Mailing-List: contact derby-dev-help@db.apache.org; run by ezmlm
Precedence: bulk
Reply-To: <derby-dev@db.apache.org>
Message-ID: <31936761.1153371016211.JavaMail.jira@brutus>
Date: Wed, 19 Jul 2006 21:50:16 -0700 (PDT)
From: "Mamta A. Satoor (JIRA)" <derby-dev@db.apache.org>
To: derby-dev@db.apache.org
Subject: [jira] Updated: (DERBY-1330) Provide runtime privilege checking for
 grant/revoke functionality
In-Reply-To: <14984243.1147927445981.JavaMail.jira@brutus>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

     [ http://issues.apache.org/jira/browse/DERBY-1330?page=3Dall ]

Mamta A. Satoor updated DERBY-1330:
-----------------------------------

    Attachment: Derby1330setUUIDinDataDictionaryV10diff.txt
                Derby1330setUUIDinDataDictionaryV10stat.txt

Dan, the patch Derby1330setUUIDinDataDictionaryV8diff.txt failed for you be=
cause it was trying to reference a variable by a name which got changed by =
another patch that went in for this jira entry.

I have attached a new patch Derby1330setUUIDinDataDictionaryV10diff.txt to =
resolve the problem. The svn stat -q is attached as Derby1330setUUIDinDataD=
ictionaryV10stat.txt. At this point, this new patch is the only pending pat=
ch on this Jira entry and I will highly appreciate somebody taking the time=
 to review and committer commiting it.

> Provide runtime privilege checking for grant/revoke functionality
> -----------------------------------------------------------------
>
>                 Key: DERBY-1330
>                 URL: http://issues.apache.org/jira/browse/DERBY-1330
>             Project: Derby
>          Issue Type: Sub-task
>          Components: SQL
>    Affects Versions: 10.2.0.0
>            Reporter: Mamta A. Satoor
>         Assigned To: Mamta A. Satoor
>         Attachments: AuthorizationModelForDerbySQLStandardAuthorization.h=
tml, AuthorizationModelForDerbySQLStandardAuthorizationV2.html, DERBY1330ja=
vaDocWarningsDiffV9.txt, DERBY1330javaDocWarningsStatV9.txt, Derby1330Minor=
CleanupV7diff.txt, Derby1330MinorCleanupV7stat.txt, Derby1330PrivilegeColle=
ctionV2diff.txt, Derby1330PrivilegeCollectionV2stat.txt, Derby1330Privilege=
CollectionV3diff.txt, Derby1330PrivilegeCollectionV3stat.txt, Derby1330setU=
UIDinDataDictionaryV10diff.txt, Derby1330setUUIDinDataDictionaryV10stat.txt=
, Derby1330setUUIDinDataDictionaryV8diff.txt, Derby1330setUUIDinDataDiction=
aryV8stat.txt, Derby1330uuidIndexForPermsSystemTablesV4diff.txt, Derby1330u=
uidIndexForPermsSystemTablesV4stat.txt, Derby1330uuidIndexForPermsSystemTab=
lesV5diff.txt, Derby1330uuidIndexForPermsSystemTablesV5stat.txt, Derby1330u=
uidIndexForPermsSystemTablesV6diff.txt, Derby1330uuidIndexForPermsSystemTab=
lesV6stat.txt, Derby1330ViewPrivilegeCollectionV1diff.txt, Derby1330ViewPri=
vilegeCollectionV1stat.txt
>
>
> Additional work needs to be done for grant/revoke to make sure that only =
users with required privileges can access various database objects. In orde=
r to do that, first we need to collect the privilege requirements for vario=
us database objects and store them in SYS.SYSREQUIREDPERM. Once we have thi=
s information then when a user tries to access an object, the required SYS.=
SYSREQUIREDPERM privileges for the object will be checked against the user =
privileges in SYS.SYSTABLEPERMS, SYS.SYSCOLPERMS and SYS.SYSROUTINEPERMS. T=
he database object access will succeed only if the user has the necessary p=
rivileges.
> SYS.SYSTABLEPERMS, SYS.SYSCOLPERMS and SYS.SYSROUTINEPERMS are already po=
pulated by Satheesh's work on DERBY-464. But SYS.SYSREQUIREDPERM doesn't ha=
ve any information in it at this point and hence no runtime privilege check=
ing is getting done at this point.

--=20
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: htt=
p://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira