box: add runtime lua_call privileges #10358

mandesero · 2024-08-02T15:56:49Z

This patch adds internal API methods for granting and revoking Lua function access.

New internal API methods:

box.internal.lua_call_runtime_priv_grant(<user-name>, <function-name>) grants access to the specified function for the specified user.
box.internal.lua_call_runtime_priv_grant(<user-name>, '') grants universal access (excluding built-in functions) for the specified user.
box.internal.lua_call_runtime_priv_reset() revokes all previously granted function execution permissions for all users.

src/box/call_rt_user_privilege.c

coveralls · 2024-08-05T13:58:48Z

coverage: 87.323% (+0.02%) from 87.304%
when pulling 5e0e970 on mandesero:mandesero/gh-10306-lua-access-without-db
into daf4914
on tarantool:master.

changelogs/unreleased/gh_10306_lua_call_runtime_access.md

no commit message yet [WIP]: This task depends on - tarantool#10304 (PR tarantool#10324) - tarantool#10306 (PR tarantool#10358) and uses commits from these PRs. Closes tarantool#10310 NO_DOC=yet NO_CHANGELOG=yet

src/lib/core/assoc.h

src/box/rt_lua_call_access.h

src/box/lua/call.c

src/box/CMakeLists.txt

src/box/rt_lua_call_access.h

src/box/box.cc

src/box/rt_access.c

Totktonada

Thank you for the patch and the updates!

I'm comfortable with the implementation. LGTM.

I've some ideas how to make this code more concise, but I think I shouldn't make this activity a part of the review process.

Totktonada · 2024-09-02T15:57:12Z

@locker Please, look over this patch if you have a spare time. I would appreciate your glance and suggestions.

src/box/call.c

src/box/lua/call.c

src/box/rt_access.h

src/box/rt_access.c

src/box/rt_access.h

src/box/lua/call.c

src/lib/core/assoc.h

src/box/call.c

test/box-luatest/gh_10306_lua_call_runtime_access_test.lua

This patch introduces a hash map that maps pairs of strings with their lengths to a pointer. Needed for tarantool#10306 NO_TEST=internal NO_DOC=internal NO_CHANGELOG=internal

This patch adds internal API methods for granting and revoking Lua function access. New internal API methods: - `box.internal.lua_call_runtime_priv_grant(<user-name>, <function-name>)` grants access to the specified function for the specified user. - `box.interal.lua_call_runtime_priv_grant(<user-name>, '')` grants universal access (excluding built-in functions) for the specified user. - `box.internal.lua_call_runtime_priv_reset()` revokes all previously granted function execution permissions for all users. Closes tarantool#10306 NO_DOC=internal NO_CHANGELOG=internal

mandesero force-pushed the mandesero/gh-10306-lua-access-without-db branch from 3ce1fa8 to 1c362cf Compare August 2, 2024 15:59

Totktonada reviewed Aug 2, 2024

View reviewed changes

src/box/call_rt_user_privilege.c Outdated Show resolved Hide resolved

mandesero force-pushed the mandesero/gh-10306-lua-access-without-db branch 3 times, most recently from 3b69301 to a256b41 Compare August 5, 2024 12:25

mandesero requested review from Totktonada and Buristan August 5, 2024 12:42

mandesero force-pushed the mandesero/gh-10306-lua-access-without-db branch 2 times, most recently from c044a6e to 835bf72 Compare August 5, 2024 13:45

mandesero force-pushed the mandesero/gh-10306-lua-access-without-db branch from 835bf72 to a08877e Compare August 5, 2024 14:05

mandesero marked this pull request as ready for review August 5, 2024 14:53

mandesero requested a review from a team as a code owner August 5, 2024 14:53

mandesero force-pushed the mandesero/gh-10306-lua-access-without-db branch 6 times, most recently from edd3c19 to 7b0a233 Compare August 8, 2024 06:44

xuniq approved these changes Aug 8, 2024

View reviewed changes

changelogs/unreleased/gh_10306_lua_call_runtime_access.md Outdated Show resolved Hide resolved

mandesero force-pushed the mandesero/gh-10306-lua-access-without-db branch from 7b0a233 to fa28e6e Compare August 13, 2024 12:16

mandesero mentioned this pull request Aug 20, 2024

config: grant runtime access to call_lua functions from declarative configuration #10392

Merged