cockroachdb / cockroachdb/cockroach

Inconsistency in permissions for SHOW USERS vs. \du

Open
#122,623 1 comment 0 reactions 0 assignees View on GitHub
C-bug E-starter O-community T-sql-foundations
Dominant language
Go
Stars
32.5k
Forks
4.1k
PR merge metrics
PR metrics pending

Description

**Describe the problem**

While logged into CockroachDB as a role without permission to run `SHOW USERS`, running the `\du` shorthand command succeeds. Here is an example:

```
v-root-crdb-rol-yq0txp53yswvvqyoiqni-1713375383@127.0.0.1:26257/defaultdb> \du
List of roles:
Role name | Attributes | Member of
--------------------------------------------------+-------------------------------------------------+------------
dbconsole | Superuser, Create role, Create DB | {admin}
root | Superuser, Create role, Create DB | {admin}
vaultadm | Superuser, Create role, Create DB | {admin}
demo | | {}
quay | | {}
v-root-crdb-rol-mogv6lux1o7gnbckomqo-1713365410 | Password valid until 2024-04-17 15:50:15+00 | {}
v-root-crdb-rol-t56efhshfuhxo8sri6ox-1713365410 | Password valid until 2024-04-17 15:50:15+00 | {}
v-root-crdb-rol-xnnjexmswl79kc7mdpcc-1713365411 | Password valid until 2024-04-17 15:50:16+00 | {}
v-root-crdb-rol-yq0txp53yswvvqyoiqni-1713375383 | Password valid until 2024-04-17 18:36:28+00 | {}
xademo | | {}
admin | Superuser, Create role, Create DB | {}
hr_admin | | {}
test_role | | {}
unpriv | | {}
v-root-crdb-rol-0sbobaoogm8ktmfoqyi9-1713365410 | Password valid until 2024-04-17 15:50:15+00 | {}
v-root-crdb-rol-jlurhtj1kfamawa3ll4i-1713365411 | Password valid until 2024-04-17 15:50:16+00 | {}
node | Superuser, Create role, Create DB, Cannot login | {}
(17 rows)
```

While the following fails:
```
v-root-crdb-rol-yq0txp53yswvvqyoiqni-1713375383@127.0.0.1:26257/defaultdb> show users;
ERROR: user v-root-crdb-rol-yq0txp53yswvvqyoiqni-1713375383 does not have SELECT privilege on relation users
SQLSTATE: 42501
v-root-crdb-rol-yq0txp53yswvvqyoiqni-1713375383@127.0.0.1:26257/defaultdb> select version();
version
----------------------------------------------------------------------------------------------------------------
CockroachDB CCL v23.2.4 (aarch64-apple-darwin21.2, built 2024/04/08 21:56:49, go1.21.8 X:nocoverageredesign)
(1 row)
```

**Desired Solution**
(edit from @rafiss): Let's change SHOW USERS so it does not hit the system tables here: https://github.com/cockroachdb/cockroach/blob/46e5956a108f7f903fa40bd4e78b97a2c15fe7f1/pkg/sql/delegate/show_roles.go#L20

It should be changed to use the `pg_catalog.pg_roles` and `crdb_internal.kv_inherited_role_members`, which don't require permissions. In order to display role options as well, we might also need to add a new `crdb_internal` table that has role options, or add role options to an existing `pg_catalog` table.

**Environment:**
- CockroachDB version v23.2.4 (aarch64-apple-darwin21.2, built 2024/04/08 21:56:49, go1.21.8 X:nocoverageredesign)
- Server OS: MacOS / ARM
- Client app: cockroach sql ...

Jira issue: CRDB-38005

Epic CRDB-49582

Contributor guide

Open the contributing guide

Research direction

Start in pkg/sql/delegate/show_roles.go and compare how SHOW USERS and \du obtain role data and privileges. The work is done when SHOW USERS uses pg_catalog.pg_roles and crdb_internal.kv_inherited_role_members without requiring permissions, while still displaying role options through an appropriate catalog or internal table.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, sql
Domain
authorization, databases
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
28/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.