[SERVER-10228] Deprecate GodScope/God Mode Created: 16/Jul/13 Updated: 06/Dec/22 |
|
| Status: | Backlog |
| Project: | Core Server |
| Component/s: | Internal Code |
| Affects Version/s: | None |
| Fix Version/s: | None |
| Type: | Improvement | Priority: | Major - P3 |
| Reporter: | Andy Schwerin | Assignee: | Backlog - Query Execution |
| Resolution: | Unresolved | Votes: | 0 |
| Labels: | neweng | ||
| Remaining Estimate: | Not Specified | ||
| Time Spent: | Not Specified | ||
| Original Estimate: | Not Specified | ||
| Issue Links: |
|
||||||||
| Assigned Teams: |
Query Execution
|
||||||||
| Participants: | |||||||||
| Description |
|
The existence of "God mode"complicates the mongod security story. Internal worker threads not acting directly on behalf of clients can use the following code to grant their client object full privileges.
The other uses are the main() thread during startup and the authorization session code for looking up and manipulating user documents as part of user management commands. The main thread can use internal authorization, so that just leaves the user management code. |
| Comments |
| Comment by Andy Schwerin [ 09/Mar/15 ] |
|
This task may be naturally subsumed by |
| Comment by Githook User [ 04/Aug/14 ] |
|
Author: {u'username': u'stbrody', u'name': u'Spencer T Brody', u'email': u'spencer@mongodb.com'}Message: SERVER-10228 |
| Comment by auto [ 19/Jul/13 ] |
|
Author: {u'username': u'andy10gen', u'name': u'Andy Schwerin', u'email': u'schwerin@10gen.com'}Message: SERVER-10228 Use internal user authorization instead of GodScope in index rebuilder thread. |
| Comment by auto [ 17/Jul/13 ] |
|
Author: {u'username': u'andy10gen', u'name': u'Andy Schwerin', u'email': u'schwerin@10gen.com'}Message: SERVER-10228 Use internal user authorization instead of GodScope in ttl thread. |
| Comment by auto [ 17/Jul/13 ] |
|
Author: {u'username': u'andy10gen', u'name': u'Andy Schwerin', u'email': u'schwerin@10gen.com'}Message: SERVER-10228 Use internal user authorization instead of GodScope in the slave tracking thread. |