*: Add security enhanced mode part 3 #24412

morgo · 2021-05-04T19:25:58Z

What problem does this PR solve?

This implements the third of presumably 4 PRs

What is changed and how it works?

Proposal: https://github.com/pingcap/tidb/blob/master/docs/design/2021-03-09-security-enhanced-mode.md

What's Changed:

This adds the concept of "RESTRICTED" system variables, which can not be read or written to be any users unless they have the RESTRICTED_VARIABLES_ADMIN privilege.

It follows the design of the spec, although the implementation is sligthtly different to my original plan. I had planned to unregister the variables when SEM is enabled, but this is likely to cause compatibility issues for packages that expect variables to be present (such as telemetry). The implementation used modifies the places in the code where variables can be read or written to insert a privilege check.

Related changes

First PR *: add security enhanced mode part 1 #23978
Second PR *: add security enhanced mode part 2 #24279

Check List

Tests

Unit test
Integration test

Side effects

Increases code complexity
Breaking backward compatibility (when enabled; by default it is backward compatible)

Release note

The 'Security Enhanced Mode' has been introduced. When enabled, it prevents users with the SUPER privilege from performing certain high risk operations. The design is inspired by Security Enhanced (SE) Linux and AppArmor.

morgo · 2021-05-04T19:26:43Z

docs/design/2021-03-09-dynamic-privileges.md

@@ -238,7 +238,7 @@ No change

 | Privilege Name | Description | Notes |
 | --------------- | --------------- | --------------- |
-| `RESTRICTED_SYSTEM_VARIABLES_ADMIN` | Allows changing a restricted `GLOBAL` system variable. | Currently in SEM all high risk variables are unloaded. TBD, it might be required in future that they are only visible/settable to those with this privilege and not SUPER. |
+| `RESTRICTED_VARIABLES_ADMIN` | Allows changing a restricted `GLOBAL` system variable. | Currently in SEM all high risk variables are unloaded. TBD, it might be required in future that they are only visible/settable to those with this privilege and not SUPER. |


This change was neccesary because dynamic privileges are limited to 32 chars. If we change this, we break MySQL compatibility.

morgo · 2021-05-04T19:51:37Z

/run-all-tests

purelind · 2021-05-06T02:57:19Z

/run-all-tests

bb7133 · 2021-05-10T16:49:54Z

/lgtm

bb7133 · 2021-05-10T16:50:01Z

Please resolve the conflicts.

morgo · 2021-05-10T18:53:30Z

/run-all-tests

tiancaiamao · 2021-05-17T04:26:54Z

/LGTM

ti-chi-bot · 2021-05-17T04:26:57Z

[REVIEW NOTIFICATION]

This pull request has been approved by:

bb7133
tiancaiamao

To complete the pull request process, please ask the reviewers in the list to review by filling /cc @reviewer in the comment.
After your PR has acquired the required number of LGTMs, you can assign this pull request to the committer in the list by filling /assign @committer in the comment to help you merge this pull request.

The full list of commands accepted by this bot can be found here.

Reviewer can indicate their review by writing /lgtm in a comment.
Reviewer can cancel approval by writing /lgtm cancel in a comment.

morgo · 2021-05-17T04:34:03Z

/merge

ti-chi-bot · 2021-05-17T04:34:07Z

This pull request has been accepted and is ready to merge.

Commit hash: 56aff62

ti-chi-bot · 2021-05-17T04:34:16Z

@morgo: Your PR was out of date, I have automatically updated it for you.

At the same time I will also trigger all tests for you:

/run-all-tests

If the CI test fails, you just re-trigger the test that failed and the bot will merge the PR for you after the CI passes.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the ti-community-infra/tichi repository.

morgo · 2021-05-17T04:40:51Z

/run-e2e-test

morgo · 2021-05-17T04:43:51Z

/run-e2e-test

…ingcap#24052) * *: fix revoke statement for CURRENT_USER() and refine error message planner: support set tidb_allow_mpp to `2` or `ENFORCE` to enforce use mpp mode. (pingcap#24516) store/tikv: remove use of SchemaAmender option in store/tikv (pingcap#24408) *: the value of tikv-client.store-liveness-timeout should not less than 0 (pingcap#24244) store/tikv: remove use of EnableAsyncCommit option in store/tikv (pingcap#24462) txn: Add txn state's view (pingcap#22908) planner: ignore lock for temporary table of PointGet and BatchPointGet (pingcap#24540) store/tikv: remove use of ReplicaRead transaction option in store/tikv (pingcap#24409) store/driver: move error to single package (pingcap#24549) ddl: add check table compatibility for temporary table (pingcap#24501) store/tikv: remove use of IsStatenessReadOnly option in store/tikv (pingcap#24464) store/tikv: change backoff type for missed tiflash peer. (pingcap#24577) store/tikv: remove use of MatchStoreLabels transaction option in store/tikv (pingcap#24465) executor, meta: Allocate auto id for global temporary tables (pingcap#24506) store/tikv: remove use of SampleStep option in store/tikv (pingcap#24461) executor: add partition pruning tests for adding and dropping partition operations (pingcap#24573) ddl: forbid partition on temporary mode before put into queue (pingcap#24565) ddl: speedup test case TestIndexOnMultipleGeneratedColumn (pingcap#24487) execution: Fix issue 24439 Inconsistent error with MySQL for GRANT CREATE USER ON <specific db>.* (pingcap#24485) *: fix errcheck (pingcap#24463) test: make TestExtractStartTs stable (pingcap#24585) ddl: forbid recover/flashback temporary tables (pingcap#24518) executor: fix point_get result on clustered index when new-row-format disabled but new-collation enabled (pingcap#24544) executor: Improve the performance of appending not fixed columns (pingcap#20969) *: typo fix (pingcap#24564) planner/core: refresh stale regions in cache for batch cop response (pingcap#24457) binlog: DML on temporary tables do not write binlog (pingcap#24570) store/tikv: remove use of GuaranteeLinearizability option in store/tikv (pingcap#24605) store/tikv: remove use of CollectRuntimeStats option in store/tikv (pingcap#24604) store/tikv: move Backoffer into a single package (pingcap#24525) variables: init cte max recursive deeps in a new session (pingcap#24609) store/tikv: move transaction options out to /kv (pingcap#24619) store/driver: move backoff driver into single package so we can use i… (pingcap#24624) server: close the temporary session in HTTP API to avoid memory leak (pingcap#24339) store/tikv: use latest PD TS plus one as min commit ts (pingcap#24579) planner: fix incorrect TableDual plan built from nulleq (pingcap#24596) ranger: fix the case which could have duplicate ranges (pingcap#24590) executor, store: Pass the SQL digest down to pessimistic lock request (pingcap#24380) kv: remove UnionStore interface (pingcap#24625) *: enable gosimple linter (pingcap#24617) txn: avoid the gc resolving pessimistic locks of ongoing transactions (pingcap#24601) util: fix wrong enum building for index range (pingcap#24632) sessionctx: change innodb large prefix default (pingcap#24555) store: fix data race about KVStore.tikvClient (pingcap#24655) executor, privileges: Add dynamic privileges to SHOW PRIVILEGES (pingcap#24646) ddl: refactor rule [4/6] (pingcap#24007) cmd: ddl_test modify retryCnt from 5 to 20 (pingcap#24662) executor: add correctness tests about direct reading with ORDER BY and LIMIT (pingcap#24455) store/tikv: remove options from unionstore (pingcap#24629) planner: fix wrongly check for update statement (pingcap#24614) store/tikv: remove CompareTS (pingcap#24657) planner, privilege: Add security enhanced mode part 4 (pingcap#24416) executor: add some test cases about partition table dynamic-mode with split-region (pingcap#24665) planner: fix wrong column offsets when processing dynamic pruning for IndexJoin (pingcap#24659) *: Add security enhanced mode part 3 (pingcap#24412) store/tikv: resolve ReplicaReadType dependencies (pingcap#24653) executor: add test cases about partition table with `expression` (pingcap#24628) tablecodec: fix write wrong prefix index value when collation is ascii_bin/latin1_bin (pingcap#24578) *: compatibility with staleread (pingcap#24285) session: test that temporary tables will also be retried (pingcap#24505) domain, session: Add new sysvarcache to replace global values cache (pingcap#24359) ddl, transaction: DDL on temporary tables won't affect transactions (pingcap#24534) *: implement tidb_bounded_staleness built-in function (pingcap#24328) executor: add correctness tests for partition table with different joins (pingcap#24673) expression: fix the spelling of word arithmetical (pingcap#24713) store/copr: balance region for batch cop task (pingcap#24521) store, metrics: Add metrics for safetTS updating (pingcap#24687) sem: add tidbredact log to restricted variables (pingcap#24701) session: fix dml_batch_size doesn't load the global variable (pingcap#24710) store/tikv: retry TSO RPC (pingcap#24682) expression, planner: push cast down to control function with enum type. (pingcap#24542) executor: add correctness tests about IndexMerge (pingcap#24674) variable: change default for DefDMLBatchSize tidbOptInt64 call (pingcap#24697) planner: add partitioning pruning tests for range partitioning (pingcap#24554) *: add option for enum push down (pingcap#24685) txn: break dependency from store/tikv to tidb/kv cause by TransactionOption (pingcap#24656) executor: enhancement for ListInDisk(support writing after reading) (pingcap#24379) kv: move TxnScope into kv (pingcap#24715) execution: fix the incorrect use of cached plan for point get (pingcap#24749) executor: add correctness tests about direct reading with indexJoin (pingcap#24497) variable: fix sysvar datarace with deep copy (pingcap#24732) *: Implementing RENAME USER (pingcap#24413) infoschema, executor: Add the deadlock table (pingcap#24524) docs: Some proposal for renaming and configurations for Lock View (pingcap#24718) planner: add range partition boundaries tests with BETWEEN expression (pingcap#24598) oracle: simplify timestamp utilities (pingcap#24688) executor: fix wrong enum key in point get (pingcap#24618) ranger: fix incorrect enum range for xxx_ci collation (pingcap#24661) executor: add some test cases about dynamic-mode and apply operator (pingcap#24683) store/tikv: remove Variables.Hook (pingcap#24758) ddl: speed up the execution time of `TestBackwardCompatibility`. (pingcap#24704) *: prepare errors for CTE (pingcap#24763) expression: support cast real/int as real (pingcap#24670) executor: add table name in log (pingcap#24666) expression: add builtin function ``json_pretty`` (pingcap#24675) ddl: make `TestDropLastVisibleColumns` stable (pingcap#24790) * ddl: make `TestDropLastVisibleColumns` stable *: support AS OF TIMESTAMP read-only begin statement (pingcap#24740) executor: Fix unstable TestTiDBLastTxnInfoCommitMode (pingcap#24779) planner: add tests for partition range boundaries for LT/GT (pingcap#24574) test: record random seed in TestIssue20658 (pingcap#24782) store/tikv/retry: define Config instead of BackoffType (pingcap#24692) config: ignore tiflash when show config (pingcap#24770) privileges: improve dynamic privs registration and tests (pingcap#24773) README: remove the link of TiDB Monthly Update (pingcap#24791) region_cache: filter peers on tombstone or dropped stores (pingcap#24726) util/stmtsummary: remove import package tikv (pingcap#24776) ddl: grammar check for create unsupported temporary table (pingcap#24723) *: update go.etcd.io/bbolt (pingcap#24799) ddl: speed up the execution time of `ddl test` and `Test Chunk pingcap#7 ddl-other` (pingcap#24780) executor: remove the unnecessary use of fmt.Sprintf (pingcap#24815) executor: fix index join panic on prefix index on some cases (pingcap#24568)

*: Add security enhanced mode part 3

83f14bf

morgo requested review from a team as code owners May 4, 2021 19:25

morgo requested review from wshwsh12 and hanfei1991 and removed request for a team May 4, 2021 19:25

ti-chi-bot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label May 4, 2021

morgo commented May 4, 2021

View reviewed changes

github-actions bot added the sig/execution SIG execution label May 4, 2021

morgo added the sig/sql-infra SIG: SQL Infra label May 4, 2021

Change to usei visitInfo

7e95d24

morgo mentioned this pull request May 5, 2021

planner, privilege: Add security enhanced mode part 4 #24416

Merged

ti-chi-bot added status/LGT1 Indicates that a PR has LGTM 1. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels May 10, 2021

Merge remote-tracking branch 'upstream/master' into security-enhanced-3

e7b33cd

ti-chi-bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label May 10, 2021

ti-chi-bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label May 12, 2021

Merge remote-tracking branch 'upstream/master' into security-enhanced-3

b368124

morgo force-pushed the security-enhanced-3 branch from af35876 to b368124 Compare May 13, 2021 02:26

ti-chi-bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label May 13, 2021

morgo requested a review from tiancaiamao May 17, 2021 01:55

morgo added 3 commits May 16, 2021 20:20

Merge branch 'master' into security-enhanced-3

628d782

fix merge

580274b

Merge remote-tracking branch 'upstream/master' into security-enhanced-3

56aff62

ti-chi-bot added status/LGT2 Indicates that a PR has LGTM 2. and removed status/LGT1 Indicates that a PR has LGTM 1. labels May 17, 2021

ti-chi-bot added the status/can-merge Indicates a PR has been approved by a committer. label May 17, 2021

Merge branch 'master' into security-enhanced-3

c569126

ti-chi-bot merged commit 8ad868f into pingcap:master May 17, 2021

morgo deleted the security-enhanced-3 branch May 17, 2021 04:46

morgo mentioned this pull request May 19, 2021

Add documentation for SEM pingcap/docs#5647

Merged

10 tasks

djshow832 mentioned this pull request Mar 8, 2022

@@hostname always shows localhost #32918

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

*: Add security enhanced mode part 3 #24412

*: Add security enhanced mode part 3 #24412

morgo commented May 4, 2021

morgo May 4, 2021

morgo commented May 4, 2021

purelind commented May 6, 2021

bb7133 commented May 10, 2021

bb7133 commented May 10, 2021

morgo commented May 10, 2021

tiancaiamao commented May 17, 2021

ti-chi-bot commented May 17, 2021

morgo commented May 17, 2021

ti-chi-bot commented May 17, 2021

ti-chi-bot commented May 17, 2021

morgo commented May 17, 2021

morgo commented May 17, 2021

*: Add security enhanced mode part 3 #24412

*: Add security enhanced mode part 3 #24412

Conversation

morgo commented May 4, 2021

What problem does this PR solve?

What is changed and how it works?

Related changes

Check List

Release note

morgo May 4, 2021

Choose a reason for hiding this comment

morgo commented May 4, 2021

purelind commented May 6, 2021

bb7133 commented May 10, 2021

bb7133 commented May 10, 2021

morgo commented May 10, 2021

tiancaiamao commented May 17, 2021

ti-chi-bot commented May 17, 2021

morgo commented May 17, 2021

ti-chi-bot commented May 17, 2021

ti-chi-bot commented May 17, 2021

morgo commented May 17, 2021

morgo commented May 17, 2021