[
https://issues.apache.org/jira/browse/IGNITE-22844?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17872367#comment-17872367
]
Mikhail Petrov commented on IGNITE-22844:
-----------------------------------------
[~mmdavydov] Thank you for the contribution.
> control.sh --consistency repair permissions fixes
> -------------------------------------------------
>
> Key: IGNITE-22844
> URL: https://issues.apache.org/jira/browse/IGNITE-22844
> Project: Ignite
> Issue Type: Improvement
> Reporter: Maksim Davydov
> Assignee: Maksim Davydov
> Priority: Minor
> Labels: ise
> Fix For: 2.17
>
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> Currently 'Read Repair' task performed for the chosen partitions by
> control.sh requires CACHE_READ and CACHE PUT permissions in addition to
> ADMIN_OPS. Thus, to perform the comand `control.sh --consistency repair` the
> one needs all 3 permissions.
> There is no point to have additional CACHE_READ and CACHE_PUT permissions to
> perform the operation, as they are useless for the task itself, and
> introduces security risk, by allowing the user to manipulate the cache in
> parallel.
> The solution would be to substitute user's security context with the context
> of the cluster node that performs the command. The former is used for the
> ADMIN_OPS permission check and the latter is used for cache. This will ease
> the requirement for the users to perform `control.sh --consistency repair`
> without introducing any additional security risk.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
