tarantool / tarantool / 19956884290

88%

Build Type

push

github

Committed by locker

Commit Message

box: introduce "grant" and "metagrant" privileges

The `PRIV_GRANT` (along with `PRIV_REVOKE`) had been introduced for a
single reason: for pretty-printing the access denial error message.
Let's make it a working privilege and introduce a new one allowing
to grant it.

The new "grant" privilege can only be granted on the "universe". It
allows to grant any privilege, except for the "grant" itself and new
"metagrant", on any object, entity or the "universe", to a visible
user. The privilege does not allow granting oneself though, only
granting to other users (this makes it granular: a user that's only
able to grant can't make oneself able to do other things).

The new "metagrant" privilege allows to grant "grant" and "metagrant"
privileges to available users. It can only be granted to "universe"
too and does not allow granting oneself either.

Dropped grantor checks from the `priv_def_check`: now any grantor may
be specified by the user calling the `box.schema.[user|role].grant`
function if he has rights to grant.

Since granting a privilege to an object requires the ability to see
it, introduced corresponding checks in all sysview spaces so that if
an object is grantable, it's visible. Except for the `_priv` space:
even if one has the "grant" privilege on the "universe", it can't see
grants of other users, only the grants created by oneself.

Dropped the `PRIV_REVOKE` constant by the way, as `PRIV_GRANT` does
cover the privilege revoke too.

Closes #11528

@TarantoolBot document
Title: Introduce the "grant" and "metagrant" privileges
Since: 3.5.1

The new privileges are only grantable on the "universe".

Root document: https://www.tarantool.io/en/doc/latest/admin/access_control/#privileges

* The `grant` permission granted to the "universe" allows a user to
  grant all permissions, except "grant" and "metagrant", to an object,
  object class or the "universe" to available users (granting oneself
  is not allowed by the permission though).
* The `metagr... (continued)

Run Details

70223 of 118177 branches covered (59.42%)

27 of 27 new or added lines in 2 files covered. (100.0%)

60 existing lines in 12 files now uncovered.

105503 of 120387 relevant lines covered (87.64%)

1361616.05 hits per line