apache / apache/cloudstack

Security: ACS user access to all databases

Open
#8,240 9 comments 0 reactions 0 assignees View on GitHub
archive component:database status:needs-investigation type:security
Dominant language
Java
Stars
3.1k
Forks
1.4k
Avg merge
6d 19h
Merged PRs (30d)
32

Description

##### ISSUE TYPE

* Bug Report
* Improvement Request
* Enhancement Request

##### COMPONENT NAME

~~~
Core, MySQL
~~~

##### CLOUDSTACK VERSION

~~~
4.19.0.0-snapshot.20231113
~~~

##### CONFIGURATION

##### OS / ENVIRONMENT

Ubuntu 22.04

##### SUMMARY

ACS requires access to all MySQL databases, which creates a huge security hole for a shared MySQL instance.

Trying to limit the scope of ACS access yields in the access denied error (see below).

##### STEPS TO REPRODUCE

~~~
> `sudo cloudstack-setup-databases cloud:cloud@mysql --deploy-as=root`

/usr/share/cloudstack-management/setup/create-database.sql
lines: 64-65
GRANT process ON *.* TO cloud@`localhost`;
GRANT process ON *.* TO cloud@`%`;

// This works with the full access
GRANT ALL ON *.* TO 'root'@'hyp0' WITH GRANT OPTION

// This yields in an error:
- GRANT ALL ON mysql.* TO 'root'@'hyp0' WITH GRANT OPTION
- GRANT ALL ON billing.* TO 'root'@'hyp0' WITH GRANT OPTION
- GRANT ALL ON cloud.* TO 'root'@'hyp0' WITH GRANT OPTION
- GRANT ALL ON cloud_usage.* TO 'root'@'hyp0' WITH GRANT OPTION
~~~

##### EXPECTED RESULTS

~~~
ACS configs own databases only without an error
~~~

##### ACTUAL RESULTS

~~~
ACS wants a full access and gives an error when a limited db access is provided

We apologize for below error:
table:
/usr/share/cloudstack-management/setup/create-database.sql

Error:
b"ERROR 1045 (28000) at line 64: Access denied for user 'root'@'hyp0' (using password: NO)\n"
~~~

Contributor guide

Open the contributing guide

Research direction

Start with /usr/share/cloudstack-management/setup/create-database.sql, especially lines 64-65, and reproduce the setup command with the limited MySQL grants shown. Trace which databases and privileges ACS needs; done means cloudstack setup succeeds with only the required database scope and no access to unrelated databases.

Written by the indexing model from the issue text.

Assessment

Tech stack
mysql, sql
Domain
databases, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.