[SERVER-47187] Add startup warning when SeIncreaseWorkingSetPrivilege not present Created: 30/Mar/20  Updated: 29/Oct/23  Resolved: 13/Apr/20

Status: Closed
Project: Core Server
Component/s: None
Affects Version/s: 4.2.5, 4.0.17
Fix Version/s: 4.0.19, 4.2.8, 4.4.0-rc5, 4.7.0

Type: Improvement Priority: Major - P3
Reporter: John Murphy Assignee: Mark Benvenuto
Resolution: Fixed Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
Backports
Depends
Backwards Compatibility: Fully Compatible
Backport Requested:
v4.4, v4.2, v4.0
Sprint: Security 2020-04-20
Participants:
Case:

 Description   

SERVER-23705 added code to enable the SeIncreaseWorkingSetPrivilege privilege for the mongod process on Windows.

If the server is running a locked down configuration, mongod is denied the privilege grant and the following warning is logged to stdout only during startup:

2020-03-26T16:03:35.664+1100 W -        [main] Failed to adjust token privilege for privilege 'SeIncreaseWorkingSetPrivilege'

The log message can be easily missed, and if encryption at rest is in use the following fassert() can be easily hit after 10's of databases are loaded:

2020-03-18T07:32:00.387+0800 F -        [conn301] Failed to SetProcessWorkingSetSizeEx: A required privilege is not held by the client.
2020-03-18T07:32:00.387+0800 F -        [conn301] Fatal Assertion 40286 at src\mongo\base\secure_allocator.cpp 154

It would be good to log a startup warning that the required privilege is not available for use, so that the Windows system configuration can be corrected.



 Comments   
Comment by Githook User [ 21/May/20 ]

Author:

{'name': 'Mark Benvenuto', 'email': 'mark.benvenuto@mongodb.com', 'username': 'markbenvenuto'}

Message: SERVER-47187 Add startup warning when SeIncreaseWorkingSetPrivilege not present

(cherry picked from commit 905011e695e1886d9fb733f71975a3affe5f4f85)
Branch: v4.2
https://github.com/mongodb/mongo/commit/d1b4a92c123cae7b61834361dcf84d5bc25dc9a7

Comment by Githook User [ 20/May/20 ]

Author:

{'name': 'Mark Benvenuto', 'email': 'mark.benvenuto@mongodb.com', 'username': 'markbenvenuto'}

Message: SERVER-47187 Add startup warning when SeIncreaseWorkingSetPrivilege not present

(cherry picked from commit 905011e695e1886d9fb733f71975a3affe5f4f85)
Branch: v4.0
https://github.com/mongodb/mongo/commit/7fa3780e18128492680cb4d693f99479a5061a41

Comment by Githook User [ 08/May/20 ]

Author:

{'name': 'Mark Benvenuto', 'email': 'mark.benvenuto@mongodb.com', 'username': 'markbenvenuto'}

Message: SERVER-47187 Add startup warning when SeIncreaseWorkingSetPrivilege not present

(cherry picked from commit 905011e695e1886d9fb733f71975a3affe5f4f85)
Branch: v4.4
https://github.com/mongodb/mongo/commit/104f59d61c0f314769a41671c9f68094810831e2

Comment by Githook User [ 10/Apr/20 ]

Author:

{'name': 'Mark Benvenuto', 'email': 'mark.benvenuto@mongodb.com', 'username': 'markbenvenuto'}

Message: SERVER-47187 Add startup warning when SeIncreaseWorkingSetPrivilege not present
Branch: master
https://github.com/mongodb/mongo/commit/905011e695e1886d9fb733f71975a3affe5f4f85

Generated at Thu Feb 08 05:13:31 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.