[TRAFODION-2423] any user can perform 'initialize trafodion,drop'

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 2.0-incubating
• Component/s: sql-security
• Environment: cloudera version -- CDH5.6; hortonworks version -- HDP2.3.4
• Assignee: Roberta Marton
• Reporter: Gao, Rui-Xian
• Created: 03/Jan/17 23:34
• Updated: 15/Feb/17 15:55
• Resolved: 15/Feb/17 15:55

Description

When security is enabled, any user can perform 'initialize trafodion,dorp' to drop all objects, we should limit the user to DB__ROOT only.

[trafodion@gyvm-1 security]$ trafci

Welcome to EsgynDB Enterprise Command Interface
Copyright (c) 2015-2016 Esgyn Corporation

Host Name/IP Address: gyvm-1.novalocal:23400
User Name: zz

• • • ERROR[8837] Invalid username or password. User: ZZ [2017-01-01 22:40:23]

User Name: qauser2
Password:

Role Name [Primary Role]:

Connected to EsgynDB Advanced

SQL>select * from user1sch.user1t;

• • • ERROR[4481] The user does not have SELECT privilege on table or view TRAFODION.USER1SCH.USER1T. [2017-01-01 22:41:03]

SQL>get component privileges on sql_operations for qauser2;

— SQL operation complete.

SQL>initialize trafodion,drop;

— SQL operation complete.