Skip to content

Dropping table does not remove role-based whitelist on that table #136

@etedpet

Description

@etedpet

When using Role Based Whitelisting with the following setup:

Given user/role kalle_wl wihch is granted all permissions to table ks.test:
cassandra@cqlsh> grant all on TABLE ks.test TO kalle_wl;

And the user/role is whitelisted for the ks.test table:
cassandra@cqlsh> ALTER ROLE kalle_wl WITH OPTIONS = { 'GRANT AUDIT WHITELIST FOR ALL' : 'data/ks/test' };

Gives the following permissions:

cassandra@cqlsh> list all PERMISSIONS of kalle_wl;
 role     | username | resource        | permission
----------+----------+-----------------+------------
 kalle_wl | kalle_wl | <table ks.test> |      ALTER
 kalle_wl | kalle_wl | <table ks.test> |       DROP
 kalle_wl | kalle_wl | <table ks.test> |     SELECT
 kalle_wl | kalle_wl | <table ks.test> |     MODIFY
 kalle_wl | kalle_wl | <table ks.test> |  AUTHORIZE

Gives the role options:

cassandra@cqlsh> list roles;
 role      | super | login | options
-----------+-------+-------+--------------------------------------------------------------------------
 cassandra |  True |  True |                                                                        {}
  kalle_wl | False | False | {'AUDIT WHITELIST ON data/ks/test': 'ALTER,DROP,SELECT,MODIFY,AUTHORIZE'}

When the table is dropped:
cassandra@cqlsh> DROP TABLE ks.test ;

Then the permission for that table is removed:

cassandra@cqlsh> list all PERMISSIONS of kalle_wl ;
 role | resource | permissions
------+----------+-------------

BUT the whitelist-data for that user is not removed:

cassandra@cqlsh> list roles;
 role      | super | login | options
-----------+-------+-------+--------------------------------------------------------------------------
 cassandra |  True |  True |                                                                        {}
  kalle_wl | False | False | {'AUDIT WHITELIST ON data/ks/test': 'ALTER,DROP,SELECT,MODIFY,AUTHORIZE'}

-> This could lead to whitelist "issues" if another table is created with the same name... The new table will immediately be whitelisted, which might not be the intent.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions