"
101+
,
100102
NULL
101103
};
102104

@@ -106,10 +108,18 @@ class SrpManagement FB_FINAL : public Firebird::StdPlugin<Firebird::IManagementI
106108

107109
try
108110
{
109-
for (const char** sql = script; *sql; ++sql)
111+
for (const char** s = script; *s; ++s)
110112
{
111-
att->execute(&statusWrapper, ddlTran, 0, *sql, SQL_DIALECT_V6, NULL, NULL, NULL, NULL);
112-
check(&statusWrapper);
113+
const char* sql = *s;
114+
bool err = false;
115+
if (sql[0] == '*')
116+
{
117+
++sql;
118+
err = true;
119+
}
120+
att->execute(&statusWrapper, ddlTran, 0, sql, SQL_DIALECT_V6, NULL, NULL, NULL, NULL);
121+
if (!err)
122+
check(&statusWrapper);
113123
}
114124

115125
ddlTran->commit(&statusWrapper);

‎src/auth/SecureRemotePassword/server/SrpServer.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -132,7 +132,7 @@ int SrpServer::authenticate(CheckStatusWrapper* status, IServerBlock* sb, IWrite
132132
{
133133
ClumpletWriter dpb(ClumpletReader::dpbList, MAX_DPB_SIZE);
134134
dpb.insertByte(isc_dpb_sec_attach, TRUE);
135-
dpb.insertString(isc_dpb_user_name, SYSDBA_USER_NAME, fb_strlen(SYSDBA_USER_NAME));
135+
dpb.insertString(isc_dpb_user_name, DBA_USER_NAME, fb_strlen(DBA_USER_NAME));
136136
const char* providers = "Providers=" CURRENT_ENGINE;
137137
dpb.insertString(isc_dpb_config, providers, fb_strlen(providers));
138138
att = p->attachDatabase(status, secDbName, dpb.getBufferLength(), dpb.getBuffer());

‎src/auth/SecurityDatabase/LegacyManagement.epp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -508,7 +508,7 @@ int SecurityDatabaseManagement::execute(Firebird::CheckStatusWrapper* st, Firebi
508508

509509
found = false;
510510
// Do not allow SYSDBA user to be deleted
511-
if (!fb_utils::stricmp(user->userName()->get(), SYSDBA_USER_NAME))
511+
if (!fb_utils::stricmp(user->userName()->get(), DBA_USER_NAME))
512512
ret = GsecMsg23;
513513
else
514514
{

‎src/auth/SecurityDatabase/LegacyServer.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -289,7 +289,7 @@ void SecurityDatabase::prepare()
289289
dpb.insertByte(isc_dpb_sec_attach, TRUE);
290290

291291
// Attach as SYSDBA
292-
dpb.insertString(isc_dpb_trusted_auth, SYSDBA_USER_NAME, fb_strlen(SYSDBA_USER_NAME));
292+
dpb.insertString(isc_dpb_trusted_auth, DBA_USER_NAME, fb_strlen(DBA_USER_NAME));
293293

294294
// Do not use other providers except current engine
295295
const char* providers = "Providers=" CURRENT_ENGINE;

‎src/burp/backup.epp

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4037,6 +4037,12 @@ void write_sql_roles()
40374037
if (!X.RDB$DESCRIPTION.NULL) {
40384038
put_source_blob (att_role_description, att_role_description, X.RDB$DESCRIPTION);
40394039
}
4040+
4041+
const UCHAR ll = sizeof(X.RDB$SYSTEM_PRIVILEGES);
4042+
put(tdgbl, att_role_sys_priveleges);
4043+
put(tdgbl, ll);
4044+
put_block(tdgbl, (const UCHAR*) (X.RDB$SYSTEM_PRIVILEGES), ll);
4045+
40404046
put(tdgbl, att_end);
40414047
MISC_terminate (X.RDB$ROLE_NAME, temp, l, sizeof(temp));
40424048
BURP_verbose (249, temp);

‎src/burp/burp.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -566,6 +566,7 @@ enum att_type {
566566
att_role_name = SERIES,
567567
att_role_owner_name,
568568
att_role_description,
569+
att_role_sys_priveleges,
569570

570571
// Check constraints attributes
571572
att_chk_constraint_name = SERIES,

‎src/burp/restore.epp

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7769,6 +7769,18 @@ bool get_sql_roles(BurpGlobals* tdgbl)
77697769
bad_attribute(scan_next_attr, attribute, 250);
77707770
break;
77717771

7772+
case att_role_sys_priveleges:
7773+
{
7774+
const ULONG l = get(tdgbl);
7775+
if (l > sizeof(X.RDB$SYSTEM_PRIVILEGES))
7776+
BURP_error_redirect (NULL, 46);
7777+
// msg 46 string truncated
7778+
7779+
if (l)
7780+
get_block(tdgbl, (UCHAR*) (X.RDB$SYSTEM_PRIVILEGES), l);
7781+
}
7782+
break;
7783+
77727784
default:
77737785
// msg 250 SQL role
77747786
bad_attribute(scan_next_attr, attribute, 250);

‎src/common/classes/MetaName.h

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,9 @@ class MetaName
8181
bool isEmpty() const { return count == 0; }
8282
bool hasData() const { return count != 0; }
8383

84+
char& operator[](unsigned n) { return data[n]; }
85+
char operator[](unsigned n) const { return data[n]; }
86+
8487
const char* begin() const { return data; }
8588
const char* end() const { return data + count; }
8689

0 commit comments

Comments
 (0)