1 files changed, 14 insertions, 9 deletions
diff --git a/src/mongo/db/auth/authorization_manager.cpp b/src/mongo/db/auth/authorization_manager.cpp
index ab2f5cd26a4..1cf8efede39 100644
--- a/src/mongo/db/auth/authorization_manager.cpp
+++ b/src/mongo/db/auth/authorization_manager.cpp
@@ -173,6 +173,7 @@ namespace {
         clusterAdminRoleReadActions.addAction(ActionType::touch);
         clusterAdminRoleReadActions.addAction(ActionType::unlock);
         clusterAdminRoleReadActions.addAction(ActionType::unsetSharding);
+        clusterAdminRoleReadActions.addAction(ActionType::writeBacksQueued);
 
         clusterAdminRoleWriteActions.addAction(ActionType::addShard);
         clusterAdminRoleWriteActions.addAction(ActionType::closeAllDatabases);
@@ -228,7 +229,6 @@ namespace {
         internalActions.addAction(ActionType::replSetGetRBID);
         internalActions.addAction(ActionType::replSetHeartbeat);
         internalActions.addAction(ActionType::writebacklisten);
-        internalActions.addAction(ActionType::writeBacksQueued);
         internalActions.addAction(ActionType::_migrateClone);
         internalActions.addAction(ActionType::_recvChunkAbort);
         internalActions.addAction(ActionType::_recvChunkCommit);
@@ -394,9 +394,21 @@ namespace {
         _authenticatedPrincipals.add(principal);
         if (!principal->isImplicitPrivilegeAcquisitionEnabled())
             return;
+
+        const std::string dbname = principal->getName().getDB().toString();
+        if (dbname == StringData("local", StringData::LiteralTag()) &&
+            principal->getName().getUser() == internalSecurity.user) {
+
+            // Grant full access to internal user
+            ActionSet allActions;
+            allActions.addAllActions();
+            acquirePrivilege(Privilege(PrivilegeSet::WILDCARD_RESOURCE, allActions),
+                             principal->getName());
+            return;
+        }
+
         _acquirePrivilegesForPrincipalFromDatabase(ADMIN_DBNAME, principal->getName());
         principal->markDatabaseAsProbed(ADMIN_DBNAME);
-        const std::string dbname = principal->getName().getDB().toString();
         _acquirePrivilegesForPrincipalFromDatabase(dbname, principal->getName());
         principal->markDatabaseAsProbed(dbname);
     }
@@ -491,13 +503,6 @@ namespace {
                                   << principal.getDB(),
                           0);
         }
-        if (principal.getUser() == internalSecurity.user) {
-            // Grant full access to internal user
-            ActionSet allActions;
-            allActions.addAllActions();
-            return acquirePrivilege(Privilege(PrivilegeSet::WILDCARD_RESOURCE, allActions),
-                                    principal);
-        }
         return buildPrivilegeSet(dbname, principal, privilegeDocument, &_acquiredPrivileges);
     }