Trafodion

Any user can cancel queries

Bug #1414231 reported by Roberta Marton
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Trafodion
Fix Released
High
Mike Hanlon
Trafodion r1.1

Bug Description

Support for cancelling queries has been added for release 1.0. However, with the current support, there is no privilege checking so anyone can cancel queries, even those that are not owned by the current user. This is a security gap.

Tags: sql-security
Roberta Marton (roberta-marton)
Changed in trafodion:
assignee: nobody → Cliff Gray (cliff-gray)
importance: Undecided → High
milestone: none → r1.1
tags: added: sql-security
Cliff Gray (cliff-gray)
Changed in trafodion:
status: New → In Progress
Revision history for this message
Cliff Gray (cliff-gray) wrote :

Assigning to Mike Hanlon to complete. Check for authority was added in change 1183, but left for Mike to integrate and test.

Changed in trafodion:
assignee: Cliff Gray (cliff-gray) → Mike Hanlon (mike-hanlon)
Revision history for this message
Trafodion-Gerrit (neo-devtools) wrote : Fix proposed to core (master)

Fix proposed to branch: master
Review: https://review.trafodion.org/1200

Revision history for this message
Trafodion-Gerrit (neo-devtools) wrote : Fix merged to core (master)

Reviewed: https://review.trafodion.org/1200
Committed: https://github.com/trafodion/core/commit/3337146b177d0449f07b2dbaf44935b34e781781
Submitter: Trafodion Jenkins
Branch: master

commit 3337146b177d0449f07b2dbaf44935b34e781781
Author: Mike Hanlon <email address hidden>
Date: Fri Feb 27 21:40:22 2015 +0000

    Query cancel privilege checking

    This change integrates the ControlRunningQuery::isUserAuthorized
    method (change 1183) to work with ControlRunningQuery::bindNode.
    It also adds new test cases to regress/catman1/TEST131.

    Change-Id: I0c6c2357b7ff928863d8511702fdf6e9e2411411
    Closes-Bug: #1414231

Changed in trafodion:
status: In Progress → Fix Committed
Revision history for this message
Paul Low (paul-low-x) wrote :

Verified on daily build 20150311.
One particular situation still fails and a separate case has been opened to track that issue:
Bug #1431531 Non-DB__ROOT has no privilege to cancel own query

Changed in trafodion:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.