[SERVER-3841] Profiling in admin DB can stick entries in other DBs (listDatabases command) Created: 14/Sep/11  Updated: 19/Mar/13  Resolved: 11/Mar/13

Status: Closed
Project: Core Server
Component/s: Admin, Security, Tools
Affects Version/s: 1.8.2
Fix Version/s: None

Type: Bug Priority: Major - P3
Reporter: Jared D. Cottrell Assignee: Spencer Brody (Inactive)
Resolution: Done Votes: 1
Labels: cloud, profiling, security
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified
Environment:

64-bit Mac OS X Lion


Issue Links:
Depends
depends on SERVER-2080 Connecting to an authenticated server... Closed
Operating System: OS X
Participants:

 Description   

Not quite sure how to accurately characterize the problem. But clearly with a DB that started in auth mode with no bowtiesarecool database it seems like a problem that without anyone with credentials mentioning the database it got created and populated with data.

Certainly related to SERVER-2080. It's not clear to me if fixing that is the only thing that needs to happen or if the profiling behavior is an issue in its own right.

% mongo localhost/admin -u *** -p ***
MongoDB shell version: 1.8.2
connecting to: localhost/admin
> show dbs
admin 5GB
local 5GB
> exit
bye
% mongo localhost/bowtiesarecool
MongoDB shell version: 1.8.2
connecting to: localhost/bowtiesarecool
> db.setProfilingLevel(2)

{ "assertion" : "unauthorized db:bowtiesarecool lock type:1 client:127.0.0.1", "assertionCode" : 10057, "errmsg" : "db assertion failure", "ok" : 0 } > exit bye % mongo localhost/admin -u *** -p *** MongoDB shell version: 1.8.2 connecting to: localhost/admin > show dbs admin 5GB bowtiesarecool (empty) local 5GB > db.setProfilingLevel(2) { "was" : 0, "slowms" : 100, "ok" : 1 }

> show dbs
admin 5GB
bowtiesarecool (empty)
local 5GB
> show dbs
admin 5GB
bowtiesarecool 5GB
local 5GB
> use bowtiesarecool
switched to db bowtiesarecool
> show collections
system.profile
> db.system.profile.find()
{ "ts" : ISODate("2011-09-14T01:37:04.458Z"), "info" : "query admin.$cmd ntoreturn:1 command:

{ listDatabases: 1.0 }

reslen:308 bytes:292", "millis" : 0 }
> exit
bye



 Comments   
Comment by Spencer Brody (Inactive) [ 11/Mar/13 ]

Reproduced in 1.8.5, but could not repro in 2.0.7, 2.2.3 or 2.4.0-RC2.

Comment by Tony Hannan [ 19/Sep/11 ]

This is probably a duplicate of SERVER-2080, at a minimum this depends on it.

Comment by Angela Shulman [ 17/Sep/11 ]

Following on to Jared's bug report above, we've been seeing the same databases come back again even after dropping them. And sometimes they can come back again with the following state:

MongoDB shell version: 1.8.2
connecting to: localhost:27107/admin
> use bowtiesarecool/
switched to db bowtiesarecool/
> show collections
Thu Sep 15 23:27:04 uncaught exception: error: {
"$err" : "invalid db name: bowtiesarecool/.system.namespaces",
"code" : 13280
}
> db.dropDatabase()
{
"assertion" : "invalid db name: bowtiesarecool/",
"assertionCode" : 13280,
"errmsg" : "db assertion failure",
"ok" : 0
}
>

Generated at Thu Feb 08 03:04:13 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.