[SERVER-34822] RoleGraph update should ignore index creation on non-role collections Created: 03/May/18  Updated: 29/Oct/23  Resolved: 30/May/18

Status: Closed
Project: Core Server
Component/s: Security
Affects Version/s: None
Fix Version/s: 3.6.6, 4.0.0-rc5, 4.1.1

Type: Bug Priority: Critical - P2
Reporter: Spencer Jackson Assignee: Spencer Jackson
Resolution: Fixed Votes: 0
Labels: bkp
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
Backports
Depends
Backwards Compatibility: Fully Compatible
Operating System: ALL
Backport Requested:
v4.0, v3.6
Sprint: Platforms 2018-06-04
Participants:
Case:

 Description   

Create a replicaset. Create a collection on the admin database. Create a role which inherits from other roles. Grant the role to a user. Create an index on the collection using the createIndex command. Connect to a secondary, and authenticate as the user. The user will have no privileges granted from transitively inherited roles. The secondary will include the following statement in its logs:

2018-05-03T14:21:50.795-0400 E ACCESS   [repl writer worker 1] Unsupported modification to roles collection in oplog; restart
this process to reenable user-defined roles; OplogOperationUnsupported: Unsupported oplog operation; Oplog entry: { op: "c", ns: "admin.$cmd", o: { createIndexes: "col", v: 2, key: { data: 1.0 }, name: "data_1" } }

The RoleGraph update procedure observes a command affecting the admin database which it doesn't understand. As a result, it disables role transitivity. It should be taught that createIndex on a collection other than system.roles is safe.



 Comments   
Comment by Githook User [ 18/Jun/18 ]

Author:

{'username': 'spencerjackson', 'name': 'Spencer Jackson', 'email': 'spencer.jackson@mongodb.com'}

Message: SERVER-34822: Make role graph ignore irrelevant createIndexes

(cherry picked from commit f0227671de94cd54a3d8e1653400aa1ee9d8b2fa)
Branch: v3.6
https://github.com/mongodb/mongo/commit/d82ca47151cdea0b1df326890913e2f0124a8d8d

Comment by Githook User [ 07/Jun/18 ]

Author:

{'username': 'spencerjackson', 'name': 'Spencer Jackson', 'email': 'spencer.jackson@mongodb.com'}

Message: SERVER-34822: Make role graph ignore irrelevant createIndexes

(cherry picked from commit f0227671de94cd54a3d8e1653400aa1ee9d8b2fa)
Branch: v4.0
https://github.com/mongodb/mongo/commit/5850207f6f15da2277305bf93a02a3b02c67a6cc

Comment by Githook User [ 30/May/18 ]

Author:

{'username': 'spencerjackson', 'name': 'Spencer Jackson', 'email': 'spencer.jackson@mongodb.com'}

Message: SERVER-34822: Make role graph ignore irrelevant createIndexes
Branch: master
https://github.com/mongodb/mongo/commit/f0227671de94cd54a3d8e1653400aa1ee9d8b2fa

Generated at Thu Feb 08 04:37:58 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.