[DERBY-2109] System privileges

• Type: Improvement
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 10.3.1.4
• Component/s: Network Server, Services
• Bug behavior facts: Security
• Assignee: Unassigned
• Reporter: Richard N. Hillegas
• Created: 22/Nov/06 15:57
• Updated: 20/Dec/11 20:57

Description

Add mechanisms for controlling system-level privileges in Derby. See the related email discussion at http://article.gmane.org/gmane.comp.apache.db.derby.devel/33151.

The 10.2 GRANT/REVOKE work was a big step forward in making Derby more secure in a client/server configuration. I'd like to plug more client/server security holes in 10.3. In particular, I'd like to focus on authorization issues which the ANSI spec doesn't address.

Here are the important issues which came out of the email discussion.

Missing privileges that are above the level of a single database:

• Create Database
• Shutdown all databases
• Shutdown System

Missing privileges specific to a particular database:

• Shutdown that Database
• Encrypt that database
• Upgrade database
• Create (in that Database) Java Plugins (currently Functions/Procedures, but someday Aggregates and VTIs)

Note that 10.2 gave us GRANT/REVOKE control over the following database-specific issues, via granting execute privilege to system procedures:

Jar Handling
Backup Routines
Admin Routines
Import/Export
Property Handling
Check Table

In addition, since 10.0, the privilege of connecting to a database has been controlled by two properties (derby.database.fullAccessUsers and derby.database.defaultConnectionMode) as described in the security section of the Developer's Guide (see http://db.apache.org/derby/docs/10.2/devguide/cdevcsecure865818.html).

Issue Links

• incorporates: DERBY-3495 Enable System Privileges checks
• incorporates: DERBY-2466 Allow dynamic reloading of the security policy file
• is blocked by: DERBY-1387 Add JMX extensions to Derby
• is related to: DERBY-3532 Invalid & possibly skipped authentication handling when shutting down the network server.
• is related to: DERBY-3614 Granted SystemPermissions are ignored when granted later with same target and different action
• is related to: DERBY-5548 Implement a GRANT/REVOKE scheme for authorizing system-wide operations
• is related to: DERBY-3491 Change SystemPermission to be a two arguement permission with a name (object the permission is on) and an action.
• relates to: DERBY-2470 No authentication required to restore a backup
• relates to: DERBY-3535 derby.drda.StartNetworkServer property no longer works gives exception java.lang.NoSuchMethodException: org.apache.derby.impl.drda.NetworkServerControlImpl.<init>(java.lang.String, java.lang.String)
• relates to: DERBY-3644 NetworkServerControl.ping() on trunk against 10.3.2.1 and older servers give 'DRDA_InvalidReplyHeader2.S:Invalid reply header from network server: Invalid string . Plaintext connection attempt to an SSL enabled server?'
• relates to: DERBY-2264 Restrict shutdown, upgrade, and encryption powers to the database owner

Sub-Tasks

• Permissions and Principal objects added by this feature need to be final and have serialization identifiers: Closed
• Make format principal names in SystemPermission (e.g. policy files) match the standard way Derby handles authorization identifiers in a Java context.: Open
• Investigate implementing the file matching logic in DatabasePermission using FilePermission: Open
• Add functional (ie user level) tests for system privileges: Open
• Enable System Privileges checks: Open
• DatabasePermission uses a JDK 1.4 method that is not present in J2ME/CDC/Foundation.: Closed
• Document user authentication support for network server shutdown: Closed