config: allow to grant access to specific functions using `lua_call` #10304

Totktonada · 2024-07-24T09:35:03Z

The declarative configuration allows to grant access to all global Lua functions (except built-in ones).

credentials:
  users:
    alice:
      privileges:
        - permissions: [execute]
          lua_call: [all]

An excerpt from the instance config schema

tarantool/src/box/lua/config/instance_config.lua

Lines 1572 to 1576 in c68e8a8

    
           lua_call = schema.array({ 
        
               items = schema.scalar({ 
        
                   type = 'string', 
        
                   allowed_values = {'all'}, 
        
               }),

It is a rough equivalent of the following box.schema.{user,role}.grant() call:

box.schema.user.create('alice')
box.schema.user.grant('alice', 'execute', 'lua_call')

box.schema.{user,role}.grant() allows to grant access to a particular global Lua function using lua_call since the 3.0.0 release (see #9360):

box.schema.user.create('alice')
box.schema.user.grant('alice', 'execute', 'lua_call', 'my_func')

We should support it in the declarative configuration too.

An example of such configuration:

credentials:
  users:
    alice:
      privileges:
        - permissions: [execute]
          lua_call: [my_func]

Part of TNTP-201.

The text was updated successfully, but these errors were encountered:

This patch adds the capability to grant access to specific Lua functions in the declarative configuration. You can now grant access by assigning the function name to `credentials.users.<user>.privileges.lua_call`. For example, setting `credentials.users.alice.privileges.lua_call = ['foo']` allows user 'alice' to execute the `foo` function. Closes tarantool#10304 NO_DOC=yet

@TarantoolBot

This patch adds the capability to grant access to specific Lua functions in the declarative configuration. You can now grant access by assigning the function name to `credentials.users.<user>.privileges.lua_call`. For example, setting `credentials.users.alice.privileges.lua_call = ['foo']` allows user 'alice' to execute the `foo` function. Closes tarantool#10304 @TarantoolBot document Title: Grant access to specific functions using lua_call Root document: https://www.tarantool.io/ru/doc/latest/book/admin/access_control object-types: - `lua_call`: A list of permitted global user-defined Lua functions that can be called. object-types-and-permissions: - `lua_call`: `execute` This field specifies a list of allowed global user-defined Lua functions that can be executed using the IPROTO_CALL request. This permission doesn’t allow a user to call built-in Lua functions (for example, `loadstring()` or `box.session.su()`) and functions defined in the `_func` system space.

@TarantoolBot

This patch adds the capability to grant access to specific Lua functions in the declarative configuration. You can now grant access by assigning the function name to `credentials.users.<user>.privileges.lua_call`. For example, setting `credentials.users.alice.privileges.lua_call = ['foo']` allows user 'alice' to execute the `foo` function. Closes tarantool#10304 @TarantoolBot document Title: Grant access to specific functions using lua_call Root document: https://www.tarantool.io/en/doc/latest/book/admin/access_control object-types: - `lua_call`: A list of permitted global user-defined Lua functions that can be called. object-types-and-permissions: - `lua_call`: `execute` This field specifies a list of allowed global user-defined Lua functions that can be executed using the IPROTO_CALL request. This permission doesn’t allow a user to call built-in Lua functions (for example, `loadstring()` or `box.session.su()`) and functions defined in the `_func` system space.

@TarantoolBot

This patch adds the capability to grant access to specific Lua functions in the declarative configuration. You can now grant access by assigning the function name to `credentials.users.<user>.privileges.lua_call`. For example, setting `credentials.users.alice.privileges.lua_call = ['foo']` allows user 'alice' to execute the `foo` function. Closes tarantool#10304 @TarantoolBot document Title: Grant access to specific functions using lua_call Root document: https://www.tarantool.io/en/doc/latest/book/admin/access_control object-types: - `lua_call`: A list of permitted global user-defined Lua functions that can be called. object-types-and-permissions: - `lua_call`: `execute` This field specifies a list of allowed global user-defined Lua functions that can be executed using the IPROTO_CALL request. This permission doesn’t allow a user to call built-in Lua functions (for example, `loadstring()` or `box.session.su()`) and functions defined in the `_func` system space.

@TarantoolBot

This patch adds the capability to grant access to specific Lua functions in the declarative configuration. You can now grant access by assigning the function name to `credentials.users.<user>.privileges.lua_call`. For example, setting `credentials.users.alice.privileges.lua_call = ['foo']` allows user 'alice' to execute the `foo` function. Closes tarantool#10304 @TarantoolBot document Title: Grant access to specific functions using lua_call Root document: https://www.tarantool.io/en/doc/latest/book/admin/access_control object-types: - `lua_call`: A list of permitted global user-defined Lua functions that can be called. object-types-and-permissions: - `lua_call`: `execute` This field specifies a list of allowed global user-defined Lua functions that can be executed using the IPROTO_CALL request. This permission doesn’t allow a user to call built-in Lua functions (for example, `loadstring()` or `box.session.su()`) and functions defined in the `_func` system space.

This patch adds the capability to grant access to specific Lua functions in the declarative configuration. You can now grant access by assigning the function name to `credentials.users.<user>.privileges.lua_call`. For example, setting `credentials.users.alice.privileges.lua_call = ['foo']` allows user 'alice' to execute the `foo` function. Closes tarantool#10304

@TarantoolBot

This patch adds the capability to grant access to specific Lua functions in the declarative configuration. You can now grant access by assigning the function name to `credentials.users.<user>.privileges.lua_call`. Closes tarantool#10304 @TarantoolBot document Title: Document lua_call feature Root document: https://www.tarantool.io/en/doc/latest/reference/configuration/configuration_reference/ `<user_or_role_name>.privileges.lua_call`: Defines the Lua functions that the specified user or a user with the specified role has permission to call. This field accepts a special value, `all`, which grants the privilege to use any global non-built-in Lua functions. For example, setting `credentials.users.alice.privileges.lua_call = ['foo']` allows the user alice to execute the foo function.

@TarantoolBot

This patch adds the capability to grant access to specific Lua functions in the declarative configuration. You can now grant access by assigning the function name to `credentials.users.<user>.privileges.lua_call`. Closes tarantool#10304 @TarantoolBot document Title: Document lua_call feature Root document: https://www.tarantool.io/en/doc/latest/reference/configuration/configuration_reference/ `<user_or_role_name>.privileges.lua_call`: Defines the Lua functions that the specified user or a user with the specified role has permission to call. This field accepts a special value, `all`, which grants the privilege to use any global non-built-in Lua functions. For example, setting `credentials.users.alice.privileges.lua_call = ['foo']` allows the user alice to execute the foo function.

no commit message yet [WIP]: This task depends on - tarantool#10304 (PR tarantool#10324) - tarantool#10306 (PR tarantool#10358) and uses commits from these PRs. Closes tarantool#10310 NO_DOC=yet NO_CHANGELOG=yet

@TarantoolBot

This patch adds the capability to grant access to specific Lua functions in the declarative configuration. You can now grant access by assigning the function name to `credentials.users.<user>.privileges.lua_call`. Closes tarantool#10304 @TarantoolBot document Title: Document lua_call feature Root document: https://www.tarantool.io/en/doc/latest/reference/configuration/configuration_reference/ `<user_or_role_name>.privileges.lua_call`: Defines the Lua functions that the specified user or a user with the specified role has permission to call. This field accepts a special value, `all`, which grants the privilege to use any global non-built-in Lua functions. For example, setting `credentials.users.alice.privileges.lua_call = ['foo']` allows the user alice to execute the foo function.

@TarantoolBot

This patch adds the capability to grant access to specific Lua functions in the declarative configuration. You can now grant access by assigning the function name to `credentials.users.<user>.privileges.lua_call`. Closes tarantool#10304 @TarantoolBot document Title: Document lua_call feature Root document: https://www.tarantool.io/en/doc/latest/reference/configuration/configuration_reference/ `<user_or_role_name>.privileges.lua_call`: Defines the Lua functions that the specified user or a user with the specified role has permission to call. This field accepts a special value, `all`, which grants the privilege to use any global non-built-in Lua functions. For example, setting `credentials.users.alice.privileges.lua_call = ['foo']` allows the user alice to execute the foo function.

Totktonada added feature A new functionality config labels Jul 24, 2024

Totktonada mentioned this issue Jul 24, 2024

config: grant access to call a global Lua function in runtime #10310

Closed

mandesero mentioned this issue Jul 29, 2024

config: grant access to specific function in config #10324

Merged

Totktonada closed this as completed in #10324 Aug 19, 2024

Totktonada closed this as completed in e7c7b24 Aug 19, 2024

Totktonada mentioned this issue Aug 19, 2024

Document lua_call feature tarantool/doc#4462

Closed

Totktonada added 3.3 Target is 3.3 and all newer release/master branches 3.2 Target is 3.2 and all newer release/master branches and removed 3.3 Target is 3.3 and all newer release/master branches labels Oct 2, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

config: allow to grant access to specific functions using `lua_call` #10304

config: allow to grant access to specific functions using `lua_call` #10304

config: allow to grant access to specific functions using lua_call #10304

config: allow to grant access to specific functions using lua_call #10304

Comments

config: allow to grant access to specific functions using `lua_call` #10304

config: allow to grant access to specific functions using `lua_call` #10304