Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-11526

GrantPrivilegesToRole and RemovePrivilegesFromRole audit record shows *all* privileges not *granted* privileges

    • Type: Icon: Bug Bug
    • Resolution: Done
    • Priority: Icon: Major - P3 Major - P3
    • 2.5.4
    • Affects Version/s: None
    • Component/s: None
    • ALL

      The audit record lists all the privileges the role has, not just the granted ones.

      Here's BSON format

                  {u'remote': {u'ip': u'127.0.0.1', u'port': 44284}, u'users': [{u'userSource': u'admin', u'user': u'admin'}], u'atype': u'grantPrivilegesToRole', u'ts': datetime.datetime(2013, 11, 1, 16, 51, 51, 37000, tzinfo=<bson.tz_util.FixedOffset object at 0x238da50>), u'param': {u'db': u'roledb34', u'privileges': [{u'resource': {u'db': u'roledb34', u'collection': u'thrip'}, u'actions': [u'createRole', u'createUser', u'dropUser']}, {u'resource': {u'db': u'admin', u'collection': u''}, u'actions': [u'collStats', u'dbHash', u'dbStats', u'find', u'killCursors']}, {u'resource': {u'db': u'admin', u'collection': u'system.indexes'}, u'actions': [u'collStats', u'dbHash', u'dbStats', u'find', u'killCursors']}, {u'resource': {u'db': u'admin', u'collection': u'system.js'}, u'actions': [u'collStats', u'dbHash', u'dbStats', u'find', u'killCursors']}, {u'resource': {u'db': u'admin', u'collection': u'system.namespaces'}, u'actions': [u'collStats', u'dbHash', u'dbStats', u'find', u'killCursors']}], u'role': u'role36'}, u'result': 0, u'local': {u'ip': u'127.0.0.1', u'port': 27017}}
      

      Here's text format.

                  2013-11-01T12:58:02.636-0400 admin@admin 127.0.0.1:44302/127.0.0.1:27017 Granted to role role72@roledb70 the privileges: { resource: { db: "roledb70", collection: "thrip" }, actions: [ "createRole", "createUser", "dropUser" ] }, { resource: { db: "admin", collection: "" }, actions: [ "collStats", "dbHash", "dbStats", "find", "killCursors" ] }, { resource: { db: "admin", collection: "system.indexes" }, actions: [ "collStats", "dbHash", "dbStats", "find", "killCursors" ] }, { resource: { db: "admin", collection: "system.js" }, actions: [ "collStats", "dbHash", "dbStats", "find", "killCursors" ] }, { resource: { db: "admin", collection: "system.namespaces" }, actions: [ "collStats", "dbHash", "dbStats", "find", "killCursors" ] }.
      
      

      RemovePrivileges has the same problem. That's even worse — it lists as removed all the aspects of the role EXCEPT those which were removed.

            Assignee:
            matt.dannenberg Matt Dannenberg
            Reporter:
            bard.bloom@10gen.com bard.bloom@10gen.com
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated:
              Resolved: