Re: [Firebird-devel] WITH CALLER PRIVILEGES propagation
Thanks Vlad. Now it makes sense. -- Mgr. Jiří Činčura https://www.tabsoverspaces.com/ Firebird-Devel mailing list, web interface at https://lists.sourceforge.net/lists/listinfo/firebird-devel
Re: [Firebird-devel] WITH CALLER PRIVILEGES propagation
21.04.2022 13:38, Jiří Činčura wrote: Hi, Can propagate the privileges down into the call stack when using WITH CALLER PRIVILEGES? For example: CREATE TABLE T_TEST (ID INTEGER NOT NULL, CONSTRAINT PK_TEST PRIMARY KEY (ID)); /* Package header: PKG_TEST, Owner: SYSDBA */ CREATE PACKAGE PKG_TEST AS begin procedure test returns (i int); end^ /* Package header: PKG_TEST_LIMITED, Owner: SYSDBA */ CREATE PACKAGE PKG_TEST_LIMITED AS begin procedure test returns (i int); end^ /* Package body: PKG_TEST, Owner: SYSDBA */ CREATE PACKAGE BODY PKG_TEST AS begin procedure test returns (i int) as begin for select id from t_test into :i do begin suspend; end end end^ /* Package body: PKG_TEST_LIMITED, Owner: SYSDBA */ CREATE PACKAGE BODY PKG_TEST_LIMITED AS begin procedure test returns (i int) as begin for execute statement 'select i from pkg_test.test' with caller privileges into :i do begin suspend; end end end^ /* Grant permissions for this database */ GRANT SELECT ON T_TEST TO PACKAGE PKG_TEST_LIMITED; GRANT EXECUTE ON PACKAGE PKG_TEST_LIMITED TO USER LIMITED; Now if I do, under LIMITED user, `select * from pkg_test_limited.test;` is will end up with `no permission for SELECT access to TABLE T_TEST`. Here user LIMITED executes PKG_TEST_LIMITED.TEST (which it have explicit grant to do, see 2nd GRANT statement) and than going to execute procedure from package PKG_TEST which nor user LIMITED nor package PKG_TEST_LIMITED is not granted to do. Error message is misleading here, btw. If you GRANT SELECT ON T_TEST TO PACKAGE PKG_TEST and run select * from pkg_test_limited.test then you'll see more correct error: no permission for EXECUTE access to PACKAGE PKG_TEST Then add missing GRANT EXECUTE ON PACKAGE PKG_TEST TO PACKAGE PKG_TEST_LIMITED and query will run successfully. But if I change the execute statement into `for execute statement 'select id t_test' with caller privileges into :i do` everything is fine. Sure, because package PKG_TEST_LIMITED granted to do it (your 1st GRANS statement) and caller privileges is effective. I guess the "caller privileges" is propagated only into `pkg_test_limited.test` when calling, but not further into `t_test`. > > Can I somewhat make it work/propagate? Or did I misunderstood the feature? Hope it is clear now. Regards, Vlad Firebird-Devel mailing list, web interface at https://lists.sourceforge.net/lists/listinfo/firebird-devel
Re: [Firebird-devel] WITH CALLER PRIVILEGES propagation
My script uses packages (and I grant to package). That's not going to fly on 2.5. :( -- Mgr. Jiří Činčura https://www.tabsoverspaces.com/ On Fri, Apr 22, 2022, at 17:23, Alex Peshkoff via Firebird-devel wrote: > On 22.04.2022 18:07, Jiří Činčura wrote: >> Yes. Fails. >> >> Do you want me to create script for testing? >> > > Can you please check your script on some old version? Like 2.5. > > May be I miss something. > > > > Firebird-Devel mailing list, web interface at > https://lists.sourceforge.net/lists/listinfo/firebird-devel Firebird-Devel mailing list, web interface at https://lists.sourceforge.net/lists/listinfo/firebird-devel
Re: [Firebird-devel] WITH CALLER PRIVILEGES propagation
On 22.04.2022 18:07, Jiří Činčura wrote: Yes. Fails. Do you want me to create script for testing? Can you please check your script on some old version? Like 2.5. May be I miss something. Firebird-Devel mailing list, web interface at https://lists.sourceforge.net/lists/listinfo/firebird-devel
Re: [Firebird-devel] WITH CALLER PRIVILEGES propagation
Yes. Fails. Do you want me to create script for testing? -- Mgr. Jiří Činčura https://www.tabsoverspaces.com/ On Fri, Apr 22, 2022, at 10:19, Alex Peshkoff via Firebird-devel wrote: > On 22.04.2022 08:20, Jiří Činčura wrote: >> Without it, it obviously fail. Because the "limited" user does not have >> permissions. That's what I'm trying go around thru the permissions of >> calling object. >> > > Fails w/o execute statement ? Just using select from procedure instead? > Very strange - this always worked with caller privileges. > > > > > Firebird-Devel mailing list, web interface at > https://lists.sourceforge.net/lists/listinfo/firebird-devel Firebird-Devel mailing list, web interface at https://lists.sourceforge.net/lists/listinfo/firebird-devel
Re: [Firebird-devel] WITH CALLER PRIVILEGES propagation
On 22.04.2022 08:20, Jiří Činčura wrote: Without it, it obviously fail. Because the "limited" user does not have permissions. That's what I'm trying go around thru the permissions of calling object. Fails w/o execute statement ? Just using select from procedure instead? Very strange - this always worked with caller privileges. Firebird-Devel mailing list, web interface at https://lists.sourceforge.net/lists/listinfo/firebird-devel
Re: [Firebird-devel] WITH CALLER PRIVILEGES propagation
Without it, it obviously fail. Because the "limited" user does not have permissions. That's what I'm trying go around thru the permissions of calling object. -- Mgr. Jiří Činčura https://www.tabsoverspaces.com/ On Thu, Apr 21, 2022, at 14:57, Alex Peshkoff via Firebird-devel wrote: > On 21.04.2022 13:38, Jiří Činčura wrote: > >> I guess the "caller privileges" is propagated only into >> `pkg_test_limited.test` when calling, but not further into `t_test`. Can I >> somewhat make it work/propagate? Or did I misunderstood the feature? >> > > "with caller privileges" was designed to make privileges, granted to > calling object, be used when processing dynamic SQL statement. SO first > of all I suggest to perform all this chain of calls w/o execute > statement and see does it make any difference. > > > > > Firebird-Devel mailing list, web interface at > https://lists.sourceforge.net/lists/listinfo/firebird-devel Firebird-Devel mailing list, web interface at https://lists.sourceforge.net/lists/listinfo/firebird-devel
Re: [Firebird-devel] WITH CALLER PRIVILEGES propagation
On 21.04.2022 13:38, Jiří Činčura wrote: I guess the "caller privileges" is propagated only into `pkg_test_limited.test` when calling, but not further into `t_test`. Can I somewhat make it work/propagate? Or did I misunderstood the feature? "with caller privileges" was designed to make privileges, granted to calling object, be used when processing dynamic SQL statement. SO first of all I suggest to perform all this chain of calls w/o execute statement and see does it make any difference. Firebird-Devel mailing list, web interface at https://lists.sourceforge.net/lists/listinfo/firebird-devel
[Firebird-devel] WITH CALLER PRIVILEGES propagation
Hi, Can propagate the privileges down into the call stack when using WITH CALLER PRIVILEGES? For example: CREATE TABLE T_TEST (ID INTEGER NOT NULL, CONSTRAINT PK_TEST PRIMARY KEY (ID)); /* Package header: PKG_TEST, Owner: SYSDBA */ CREATE PACKAGE PKG_TEST AS begin procedure test returns (i int); end^ /* Package header: PKG_TEST_LIMITED, Owner: SYSDBA */ CREATE PACKAGE PKG_TEST_LIMITED AS begin procedure test returns (i int); end^ /* Package body: PKG_TEST, Owner: SYSDBA */ CREATE PACKAGE BODY PKG_TEST AS begin procedure test returns (i int) as begin for select id from t_test into :i do begin suspend; end end end^ /* Package body: PKG_TEST_LIMITED, Owner: SYSDBA */ CREATE PACKAGE BODY PKG_TEST_LIMITED AS begin procedure test returns (i int) as begin for execute statement 'select i from pkg_test.test' with caller privileges into :i do begin suspend; end end end^ /* Grant permissions for this database */ GRANT SELECT ON T_TEST TO PACKAGE PKG_TEST_LIMITED; GRANT EXECUTE ON PACKAGE PKG_TEST_LIMITED TO USER LIMITED; Now if I do, under LIMITED user, `select * from pkg_test_limited.test;` is will end up with `no permission for SELECT access to TABLE T_TEST`. But if I change the execute statement into `for execute statement 'select id t_test' with caller privileges into :i do` everything is fine. I guess the "caller privileges" is propagated only into `pkg_test_limited.test` when calling, but not further into `t_test`. Can I somewhat make it work/propagate? Or did I misunderstood the feature? -- Mgr. Jiří Činčura https://www.tabsoverspaces.com/ Firebird-Devel mailing list, web interface at https://lists.sourceforge.net/lists/listinfo/firebird-devel
