Database restriction aggregator for SET ROLE statement. More...

#include <partial_revokes.h>

Inheritance diagram for DB_restrictions_aggregator_set_role:

Private Member Functions
	DB_restrictions_aggregator_set_role (const Auth_id &grantor, const Auth_id grantee, const Access_bitmask grantor_global_access, const Access_bitmask grantee_global_access, const DB_restrictions &grantor_restrictions, const DB_restrictions &grantee_restrictions, const Access_bitmask requested_access, Db_access_map *db_map)
	DB_restrictions_aggregator_set_role constructor. More...

Status	validate () override
	Evaluates the restrictions list of grantor and grantee, as well as requested privilege. More...

void	aggregate (DB_restrictions &db_restrictions) override
	Generates DB_restrictions based on the requested access, grantor and grantee's DB_restrictions in the ACL cache. More...

Private Attributes
Db_access_map *	m_db_map

Friends
class	Restrictions_aggregator_factory

Additional Inherited Members
Public Member Functions inherited from DB_restrictions_aggregator
bool	generate (Abstract_restrictions &restrictions) override
	Driver function to aggregate restriction lists. More...

Public Member Functions inherited from Restrictions_aggregator
virtual	~Restrictions_aggregator ()
	Destructor. More...

Protected Types inherited from DB_restrictions_aggregator
enum class	SQL_OP { SET_ROLE , GLOBAL_GRANT }

using	Status = Restrictions_aggregator::Status

Protected Types inherited from Restrictions_aggregator
enum class	Status { Error , Warning , Validated , Aggregated , No_op }

Protected Member Functions inherited from DB_restrictions_aggregator
	DB_restrictions_aggregator (const Auth_id &grantor, const Auth_id grantee, const Access_bitmask grantor_global_access, const Access_bitmask grantee_global_access, const DB_restrictions &grantor_restrictions, const DB_restrictions &grantee_restrictions, const Access_bitmask requested_access, const Security_context *sctx)
	Constructor for database level restrictions aggregator. More...

bool	find_if_require_next_level_operation (Access_bitmask &rights) const override
	Get list of privileges that are not restricted through restriction list. More...

bool	check_db_access_and_restrictions_collision (const Access_bitmask grantee_db_access, const Access_bitmask grantee_restrictions, const std::string &db_name) noexcept
	Check possible descrepancy between DB access being granted and existing restrictions. More...

void	set_if_db_level_operation (const Access_bitmask requested_access, const Access_bitmask restrictions_mask) noexcept
	Set privileges that needs to be processed further. More...

void	aggregate_restrictions (SQL_OP sql_op, const Db_access_map *m_db_map, DB_restrictions &restrictions)
	A helper method that aggregates the restrictions for global_grant and set_role operations since both are similar in nature. More...

Access_bitmask	get_grantee_db_access (const std::string &db_name) const
	Fetches the grantee's DB access on the specified DB If the current user is the grantee and has some active roles, probe the security context. More...

void	get_grantee_db_access (const std::string &db_name, Access_bitmask &access) const
	Fetches the grantee's DB access on the specified DB. More...

Protected Member Functions inherited from Restrictions_aggregator
	Restrictions_aggregator (const Auth_id &grantor, const Auth_id grantee, const Access_bitmask grantor_global_access, const Access_bitmask grantee_global_access, const Access_bitmask requested_access)
	Constructor. More...

	Restrictions_aggregator (const Restrictions_aggregator &)=delete

Restrictions_aggregator &	operator= (const Restrictions_aggregator &)=delete

	Restrictions_aggregator (const Restrictions_aggregator &&)=delete

Restrictions_aggregator &	operator= (const Restrictions_aggregator &&)=delete

Protected Attributes inherited from DB_restrictions_aggregator
Access_bitmask	m_privs_not_processed = 0
	Privileges that needs to be checked further through DB grants. More...

DB_restrictions	m_grantor_rl
	Database restrictions for grantor. More...

DB_restrictions	m_grantee_rl
	Database restrictions for grantee. More...

const Security_context *	m_sctx
	Security context of the current user. More...

const bool	m_current_user_is_grantee
	Whether the current user is the grantee. More...

Protected Attributes inherited from Restrictions_aggregator
const Auth_id	m_grantor
	Grantor information. More...

const Auth_id	m_grantee
	Grantee information. More...

const Access_bitmask	m_grantor_global_access
	Global static privileges of grantor. More...

const Access_bitmask	m_grantee_global_access
	Global static privileges of grantee. More...

const Access_bitmask	m_requested_access
	Privileges that are being granted or revoked. More...

Status	m_status
	Internal status of aggregation process. More...

Detailed Description

Database restriction aggregator for SET ROLE statement.

Constructor & Destructor Documentation

◆ DB_restrictions_aggregator_set_role()

DB_restrictions_aggregator_set_role::DB_restrictions_aggregator_set_role	(	const Auth_id &	grantor,
		const Auth_id	grantee,
		const Access_bitmask	grantor_global_access,
		const Access_bitmask	grantee_global_access,
		const DB_restrictions &	grantor_db_restrictions,
		const DB_restrictions &	grantee_db_restrictions,
		const Access_bitmask	requested_access,
		Db_access_map *	db_map
	)

private

DB_restrictions_aggregator_set_role constructor.

Parameters

[in]	grantor	Grantor's user name and host info
[in]	grantee	Grantee's user name and host info
[in]	grantor_global_access	Current privileges mask of grantor
[in]	grantee_global_access	Current privileges mask of grantee
[in]	grantor_db_restrictions	Restrictions on the grantor
[in]	grantee_db_restrictions	Restrictions on the grantee
[in]	requested_access	Requested privileges mask in the SQL statement
[in,out]	db_map	Grantee's db_accees_map to fetch/update db access

Member Function Documentation

◆ aggregate()

void DB_restrictions_aggregator_set_role::aggregate ( DB_restrictions & db_restrictions )

overrideprivatevirtual

Generates DB_restrictions based on the requested access, grantor and grantee's DB_restrictions in the ACL cache.

If grantor has restrictions
- Retain Grantee's restrictions if it has more privileges than grantor
- If grantee has restrictions than aggregate them
- If grantee does not have restrictions keep only those restrictions of grantor for which there is no DB level access to grantee.
else if grantee has restrictions
- Remove the restrictions on which global grant is requested.

Parameters

[out] db_restrictions Fills the parameter with the generated DB_restrictions

Implements DB_restrictions_aggregator.

◆ validate()

Restrictions_aggregator::Status DB_restrictions_aggregator_set_role::validate ( )

overrideprivatevirtual

Evaluates the restrictions list of grantor and grantee, as well as requested privilege.

Checks possible descrepancy between DB access being granted and existing restrictions.

Returns

Status Moves the object in the appropriate status. For instance :

Validated, if validation was performed successfully
NO_op, if there is no aggregation of privileges required.
Error, if an error encountered

Implements DB_restrictions_aggregator.

Friends And Related Function Documentation

◆ Restrictions_aggregator_factory

friend class Restrictions_aggregator_factory

friend

Member Data Documentation

◆ m_db_map

Db_access_map* DB_restrictions_aggregator_set_role::m_db_map

private

The documentation for this class was generated from the following files:

sql/auth/partial_revokes.h
sql/auth/partial_revokes.cc

Private Member Functions

Private Attributes

Friends

Additional Inherited Members