-
Notifications
You must be signed in to change notification settings - Fork 37
Open
Labels
bugSomething isn't workingSomething isn't working
Description
When using Role Based Whitelisting with the following setup:
Given user/role kalle_wl wihch is granted all permissions to table ks.test:
cassandra@cqlsh> grant all on TABLE ks.test TO kalle_wl;
And the user/role is whitelisted for the ks.test table:
cassandra@cqlsh> ALTER ROLE kalle_wl WITH OPTIONS = { 'GRANT AUDIT WHITELIST FOR ALL' : 'data/ks/test' };
Gives the following permissions:
cassandra@cqlsh> list all PERMISSIONS of kalle_wl;
role | username | resource | permission
----------+----------+-----------------+------------
kalle_wl | kalle_wl | <table ks.test> | ALTER
kalle_wl | kalle_wl | <table ks.test> | DROP
kalle_wl | kalle_wl | <table ks.test> | SELECT
kalle_wl | kalle_wl | <table ks.test> | MODIFY
kalle_wl | kalle_wl | <table ks.test> | AUTHORIZE
Gives the role options:
cassandra@cqlsh> list roles;
role | super | login | options
-----------+-------+-------+--------------------------------------------------------------------------
cassandra | True | True | {}
kalle_wl | False | False | {'AUDIT WHITELIST ON data/ks/test': 'ALTER,DROP,SELECT,MODIFY,AUTHORIZE'}
When the table is dropped:
cassandra@cqlsh> DROP TABLE ks.test ;
Then the permission for that table is removed:
cassandra@cqlsh> list all PERMISSIONS of kalle_wl ;
role | resource | permissions
------+----------+-------------
BUT the whitelist-data for that user is not removed:
cassandra@cqlsh> list roles;
role | super | login | options
-----------+-------+-------+--------------------------------------------------------------------------
cassandra | True | True | {}
kalle_wl | False | False | {'AUDIT WHITELIST ON data/ks/test': 'ALTER,DROP,SELECT,MODIFY,AUTHORIZE'}
-> This could lead to whitelist "issues" if another table is created with the same name... The new table will immediately be whitelisted, which might not be the intent.
Metadata
Metadata
Assignees
Labels
bugSomething isn't workingSomething isn't working