cockroachdb / cockroachdb/cockroach
Inconsistency in permissions for SHOW USERS vs. \du
- Dominant language
- Go
- Stars
- 32.5k
- Forks
- 4.1k
- PR merge metrics
- PR metrics pending
Description
**Describe the problem**
While logged into CockroachDB as a role without permission to run `SHOW USERS`, running the `\du` shorthand command succeeds. Here is an example:
```
v-root-crdb-rol-yq0txp53yswvvqyoiqni-1713375383@127.0.0.1:26257/defaultdb> \du
List of roles:
Role name | Attributes | Member of
--------------------------------------------------+-------------------------------------------------+------------
dbconsole | Superuser, Create role, Create DB | {admin}
root | Superuser, Create role, Create DB | {admin}
vaultadm | Superuser, Create role, Create DB | {admin}
demo | | {}
quay | | {}
v-root-crdb-rol-mogv6lux1o7gnbckomqo-1713365410 | Password valid until 2024-04-17 15:50:15+00 | {}
v-root-crdb-rol-t56efhshfuhxo8sri6ox-1713365410 | Password valid until 2024-04-17 15:50:15+00 | {}
v-root-crdb-rol-xnnjexmswl79kc7mdpcc-1713365411 | Password valid until 2024-04-17 15:50:16+00 | {}
v-root-crdb-rol-yq0txp53yswvvqyoiqni-1713375383 | Password valid until 2024-04-17 18:36:28+00 | {}
xademo | | {}
admin | Superuser, Create role, Create DB | {}
hr_admin | | {}
test_role | | {}
unpriv | | {}
v-root-crdb-rol-0sbobaoogm8ktmfoqyi9-1713365410 | Password valid until 2024-04-17 15:50:15+00 | {}
v-root-crdb-rol-jlurhtj1kfamawa3ll4i-1713365411 | Password valid until 2024-04-17 15:50:16+00 | {}
node | Superuser, Create role, Create DB, Cannot login | {}
(17 rows)
```
While the following fails:
```
v-root-crdb-rol-yq0txp53yswvvqyoiqni-1713375383@127.0.0.1:26257/defaultdb> show users;
ERROR: user v-root-crdb-rol-yq0txp53yswvvqyoiqni-1713375383 does not have SELECT privilege on relation users
SQLSTATE: 42501
v-root-crdb-rol-yq0txp53yswvvqyoiqni-1713375383@127.0.0.1:26257/defaultdb> select version();
version
----------------------------------------------------------------------------------------------------------------
CockroachDB CCL v23.2.4 (aarch64-apple-darwin21.2, built 2024/04/08 21:56:49, go1.21.8 X:nocoverageredesign)
(1 row)
```
**Desired Solution**
(edit from @rafiss): Let's change SHOW USERS so it does not hit the system tables here: https://github.com/cockroachdb/cockroach/blob/46e5956a108f7f903fa40bd4e78b97a2c15fe7f1/pkg/sql/delegate/show_roles.go#L20
It should be changed to use the `pg_catalog.pg_roles` and `crdb_internal.kv_inherited_role_members`, which don't require permissions. In order to display role options as well, we might also need to add a new `crdb_internal` table that has role options, or add role options to an existing `pg_catalog` table.
**Environment:**
- CockroachDB version v23.2.4 (aarch64-apple-darwin21.2, built 2024/04/08 21:56:49, go1.21.8 X:nocoverageredesign)
- Server OS: MacOS / ARM
- Client app: cockroach sql ...
Jira issue: CRDB-38005
Epic CRDB-49582
Contributor guide
Research direction
Start in pkg/sql/delegate/show_roles.go and compare how SHOW USERS and \du obtain role data and privileges. The work is done when SHOW USERS uses pg_catalog.pg_roles and crdb_internal.kv_inherited_role_members without requiring permissions, while still displaying role options through an appropriate catalog or internal table.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, sql
- Domain
- authorization, databases
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 28/100