diff options
Diffstat (limited to 'src/mongo/db/auth/builtin_roles.cpp')
| -rw-r--r-- | src/mongo/db/auth/builtin_roles.cpp | 42 |
1 files changed, 6 insertions, 36 deletions
diff --git a/src/mongo/db/auth/builtin_roles.cpp b/src/mongo/db/auth/builtin_roles.cpp index 9eddd117f80..2b0c63cb798 100644 --- a/src/mongo/db/auth/builtin_roles.cpp +++ b/src/mongo/db/auth/builtin_roles.cpp @@ -119,7 +119,6 @@ MONGO_INITIALIZER(AuthorizationBuiltinRoles)(InitializerContext* context) { << ActionType::killCursors << ActionType::listCollections << ActionType::listIndexes - << ActionType::listSearchIndexes << ActionType::planCacheRead; // Read-write role @@ -129,15 +128,12 @@ MONGO_INITIALIZER(AuthorizationBuiltinRoles)(InitializerContext* context) { << ActionType::convertToCapped // db admin gets this also << ActionType::createCollection // db admin gets this also << ActionType::createIndex - << ActionType::createSearchIndexes << ActionType::dropCollection << ActionType::dropIndex - << ActionType::dropSearchIndex << ActionType::insert << ActionType::remove << ActionType::renameCollectionSameDB // db admin gets this also - << ActionType::update - << ActionType::updateSearchIndex; + << ActionType::update; // User admin role userAdminRoleActions @@ -167,24 +163,21 @@ MONGO_INITIALIZER(AuthorizationBuiltinRoles)(InitializerContext* context) { << ActionType::dropDatabase // clusterAdmin gets this also TODO(spencer): should // readWriteAnyDatabase? << ActionType::dropIndex - << ActionType::dropSearchIndex << ActionType::createIndex - << ActionType::createSearchIndexes << ActionType::enableProfiler << ActionType::listCollections << ActionType::listIndexes - << ActionType::listSearchIndexes << ActionType::planCacheIndexFilter << ActionType::planCacheRead << ActionType::planCacheWrite << ActionType::reIndex << ActionType::renameCollectionSameDB // read_write gets this also << ActionType::storageDetails - << ActionType::updateSearchIndex << ActionType::validate; // clusterMonitor role actions that target the cluster resource clusterMonitorRoleClusterActions + << ActionType::checkFreeMonitoringStatus << ActionType::connPoolStats << ActionType::getCmdLineOpts << ActionType::getDefaultRWConcern // clusterManager gets this also @@ -203,11 +196,7 @@ MONGO_INITIALIZER(AuthorizationBuiltinRoles)(InitializerContext* context) { << ActionType::top << ActionType::useUUID << ActionType::inprog - << ActionType::shardingState - << ActionType::allCollectionStats - << ActionType::shardedDataDistribution - << ActionType::queryStatsRead - << ActionType::queryStatsReadTransformed; + << ActionType::shardingState; // clusterMonitor role actions that target a database (or collection) resource clusterMonitorRoleDatabaseActions @@ -264,6 +253,7 @@ MONGO_INITIALIZER(AuthorizationBuiltinRoles)(InitializerContext* context) { << ActionType::runTenantMigration << ActionType::setDefaultRWConcern << ActionType::setFeatureCompatibilityVersion + << ActionType::setFreeMonitoring << ActionType::setClusterParameter << ActionType::getClusterParameter; @@ -376,8 +366,7 @@ void addUserAdminAnyDbPrivileges(PrivilegeVector* privileges) { ActionSet readRoleAndIndexActions; readRoleAndIndexActions += readRoleActions; - readRoleAndIndexActions << ActionType::createIndex << ActionType::dropIndex - << ActionType::createSearchIndexes << ActionType::dropSearchIndex; + readRoleAndIndexActions << ActionType::createIndex << ActionType::dropIndex; Privilege::addPrivilegeToPrivilegeVector( privileges, Privilege(ResourcePattern::forCollectionName("system.users"), readRoleActions)); @@ -433,11 +422,6 @@ void addClusterMonitorPrivileges(PrivilegeVector* privileges) { Privilege(ResourcePattern::forDatabaseName("config"), clusterMonitorRoleDatabaseActions)); Privilege::addPrivilegeToPrivilegeVector( privileges, - Privilege(ResourcePattern::forExactNamespace(NamespaceString("config", "system.sessions")), - clusterMonitorRoleDatabaseActions)); - - Privilege::addPrivilegeToPrivilegeVector( - privileges, Privilege(ResourcePattern::forDatabaseName("local"), clusterMonitorRoleDatabaseActions)); addReadOnlyDbPrivileges(privileges, "config"); addReadOnlyDbPrivileges(privileges, "local"); @@ -535,8 +519,6 @@ void addQueryableBackupPrivileges(PrivilegeVector* privileges) { Privilege::addPrivilegeToPrivilegeVector( privileges, Privilege(ResourcePattern::forAnyResource(), ActionType::listIndexes)); Privilege::addPrivilegeToPrivilegeVector( - privileges, Privilege(ResourcePattern::forAnyResource(), ActionType::listSearchIndexes)); - Privilege::addPrivilegeToPrivilegeVector( privileges, Privilege(ResourcePattern::forAnySystemBuckets(), ActionType::find)); ActionSet clusterActions; @@ -617,9 +599,7 @@ void addRestorePrivileges(PrivilegeVector* privileges) { ActionSet actions; actions << ActionType::bypassDocumentValidation << ActionType::collMod << ActionType::convertToCapped << ActionType::createCollection - << ActionType::createIndex << ActionType::dropCollection - << ActionType::createSearchIndexes << ActionType::updateSearchIndex - << ActionType::insert; + << ActionType::createIndex << ActionType::dropCollection << ActionType::insert; Privilege::addPrivilegeToPrivilegeVector( privileges, Privilege(ResourcePattern::forAnyNormalResource(), actions)); @@ -696,11 +676,6 @@ void addRestorePrivileges(PrivilegeVector* privileges) { Privilege( ResourcePattern::forExactNamespace(AuthorizationManager::rolesCollectionNamespace), ActionType::createIndex)); - Privilege::addPrivilegeToPrivilegeVector( - privileges, - Privilege( - ResourcePattern::forExactNamespace(AuthorizationManager::rolesCollectionNamespace), - ActionType::createSearchIndexes)); Privilege::addPrivilegeToPrivilegeVector( privileges, @@ -712,12 +687,7 @@ void addRestorePrivileges(PrivilegeVector* privileges) { // Need to be able to set and bypass write blocking mode for C2C replication ActionType::bypassWriteBlockingMode, ActionType::setUserWriteBlockMode, - // Needed for `mongorestore --preserveUUID` - ActionType::applyOps, })); - Privilege::addPrivilegeToPrivilegeVector( - privileges, - Privilege(ResourcePattern::forCollectionName("system.views"), ActionType::dropCollection)); } void addRootRolePrivileges(PrivilegeVector* privileges) { |