This is an automated email from the ASF dual-hosted git repository. morningman pushed a commit to branch branch-2.0 in repository https://gitbox.apache.org/repos/asf/doris.git
The following commit(s) were added to refs/heads/branch-2.0 by this push: new 656cbbb96b2 [branch-2.0](auth)Not allowed to operate internal_schema database (#29790) (#30013) 656cbbb96b2 is described below commit 656cbbb96b238b51abcf1232322a10c1b205211f Author: zhangdong <493738...@qq.com> AuthorDate: Fri Jan 19 14:46:44 2024 +0800 [branch-2.0](auth)Not allowed to operate internal_schema database (#29790) (#30013) bp #29790 --- .../doris/analysis/AlterDatabasePropertyStmt.java | 3 +- .../doris/analysis/AlterDatabaseQuotaStmt.java | 3 +- .../apache/doris/analysis/AlterDatabaseRename.java | 3 +- .../org/apache/doris/analysis/AlterTableStmt.java | 2 + .../org/apache/doris/analysis/CreateDbStmt.java | 2 + .../org/apache/doris/analysis/CreateTableStmt.java | 6 +- .../java/org/apache/doris/analysis/DropDbStmt.java | 3 +- .../org/apache/doris/analysis/DropTableStmt.java | 3 +- .../doris/analysis/InsertOverwriteTableStmt.java | 14 +++ .../apache/doris/analysis/TruncateTableStmt.java | 3 +- .../doris/common/util/InternalDatabaseUtil.java | 38 +++++++ .../doris/transaction/DatabaseTransactionMgr.java | 3 + .../operate_internal_schema.groovy | 126 +++++++++++++++++++++ 13 files changed, 201 insertions(+), 8 deletions(-) diff --git a/fe/fe-core/src/main/java/org/apache/doris/analysis/AlterDatabasePropertyStmt.java b/fe/fe-core/src/main/java/org/apache/doris/analysis/AlterDatabasePropertyStmt.java index 28d65652081..b8c1b8f0003 100644 --- a/fe/fe-core/src/main/java/org/apache/doris/analysis/AlterDatabasePropertyStmt.java +++ b/fe/fe-core/src/main/java/org/apache/doris/analysis/AlterDatabasePropertyStmt.java @@ -22,6 +22,7 @@ import org.apache.doris.cluster.ClusterNamespace; import org.apache.doris.common.ErrorCode; import org.apache.doris.common.ErrorReport; import org.apache.doris.common.UserException; +import org.apache.doris.common.util.InternalDatabaseUtil; import org.apache.doris.common.util.PrintableMap; import org.apache.doris.common.util.PropertyAnalyzer; import org.apache.doris.mysql.privilege.PrivPredicate; @@ -52,7 +53,7 @@ public class AlterDatabasePropertyStmt extends DdlStmt { @Override public void analyze(Analyzer analyzer) throws UserException { super.analyze(analyzer); - + InternalDatabaseUtil.checkDatabase(dbName, ConnectContext.get()); if (!Env.getCurrentEnv().getAccessManager().checkGlobalPriv(ConnectContext.get(), PrivPredicate.ADMIN)) { ErrorReport.reportAnalysisException(ErrorCode.ERR_DBACCESS_DENIED_ERROR, analyzer.getQualifiedUser(), dbName); diff --git a/fe/fe-core/src/main/java/org/apache/doris/analysis/AlterDatabaseQuotaStmt.java b/fe/fe-core/src/main/java/org/apache/doris/analysis/AlterDatabaseQuotaStmt.java index ef3bc0f1e03..0770fd85269 100644 --- a/fe/fe-core/src/main/java/org/apache/doris/analysis/AlterDatabaseQuotaStmt.java +++ b/fe/fe-core/src/main/java/org/apache/doris/analysis/AlterDatabaseQuotaStmt.java @@ -22,6 +22,7 @@ import org.apache.doris.cluster.ClusterNamespace; import org.apache.doris.common.ErrorCode; import org.apache.doris.common.ErrorReport; import org.apache.doris.common.UserException; +import org.apache.doris.common.util.InternalDatabaseUtil; import org.apache.doris.common.util.ParseUtil; import org.apache.doris.mysql.privilege.PrivPredicate; import org.apache.doris.qe.ConnectContext; @@ -62,7 +63,7 @@ public class AlterDatabaseQuotaStmt extends DdlStmt { @Override public void analyze(Analyzer analyzer) throws UserException { super.analyze(analyzer); - + InternalDatabaseUtil.checkDatabase(dbName, ConnectContext.get()); if (!Env.getCurrentEnv().getAccessManager().checkGlobalPriv(ConnectContext.get(), PrivPredicate.ADMIN)) { ErrorReport.reportAnalysisException(ErrorCode.ERR_DBACCESS_DENIED_ERROR, analyzer.getQualifiedUser(), dbName); diff --git a/fe/fe-core/src/main/java/org/apache/doris/analysis/AlterDatabaseRename.java b/fe/fe-core/src/main/java/org/apache/doris/analysis/AlterDatabaseRename.java index 7876952f721..67558b438ba 100644 --- a/fe/fe-core/src/main/java/org/apache/doris/analysis/AlterDatabaseRename.java +++ b/fe/fe-core/src/main/java/org/apache/doris/analysis/AlterDatabaseRename.java @@ -25,6 +25,7 @@ import org.apache.doris.common.ErrorCode; import org.apache.doris.common.ErrorReport; import org.apache.doris.common.FeNameFormat; import org.apache.doris.common.UserException; +import org.apache.doris.common.util.InternalDatabaseUtil; import org.apache.doris.mysql.privilege.PrivBitSet; import org.apache.doris.mysql.privilege.PrivPredicate; import org.apache.doris.mysql.privilege.Privilege; @@ -55,7 +56,7 @@ public class AlterDatabaseRename extends DdlStmt { if (Strings.isNullOrEmpty(dbName)) { throw new AnalysisException("Database name is not set"); } - + InternalDatabaseUtil.checkDatabase(dbName, ConnectContext.get()); if (!Env.getCurrentEnv().getAccessManager().checkDbPriv(ConnectContext.get(), dbName, PrivPredicate.of(PrivBitSet.of(Privilege.ADMIN_PRIV, Privilege.ALTER_PRIV), Operator.OR))) { ErrorReport.reportAnalysisException(ErrorCode.ERR_DBACCESS_DENIED_ERROR, diff --git a/fe/fe-core/src/main/java/org/apache/doris/analysis/AlterTableStmt.java b/fe/fe-core/src/main/java/org/apache/doris/analysis/AlterTableStmt.java index f2831a628f2..d702f09022d 100644 --- a/fe/fe-core/src/main/java/org/apache/doris/analysis/AlterTableStmt.java +++ b/fe/fe-core/src/main/java/org/apache/doris/analysis/AlterTableStmt.java @@ -27,6 +27,7 @@ import org.apache.doris.common.AnalysisException; import org.apache.doris.common.ErrorCode; import org.apache.doris.common.ErrorReport; import org.apache.doris.common.UserException; +import org.apache.doris.common.util.InternalDatabaseUtil; import org.apache.doris.common.util.PropertyAnalyzer; import org.apache.doris.common.util.Util; import org.apache.doris.mysql.privilege.PrivPredicate; @@ -67,6 +68,7 @@ public class AlterTableStmt extends DdlStmt { tbl.analyze(analyzer); // disallow external catalog Util.prohibitExternalCatalog(tbl.getCtl(), this.getClass().getSimpleName()); + InternalDatabaseUtil.checkDatabase(tbl.getDb(), ConnectContext.get()); if (!Env.getCurrentEnv().getAccessManager().checkTblPriv(ConnectContext.get(), tbl.getDb(), tbl.getTbl(), PrivPredicate.ALTER)) { ErrorReport.reportAnalysisException(ErrorCode.ERR_TABLEACCESS_DENIED_ERROR, "ALTER TABLE", diff --git a/fe/fe-core/src/main/java/org/apache/doris/analysis/CreateDbStmt.java b/fe/fe-core/src/main/java/org/apache/doris/analysis/CreateDbStmt.java index b1f90678893..fa52da40c5d 100644 --- a/fe/fe-core/src/main/java/org/apache/doris/analysis/CreateDbStmt.java +++ b/fe/fe-core/src/main/java/org/apache/doris/analysis/CreateDbStmt.java @@ -23,6 +23,7 @@ import org.apache.doris.common.ErrorCode; import org.apache.doris.common.ErrorReport; import org.apache.doris.common.FeNameFormat; import org.apache.doris.common.UserException; +import org.apache.doris.common.util.InternalDatabaseUtil; import org.apache.doris.common.util.PrintableMap; import org.apache.doris.mysql.privilege.PrivPredicate; import org.apache.doris.qe.ConnectContext; @@ -64,6 +65,7 @@ public class CreateDbStmt extends DdlStmt { FeNameFormat.checkDbName(dbName); dbName = ClusterNamespace.getFullName(getClusterName(), dbName); + InternalDatabaseUtil.checkDatabase(dbName, ConnectContext.get()); if (!Env.getCurrentEnv().getAccessManager().checkDbPriv(ConnectContext.get(), dbName, PrivPredicate.CREATE)) { ErrorReport.reportAnalysisException( ErrorCode.ERR_DBACCESS_DENIED_ERROR, analyzer.getQualifiedUser(), dbName); diff --git a/fe/fe-core/src/main/java/org/apache/doris/analysis/CreateTableStmt.java b/fe/fe-core/src/main/java/org/apache/doris/analysis/CreateTableStmt.java index a7a898a7f88..22f55598856 100644 --- a/fe/fe-core/src/main/java/org/apache/doris/analysis/CreateTableStmt.java +++ b/fe/fe-core/src/main/java/org/apache/doris/analysis/CreateTableStmt.java @@ -37,6 +37,7 @@ import org.apache.doris.common.FeNameFormat; import org.apache.doris.common.Pair; import org.apache.doris.common.UserException; import org.apache.doris.common.util.AutoBucketUtils; +import org.apache.doris.common.util.InternalDatabaseUtil; import org.apache.doris.common.util.ParseUtil; import org.apache.doris.common.util.PrintableMap; import org.apache.doris.common.util.PropertyAnalyzer; @@ -311,8 +312,9 @@ public class CreateTableStmt extends DdlStmt { // disallow external catalog Util.prohibitExternalCatalog(tableName.getCtl(), this.getClass().getSimpleName()); - if (!Env.getCurrentEnv().getAccessManager().checkTblPriv(ConnectContext.get(), tableName.getDb(), - tableName.getTbl(), PrivPredicate.CREATE)) { + InternalDatabaseUtil.checkDatabase(tableName.getDb(), ConnectContext.get()); + if (!Env.getCurrentEnv().getAccessManager() + .checkTblPriv(ConnectContext.get(), tableName.getDb(), tableName.getTbl(), PrivPredicate.CREATE)) { ErrorReport.reportAnalysisException(ErrorCode.ERR_SPECIFIC_ACCESS_DENIED_ERROR, "CREATE"); } diff --git a/fe/fe-core/src/main/java/org/apache/doris/analysis/DropDbStmt.java b/fe/fe-core/src/main/java/org/apache/doris/analysis/DropDbStmt.java index f4edb5a408a..2699dff0e92 100644 --- a/fe/fe-core/src/main/java/org/apache/doris/analysis/DropDbStmt.java +++ b/fe/fe-core/src/main/java/org/apache/doris/analysis/DropDbStmt.java @@ -24,6 +24,7 @@ import org.apache.doris.cluster.ClusterNamespace; import org.apache.doris.common.ErrorCode; import org.apache.doris.common.ErrorReport; import org.apache.doris.common.UserException; +import org.apache.doris.common.util.InternalDatabaseUtil; import org.apache.doris.mysql.privilege.PrivPredicate; import org.apache.doris.qe.ConnectContext; @@ -60,7 +61,7 @@ public class DropDbStmt extends DdlStmt { ErrorReport.reportAnalysisException(ErrorCode.ERR_WRONG_DB_NAME, dbName); } dbName = ClusterNamespace.getFullName(getClusterName(), dbName); - + InternalDatabaseUtil.checkDatabase(dbName, ConnectContext.get()); // Don't allow to drop mysql compatible databases DatabaseIf db = Env.getCurrentInternalCatalog().getDbNullable(dbName); if (db != null && (db instanceof Database) && ((Database) db).isMysqlCompatibleDatabase()) { diff --git a/fe/fe-core/src/main/java/org/apache/doris/analysis/DropTableStmt.java b/fe/fe-core/src/main/java/org/apache/doris/analysis/DropTableStmt.java index a8b091705e4..d2ff04186fb 100644 --- a/fe/fe-core/src/main/java/org/apache/doris/analysis/DropTableStmt.java +++ b/fe/fe-core/src/main/java/org/apache/doris/analysis/DropTableStmt.java @@ -21,6 +21,7 @@ import org.apache.doris.catalog.Env; import org.apache.doris.common.ErrorCode; import org.apache.doris.common.ErrorReport; import org.apache.doris.common.UserException; +import org.apache.doris.common.util.InternalDatabaseUtil; import org.apache.doris.common.util.Util; import org.apache.doris.mysql.privilege.PrivPredicate; import org.apache.doris.qe.ConnectContext; @@ -85,7 +86,7 @@ public class DropTableStmt extends DdlStmt { tableName.analyze(analyzer); // disallow external catalog Util.prohibitExternalCatalog(tableName.getCtl(), this.getClass().getSimpleName()); - + InternalDatabaseUtil.checkDatabase(tableName.getDb(), ConnectContext.get()); // check access if (!Env.getCurrentEnv().getAccessManager().checkTblPriv(ConnectContext.get(), tableName.getDb(), tableName.getTbl(), PrivPredicate.DROP)) { diff --git a/fe/fe-core/src/main/java/org/apache/doris/analysis/InsertOverwriteTableStmt.java b/fe/fe-core/src/main/java/org/apache/doris/analysis/InsertOverwriteTableStmt.java index a34c2cab0b9..17cca1cecc5 100644 --- a/fe/fe-core/src/main/java/org/apache/doris/analysis/InsertOverwriteTableStmt.java +++ b/fe/fe-core/src/main/java/org/apache/doris/analysis/InsertOverwriteTableStmt.java @@ -17,7 +17,13 @@ package org.apache.doris.analysis; +import org.apache.doris.catalog.Env; +import org.apache.doris.common.ErrorCode; +import org.apache.doris.common.ErrorReport; import org.apache.doris.common.UserException; +import org.apache.doris.common.util.InternalDatabaseUtil; +import org.apache.doris.mysql.privilege.PrivPredicate; +import org.apache.doris.qe.ConnectContext; import lombok.Getter; @@ -69,5 +75,13 @@ public class InsertOverwriteTableStmt extends DdlStmt { @Override public void analyze(Analyzer analyzer) throws UserException { + target.getTblName().analyze(analyzer); + InternalDatabaseUtil.checkDatabase(getDb(), ConnectContext.get()); + if (!Env.getCurrentEnv().getAccessManager() + .checkTblPriv(ConnectContext.get(), getDb(), getTbl(), PrivPredicate.LOAD)) { + ErrorReport.reportAnalysisException(ErrorCode.ERR_TABLEACCESS_DENIED_ERROR, "LOAD", + ConnectContext.get().getQualifiedUser(), ConnectContext.get().getRemoteIP(), + getDb() + ": " + getTbl()); + } } } diff --git a/fe/fe-core/src/main/java/org/apache/doris/analysis/TruncateTableStmt.java b/fe/fe-core/src/main/java/org/apache/doris/analysis/TruncateTableStmt.java index ea70a4893c1..b6f41ad409f 100644 --- a/fe/fe-core/src/main/java/org/apache/doris/analysis/TruncateTableStmt.java +++ b/fe/fe-core/src/main/java/org/apache/doris/analysis/TruncateTableStmt.java @@ -22,6 +22,7 @@ import org.apache.doris.common.AnalysisException; import org.apache.doris.common.ErrorCode; import org.apache.doris.common.ErrorReport; import org.apache.doris.common.UserException; +import org.apache.doris.common.util.InternalDatabaseUtil; import org.apache.doris.common.util.Util; import org.apache.doris.mysql.privilege.PrivPredicate; import org.apache.doris.qe.ConnectContext; @@ -49,7 +50,7 @@ public class TruncateTableStmt extends DdlStmt { if (tblRef.hasExplicitAlias()) { throw new AnalysisException("Not support truncate table with alias"); } - + InternalDatabaseUtil.checkDatabase(tblRef.getName().getDb(), ConnectContext.get()); // check access // it requires LOAD privilege, because we consider this operation as 'delete data', which is also a // 'load' operation. diff --git a/fe/fe-core/src/main/java/org/apache/doris/common/util/InternalDatabaseUtil.java b/fe/fe-core/src/main/java/org/apache/doris/common/util/InternalDatabaseUtil.java new file mode 100644 index 00000000000..7ca56fd08bc --- /dev/null +++ b/fe/fe-core/src/main/java/org/apache/doris/common/util/InternalDatabaseUtil.java @@ -0,0 +1,38 @@ +// Licensed to the Apache Software Foundation (ASF) under one +// or more contributor license agreements. See the NOTICE file +// distributed with this work for additional information +// regarding copyright ownership. The ASF licenses this file +// to you under the Apache License, Version 2.0 (the +// "License"); you may not use this file except in compliance +// with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package org.apache.doris.common.util; + +import org.apache.doris.cluster.ClusterNamespace; +import org.apache.doris.common.AnalysisException; +import org.apache.doris.common.FeConstants; +import org.apache.doris.qe.ConnectContext; + +import com.google.common.base.Preconditions; + +public class InternalDatabaseUtil { + + public static void checkDatabase(String dbName, ConnectContext ctx) throws AnalysisException { + Preconditions.checkNotNull(dbName, "require dbName object"); + if (!FeConstants.INTERNAL_DB_NAME.equals(ClusterNamespace.getNameFromFullName(dbName))) { + return; + } + if (ctx == null || ctx.getCurrentUserIdentity() == null || !ctx.getCurrentUserIdentity().isRootUser()) { + throw new AnalysisException("Not allowed to operate database: " + dbName); + } + } +} diff --git a/fe/fe-core/src/main/java/org/apache/doris/transaction/DatabaseTransactionMgr.java b/fe/fe-core/src/main/java/org/apache/doris/transaction/DatabaseTransactionMgr.java index 125335b382c..f21d7a21204 100644 --- a/fe/fe-core/src/main/java/org/apache/doris/transaction/DatabaseTransactionMgr.java +++ b/fe/fe-core/src/main/java/org/apache/doris/transaction/DatabaseTransactionMgr.java @@ -44,6 +44,7 @@ import org.apache.doris.common.Pair; import org.apache.doris.common.QuotaExceedException; import org.apache.doris.common.UserException; import org.apache.doris.common.util.DebugUtil; +import org.apache.doris.common.util.InternalDatabaseUtil; import org.apache.doris.common.util.MetaLockUtils; import org.apache.doris.common.util.TimeUtils; import org.apache.doris.metric.MetricRepo; @@ -313,6 +314,8 @@ public class DatabaseTransactionMgr { long listenerId, long timeoutSecond) throws DuplicatedRequestException, LabelAlreadyUsedException, BeginTransactionException, AnalysisException, QuotaExceedException, MetaNotFoundException { + Database db = env.getInternalCatalog().getDbOrMetaException(dbId); + InternalDatabaseUtil.checkDatabase(db.getFullName(), ConnectContext.get()); checkDatabaseDataQuota(); writeLock(); try { diff --git a/regression-test/suites/internal_schema_p0/operate_internal_schema.groovy b/regression-test/suites/internal_schema_p0/operate_internal_schema.groovy new file mode 100644 index 00000000000..658dec30b93 --- /dev/null +++ b/regression-test/suites/internal_schema_p0/operate_internal_schema.groovy @@ -0,0 +1,126 @@ +// Licensed to the Apache Software Foundation (ASF) under one +// or more contributor license agreements. See the NOTICE file +// distributed with this work for additional information +// regarding copyright ownership. The ASF licenses this file +// to you under the Apache License, Version 2.0 (the +// "License"); you may not use this file except in compliance +// with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +import org.junit.Assert; + +suite("operate_internal_schema") { + def testTable = "operate_internal_schema_tbl" + sql "use __internal_schema" + sql "DROP TABLE IF EXISTS ${testTable}" + //alter db + sql "ALTER DATABASE __internal_schema SET PROPERTIES('replication_allocation' = '');" + //create table + sql """ + CREATE TABLE IF NOT EXISTS ${testTable} + ( + `user_id` LARGEINT NOT NULL, + `age` SMALLINT + ) + UNIQUE KEY(`user_id`) + DISTRIBUTED BY HASH(`user_id`) BUCKETS 1 + PROPERTIES ( + "replication_allocation" = "tag.location.default: 1" + ); + """ + //alter table + sql "ALTER TABLE ${testTable} MODIFY COMMENT 'new_comment';" + //insert + sql "insert into ${testTable} values(1,2);" + //update + sql "update ${testTable} set age=2 where user_id=1;" + //delete + sql "delete from ${testTable} where user_id=1;" + // truncate + sql "truncate table ${testTable};" + // insert overwrite + sql "insert overwrite table ${testTable} values(1,3)" + + def user = 'operate_internal_schema_user' + def pwd = 'C123_567p' + try_sql("DROP USER ${user}") + sql """CREATE USER '${user}' IDENTIFIED BY '${pwd}'""" + sql """GRANT ADMIN_PRIV ON *.*.* TO ${user}""" + def tokens = context.config.jdbcUrl.split('/') + def url=tokens[0] + "//" + tokens[2] + "/" + "__internal_schema" + "?" + connect(user=user, password="${pwd}", url=url) { + sql "use __internal_schema;" + try { + //alter db + sql "ALTER DATABASE __internal_schema SET PROPERTIES('replication_allocation' = '');" + Assert.fail(); + } catch (Exception e) { + log.info(e.getMessage()) + } + + try { + //alter table + sql "ALTER TABLE ${testTable} MODIFY COMMENT 'new_comment';" + Assert.fail(); + } catch (Exception e) { + log.info(e.getMessage()) + } + + try { + //insert + sql "insert into ${testTable} values(1,2);" + Assert.fail(); + } catch (Exception e) { + log.info(e.getMessage()) + } + + try { + //update + sql "update ${testTable} set age=2 where user_id=1;" + Assert.fail(); + } catch (Exception e) { + log.info(e.getMessage()) + } + + try { + //delete + sql "delete from ${testTable} where user_id=1;" + Assert.fail(); + } catch (Exception e) { + log.info(e.getMessage()) + } + + try { + // truncate + sql "truncate table ${testTable};" + Assert.fail(); + } catch (Exception e) { + log.info(e.getMessage()) + } + + try { + // insert overwrite + sql "insert overwrite table ${testTable} values(1,3)" + Assert.fail(); + } catch (Exception e) { + log.info(e.getMessage()) + } + + try { + // drop table + sql "drop table ${testTable}" + Assert.fail(); + } catch (Exception e) { + log.info(e.getMessage()) + } + } + sql "drop table ${testTable}" +} --------------------------------------------------------------------- To unsubscribe, e-mail: commits-unsubscr...@doris.apache.org For additional commands, e-mail: commits-h...@doris.apache.org