Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-90566

Permissions to fsyncLock are not the same as to fsyncUnlock

    • Type: Icon: Bug Bug
    • Resolution: Duplicate
    • Priority: Icon: Major - P3 Major - P3
    • None
    • Affects Version/s: None
    • Component/s: None
    • Server Security
    • ALL

      Testing on '8.0.0-rc4'

      fsyncLock: fine

      Enterprise [direct: mongos] admin> db.fsyncLock()
      {
        numFiles: 1,
        all: {
          raw: {
            'shard02/localhost:30004,localhost:30005,localhost:30006': {
              info: 'now locked against writes, use db.fsyncUnlock() to unlock',
              lockCount: Long("1"),
              seeAlso: 'http://dochub.mongodb.org/core/fsynccommand',
              ok: 1
            },
            'configRepl/localhost:30007': {
              info: 'now locked against writes, use db.fsyncUnlock() to unlock',
              lockCount: Long("1"),
              seeAlso: 'http://dochub.mongodb.org/core/fsynccommand',
              ok: 1
            },
            'shard01/localhost:30001,localhost:30002,localhost:30003': {
              info: 'now locked against writes, use db.fsyncUnlock() to unlock',
              lockCount: Long("1"),
              seeAlso: 'http://dochub.mongodb.org/core/fsynccommand',
              ok: 1
            }
          }
        },
        ok: 1,
        '$clusterTime': {
          clusterTime: Timestamp({ t: 1715842194, i: 7 }),
          signature: {
            hash: Binary(Buffer.from("4acd0115b9a7d848a47e26da29b51a45360e7516", "hex"), 0),
            keyId: Long("7369462855373946902")
          }
        },
        operationTime: Timestamp({ t: 1715842194, i: 7 })
      }
      

      fsyncUnlock: not authorized

      Enterprise [direct: mongos] admin> db.fsyncUnlock()
      MongoServerError: not authorized on admin to execute command { fsyncUnlock: 1, lsid: { id: UUID("78bf81bf-c068-48df-aeb6-247975662b4f") }, $clusterTime: { clusterTime: Timestamp(1715842194, 7), signature: { hash: BinData(0, 4ACD0115B9A7D848A47E26DA29B51A45360E7516), keyId: 7369462855373946902 } }, $db: "admin" }
      

      This is the permissions I have

      Enterprise [direct: mongos] admin> db.runCommand({connectionStatus:1})
      {
        authInfo: {
          authenticatedUsers: [ { user: 'user', db: 'admin' } ],
          authenticatedUserRoles: [
            { role: 'clusterAdmin', db: 'admin' },
            { role: 'dbAdminAnyDatabase', db: 'admin' },
            { role: 'readWriteAnyDatabase', db: 'admin' },
            { role: 'userAdminAnyDatabase', db: 'admin' }
          ]
        },
        ok: 1,
        '$clusterTime': {
          clusterTime: Timestamp({ t: 1715842194, i: 7 }),
          signature: {
            hash: Binary(Buffer.from("4acd0115b9a7d848a47e26da29b51a45360e7516", "hex"), 0),
            keyId: Long("7369462855373946902")
          }
        },
        operationTime: Timestamp({ t: 1715842194, i: 7 })
      }
      

      I can fsyncLock again to add more locks (lockCount: Long("2"))

      Enterprise [direct: mongos] admin> db.fsyncLock()
      {
        numFiles: 1,
        all: {
          raw: {
            'configRepl/localhost:30007': {
              info: 'now locked against writes, use db.fsyncUnlock() to unlock',
              lockCount: Long("2"),
              seeAlso: 'http://dochub.mongodb.org/core/fsynccommand',
              ok: 1
            },
            'shard01/localhost:30001,localhost:30002,localhost:30003': {
              info: 'now locked against writes, use db.fsyncUnlock() to unlock',
              lockCount: Long("2"),
              seeAlso: 'http://dochub.mongodb.org/core/fsynccommand',
              ok: 1
            },
            'shard02/localhost:30004,localhost:30005,localhost:30006': {
              info: 'now locked against writes, use db.fsyncUnlock() to unlock',
              lockCount: Long("2"),
              seeAlso: 'http://dochub.mongodb.org/core/fsynccommand',
              ok: 1
            }
          }
        },
        ok: 1,
        '$clusterTime': {
          clusterTime: Timestamp({ t: 1715842194, i: 7 }),
          signature: {
            hash: Binary(Buffer.from("4acd0115b9a7d848a47e26da29b51a45360e7516", "hex"), 0),
            keyId: Long("7369462855373946902")
          }
        },
        operationTime: Timestamp({ t: 1715842194, i: 7 })
      }
      

            Assignee:
            Unassigned Unassigned
            Reporter:
            joanna.cheng@mongodb.com Joanna Cheng
            Votes:
            0 Vote for this issue
            Watchers:
            5 Start watching this issue

              Created:
              Updated:
              Resolved: