Merge lp:~clint-fewbar/drizzle/authorize-default-deny into lp:drizzle/7.0

[Clint Byrum]

This adds the command line:

--authorize-default-deny

This changes the kernel behavior for authorization plugin resolution from defaulting to accept, requiring a plugin to restrict access, to defaulting to deny, and requiring just one plugin to not-restrict access.

It does not change the behavior of the pruneSchema portion, because that one is already additive, and it doesn't make much sense to change that to subtractive.

[Monty Taylor (mordred)]

looks great.

review: Approve

[Olaf van der Spek (olafvdspek)]

Wouldn't it be better to always default to deny and have a plugin that can be used to always allow?

[Brian Aker (brianaker)]

Olaf brings up a good question. Right now we assume "no plugins, all access is fine".

If even a single plugin is installed, shouldn't we assume no?

[Olaf van der Spek (olafvdspek)]

> If even a single plugin is installed, shouldn't we assume no?

I'd default to deny and require the user to load a plugin.

[Brian Aker (brianaker)]

One of the original goals was to allow people who don't use any authentication what so ever to have a zero cost auth if they don't use it.

I suspect what a distribution would do is install a default plugin, maybe one for instance which just does localhost and limits a user based on their login information (ie grab the username and then use that as the credentials).

[Olaf van der Spek (olafvdspek)]

> One of the original goals was to allow people who don't use any authentication
> what so ever to have a zero cost auth if they don't use it.

An "Always Allow" plugin has minimal overhead and allows for a safe default.

> I suspect what a distribution would do is install a default plugin, maybe one
> for instance which just does localhost and limits a user based on their login
> information (ie grab the username and then use that as the credentials).

Is such a plugin available yet?

[Clint Byrum (clint-fewbar)]

On Thu, 2011-02-24 at 08:59 +0000, Olaf van der Spek wrote:
> > One of the original goals was to allow people who don't use any authentication
> > what so ever to have a zero cost auth if they don't use it.
>
> An "Always Allow" plugin has minimal overhead and allows for a safe default.

Essentially this exists by making the default allow. Those concerned
with harsher controls can use --authorize-default-deny and configure
their authorization plugin accordingly.

>
> > I suspect what a distribution would do is install a default plugin, maybe one
> > for instance which just does localhost and limits a user based on their login
> > information (ie grab the username and then use that as the credentials).
>

I am doing this work specifically for the packaging in Ubuntu and
Debian. The simple_user_policy with auth_file is good enough for most
apps, but there is a need for a backup-everything user.... rather than
rely on the literal "root" and all the privilege it brings.. it makes
sense to have another set of rules defined elsewhere...

> Is such a plugin available yet?

I'm writing a regex based plugin that just does simple user to
table/schema/process mapping to either ACCEPT or DENY

The idea is that one can have the simple user policy and the regex based
policy, and this flag allows you to control how they work together.

[Olaf van der Spek (olafvdspek)]

> On Thu, 2011-02-24 at 08:59 +0000, Olaf van der Spek wrote:
> > > One of the original goals was to allow people who don't use any
> authentication
> > > what so ever to have a zero cost auth if they don't use it.
> >
> > An "Always Allow" plugin has minimal overhead and allows for a safe default.
>
> Essentially this exists by making the default allow. Those concerned

No, a safe default would be deny.
What happens if you load an auth plugin and don't use --authorize-default-deny?

> I am doing this work specifically for the packaging in Ubuntu and
> Debian. The simple_user_policy with auth_file is good enough for most
> apps, but there is a need for a backup-everything user.... rather than
> rely on the literal "root" and all the privilege it brings.. it makes
> sense to have another set of rules defined elsewhere...

What does simple_user_policy do?

Olaf

[Brian Aker (brianaker)]

How about using the PAM module for distributions?

[Brian Aker (brianaker)]

BTW I am looking into this.

[Olaf van der Spek (olafvdspek)]

> How about using the PAM module for distributions?

I think peercred is the best method for local(host) connections.

http://kb.askmonty.org/v/socket_peercred-authentication-plugin

[Andrew Hutchings (linuxjedi)]

Olaf: we only use socket file for backwards compatibility with some MySQL clients, it probably wouldn't work with drizzle clients which use 127.0.0.1 for localhost.

[Clint Byrum (clint-fewbar)]

I keep wondering about that too.

The key is not to rely on the system default. Since Drizzle has no
encryption capabilities in the protocol, we need to make sure that users
who login via ssh aren't also encouraged to expose their password via
drizzle.

Also PAM isn't available on all supported platforms.

On Sat, 2011-02-26 at 22:28 +0000, Brian Aker wrote:
> How about using the PAM module for distributions?

[Olaf van der Spek (olafvdspek)]

Why does Drizzle not support UDS?

[Brian Aker (brianaker)]

Olaf: Drizzle supports UDS.

I'm going to write up a short blurb to the list tonight which explains a couple of things about the trunk and see where people want to go. I think we have it adjusted now to the point where it will be a bit better for folks.

Unmerged revisions

2179. By Clint Byrum on 2011-02-22

merging trunk

2178. By Clint Byrum on 2011-02-22

add an option to make authorize plugin system default to deny instead of accept

=== modified file 'drizzled/drizzled.cc'
--- drizzled/drizzled.cc	2011-02-22 06:09:35 +0000
+++ drizzled/drizzled.cc	2011-02-22 22:32:07 +0000
@@ -1148,6 +1148,8 @@
   ;
 
   long_options.add_options()
+  ("authorize-default-deny", po::value<bool>(&global_system_variables.authorize_default_deny)->default_value(false)->zero_tokens(),
+  _("Force authorization system to default to deny."))
   ("auto-increment-increment", po::value<uint64_t>(&global_system_variables.auto_increment_increment)->default_value(1)->notifier(&check_limits_aii),
   _("Auto-increment columns are incremented by this"))
   ("auto-increment-offset", po::value<uint64_t>(&global_system_variables.auto_increment_offset)->default_value(1)->notifier(&check_limits_aio),

=== modified file 'drizzled/plugin/authorization.cc'
--- drizzled/plugin/authorization.cc	2011-02-17 00:14:13 +0000
+++ drizzled/plugin/authorization.cc	2011-02-22 22:32:07 +0000
@@ -71,7 +71,7 @@
 
   inline result_type operator()(argument_type auth)
   {
-    return auth->restrictSchema(user_ctx, schema);
+    return auth->restrictSchema(user_ctx, schema) ^ global_system_variables.authorize_default_deny;
   }
 };
 
@@ -90,7 +90,7 @@
 
   inline result_type operator()(argument_type auth)
   {
-    return auth->restrictTable(user_ctx, table);
+    return auth->restrictTable(user_ctx, table) ^ global_system_variables.authorize_default_deny;
   }
 };
 
@@ -109,7 +109,7 @@
 
   inline result_type operator()(argument_type auth)
   {
-    return auth->restrictProcess(user_ctx, session_ctx);
+    return auth->restrictProcess(user_ctx, session_ctx) ^ global_system_variables.authorize_default_deny;
   }
 };
 
@@ -151,7 +151,7 @@
    * false, which means that that each of them believe the user is authorized
    * to view the resource in question.
    */
-  if (iter != authorization_plugins.end())
+  if ((iter != authorization_plugins.end()) ^ global_system_variables.authorize_default_deny)
   {
     if (send_error)
     {
@@ -181,7 +181,7 @@
    * false, which means that that each of them believe the user is authorized
    * to view the resource in question.
    */
-  if (iter != authorization_plugins.end())
+  if ((iter != authorization_plugins.end()) ^ global_system_variables.authorize_default_deny)
   {
     if (send_error)
     {
@@ -217,7 +217,7 @@
    * to view the resource in question.
    */
 
-  if (iter != authorization_plugins.end())
+  if ((iter != authorization_plugins.end()) ^ global_system_variables.authorize_default_deny)
   {
     if (send_error)
     {

=== modified file 'drizzled/sys_var.cc'
--- drizzled/sys_var.cc	2011-02-15 20:03:56 +0000
+++ drizzled/sys_var.cc	2011-02-22 22:32:07 +0000
@@ -129,6 +129,9 @@
   The variables are linked into the list. A variable is added to
   it in the constructor (see sys_var class for details).
 */
+static sys_var_session_bool
+sys_authorize_default_deny("authorize_default_deny",
+                             &drizzle_system_variables::authorize_default_deny);
 static sys_var_session_uint64_t
 sys_auto_increment_increment("auto_increment_increment",
                              &drizzle_system_variables::auto_increment_increment);
@@ -1492,6 +1495,7 @@
 {
   try
   {
+    add_sys_var_to_list(&sys_authorize_default_deny, my_long_options);
     add_sys_var_to_list(&sys_auto_increment_increment, my_long_options);
     add_sys_var_to_list(&sys_auto_increment_offset, my_long_options);
     add_sys_var_to_list(&sys_autocommit, my_long_options);

=== modified file 'drizzled/system_variables.h'
--- drizzled/system_variables.h	2011-02-12 10:06:03 +0000
+++ drizzled/system_variables.h	2011-02-22 22:32:07 +0000
@@ -77,6 +77,7 @@
   uint32_t query_prealloc_size;
   uint64_t group_concat_max_len;
   uint64_t pseudo_thread_id;
+  bool authorize_default_deny;
 
   plugin::StorageEngine *storage_engine;