Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-11526

GrantPrivilegesToRole and RemovePrivilegesFromRole audit record shows *all* privileges not *granted* privileges

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Major - P3
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: 2.5.4
    • Component/s: None
    • Labels:
    • Operating System:
      ALL

      Description

      The audit record lists all the privileges the role has, not just the granted ones.

      Here's BSON format

                  {u'remote': {u'ip': u'127.0.0.1', u'port': 44284}, u'users': [{u'userSource': u'admin', u'user': u'admin'}], u'atype': u'grantPrivilegesToRole', u'ts': datetime.datetime(2013, 11, 1, 16, 51, 51, 37000, tzinfo=<bson.tz_util.FixedOffset object at 0x238da50>), u'param': {u'db': u'roledb34', u'privileges': [{u'resource': {u'db': u'roledb34', u'collection': u'thrip'}, u'actions': [u'createRole', u'createUser', u'dropUser']}, {u'resource': {u'db': u'admin', u'collection': u''}, u'actions': [u'collStats', u'dbHash', u'dbStats', u'find', u'killCursors']}, {u'resource': {u'db': u'admin', u'collection': u'system.indexes'}, u'actions': [u'collStats', u'dbHash', u'dbStats', u'find', u'killCursors']}, {u'resource': {u'db': u'admin', u'collection': u'system.js'}, u'actions': [u'collStats', u'dbHash', u'dbStats', u'find', u'killCursors']}, {u'resource': {u'db': u'admin', u'collection': u'system.namespaces'}, u'actions': [u'collStats', u'dbHash', u'dbStats', u'find', u'killCursors']}], u'role': u'role36'}, u'result': 0, u'local': {u'ip': u'127.0.0.1', u'port': 27017}}

      Here's text format.

                  2013-11-01T12:58:02.636-0400 admin@admin 127.0.0.1:44302/127.0.0.1:27017 Granted to role role72@roledb70 the privileges: { resource: { db: "roledb70", collection: "thrip" }, actions: [ "createRole", "createUser", "dropUser" ] }, { resource: { db: "admin", collection: "" }, actions: [ "collStats", "dbHash", "dbStats", "find", "killCursors" ] }, { resource: { db: "admin", collection: "system.indexes" }, actions: [ "collStats", "dbHash", "dbStats", "find", "killCursors" ] }, { resource: { db: "admin", collection: "system.js" }, actions: [ "collStats", "dbHash", "dbStats", "find", "killCursors" ] }, { resource: { db: "admin", collection: "system.namespaces" }, actions: [ "collStats", "dbHash", "dbStats", "find", "killCursors" ] }.
       

      RemovePrivileges has the same problem. That's even worse — it lists as removed all the aspects of the role EXCEPT those which were removed.

        Attachments

          Activity

            People

            • Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: