From bcdf0dcc6e259b47e2a8c1171ca3664fb1a1fc2b Mon Sep 17 00:00:00 2001 From: Kseniia Antonova Date: Fri, 21 Aug 2026 16:56:15 +0300 Subject: [PATCH 1/3] Add note about crud read/write permissions --- doc/book/admin/access_control.rst | 60 +++++++++++++++++++++++++++++++ 1 file changed, 60 insertions(+) diff --git a/doc/book/admin/access_control.rst b/doc/book/admin/access_control.rst index 18f5d82219..fd832dbe2a 100644 --- a/doc/book/admin/access_control.rst +++ b/doc/book/admin/access_control.rst @@ -4,6 +4,17 @@ Access control ================================================================================ + +.. NOTE:: + + Starting from crud 1.6.0 (crud-ee 1.7.3), the user on behalf of whom CRUD operations are performed through the router + must be granted privileges to execute CRUD read and write operations. + See the list of minimum required privileges for reading and writing through CRUD + in the :ref:`Minimum set of privileges in typical Tarantool scenarios ` section. + + Without these privileges the user will get an access error when executing CRUD operations. + The error can occur either on the router side or on the storage side, depending on which component cannot access the system space. + This section explains how Tarantool makes it possible for administrators to prevent unauthorized access to the database and to certain functions. @@ -375,3 +386,52 @@ at start of the transaction using :doc:`/reference/reference_lua/box_session/syn To track all connects and disconnects, you can use :ref:`connection and authentication triggers `. + + +.. _authentication-users_minimal_priv: + +-------------------------------------------------------------------------------- +Minimum set of privileges in typical Tarantool scenarios +-------------------------------------------------------------------------------- + +This section provides a list of the minimum required privileges for the following typical Tarantool usage scenarios: + +- :ref:`Reading and writing data with CRUD ` + +.. _authentication-users_minimal_priv-crud_read_write: + +Reading and writing data with CRUD +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +CRUD and vshard modules execute requests on the storage side on behalf of the same user who initiated the request on the +router. +For the correct operation of CRUD methods, the user on behalf of whom requests are made to the cluster through the +router must be granted a minimum set of privileges **on each storage instance**. + +Starting from crud 1.6.0 (crud-ee 1.7.3) the minimum set of privileges for reading and writing data with CRUD looks as follows: + +.. code-block:: lua + + box.schema.user.grant('db_user', 'execute', 'universe') + box.schema.user.grant('db_user', 'read', 'space', '_bucket') + box.schema.user.grant('db_user', 'read', 'space', '_ddl_sharding_key') + +In the example above, the user ``db_user`` is granted the following privileges: + +- `execute` on ``universe`` — executing auxiliary stored procedures on storage instances. + CRUD and vshard modules call internal functions on the storage side, and without the `execute` privilege these calls will be denied; +- `read` on ``_bucket`` — read the bucket map for request routing and checking bucket ownership; +- `read` on ``_ddl_sharding_key`` — read sharding metadata for routing. + +In addition to the privileges for reading system spaces, reading and writing data requires privileges for +reading and writing data in specific user spaces. In the example below the privileges are granted for the `bands` space: + +.. code-block:: lua + + box.schema.user.grant('db_user', 'read,write', 'space', 'bands') + +.. note:: + + Without these privileges the user will get an access error when executing CRUD operations. + The error can occur either on the router side or on the storage side, depending on which component cannot access the system space. + From 325658bc0ebafec3a37d552709cb4e4b072783ee Mon Sep 17 00:00:00 2001 From: Kseniia Antonova Date: Fri, 21 Aug 2026 22:34:17 +0300 Subject: [PATCH 2/3] Add RU file --- .../LC_MESSAGES/book/admin/access_control.po | 113 ++++++++++++++++++ 1 file changed, 113 insertions(+) diff --git a/locale/ru/LC_MESSAGES/book/admin/access_control.po b/locale/ru/LC_MESSAGES/book/admin/access_control.po index b9ed740711..f9fb43faad 100644 --- a/locale/ru/LC_MESSAGES/book/admin/access_control.po +++ b/locale/ru/LC_MESSAGES/book/admin/access_control.po @@ -2,6 +2,32 @@ msgid "Access control" msgstr "Управление доступом" +msgid "" +"Starting from crud 1.6.0 (crud-ee 1.7.3), the user on behalf of whom CRUD " +"operations are performed through the router must be granted privileges to " +"execute CRUD read and write operations. See the list of minimum required " +"privileges for reading and writing through CRUD in the :ref:`Minimum set of " +"privileges in typical Tarantool scenarios `" +" section." +msgstr "" +"Начиная с версии crud 1.6.0 (crud-ee 1.7.3), перед началом работы для " +"пользователя, от имени которого выполняются CRUD-операции через роутер, " +"необходимо задать права на выполнение CRUD-операций чтения и записи данных. " +"Список минимально необходимых разрешений для чтения и записи через CRUD " +"приведен в разделе :ref:`Минимальный набор разрешений в типовых сценариях " +"Tarantool `." + + +msgid "" +"Without these privileges the user will get an access error when executing " +"CRUD operations. The error can occur either on the router side or on the " +"storage side, depending on which component cannot access the system space." +msgstr "" +"Без указанных выше прав пользователь получит ошибку доступа при выполнении " +"CRUD-операций. Ошибка может возникать как на стороне роутера, так и на " +"стороне хранилища, в зависимости от того, какой компонент не может получить " +"доступ к системному спейсу." + msgid "" "This section explains " "how Tarantool makes it possible for administrators to prevent unauthorized " @@ -746,3 +772,90 @@ msgid "" msgstr "" "Чтобы отследить все подключения и отключения, можно использовать " ":ref:`триггеры соединений и аутентификации `." + +msgid "Minimum set of privileges in typical Tarantool scenarios" +msgstr "Минимальный набор разрешений в типовых сценариях Tarantool" + +msgid "" +"This section provides a list of the minimum required privileges for the " +"following typical Tarantool usage scenarios:" +msgstr "" +"В этом разделе приведен список минимально необходимых разрешений для " +"следующих типовых сценариев работы с Tarantool:" + +msgid "Reading and writing data with CRUD" +msgstr "Чтение и запись данных через модуль CRUD" + +msgid "Reading and writing data with CRUD" +msgstr "Чтение и запись данных через модуль CRUD" + +msgid "" +"CRUD and vshard modules execute requests on the storage side on behalf of " +"the same user who initiated the request on the router. For the correct " +"operation of CRUD methods, the user on behalf of whom requests are made to " +"the cluster through the router must be granted a minimum set of privileges " +"**on each storage instance**." +msgstr "" +"Модули CRUD и vshard выполняют запросы на стороне хранилища от имени того " +"же пользователя, который инициировал запрос на роутере. Для корректной " +"работы методов CRUD пользователю, от имени которого выполняются обращения " +"к кластеру через роутер, необходимо предоставить минимальный набор прав " +"**на каждом экземпляре хранилища**." + +msgid "" +"Starting from crud 1.6.0 (crud-ee 1.7.3) the minimum set of privileges for " +"reading and writing data with CRUD looks as follows:" +msgstr "" +"Начиная с версии crud 1.6.0 (crud-ee 1.7.3) минимальный набор прав для " +"чтения и записи данных через модуль CRUD выглядит так:" + +msgid "" +"In the example above, the user ``db_user`` is granted the following " +"privileges:" +msgstr "" +"В примере выше пользователю ``db_user`` выданы следующие разрешения:" + +msgid "" +"- `execute` on ``universe`` - executing auxiliary stored procedures on " +"storage instances. CRUD and vshard modules call internal functions on the " +"storage side, and without the ``execute`` privilege these calls will be denied;" +msgstr "" +"- `execute` на ``universe`` - выполнение служебных хранимых процедур на " +"узлах хранилища. Модули CRUD и vshard вызывают внутренние функции на " +"стороне хранилища, и без права ``execute`` эти вызовы будут отклонены;" + + +msgid "" +"- `read` on ``_bucket`` - read the bucket map for request routing and " +"checking bucket ownership;" +msgstr "" +"- `read` на ``_bucket`` - чтение карты сегментов для маршрутизации запросов " +"и проверки принадлежности сегмента;" + +msgid "" +"- `read` on ``_ddl_sharding_key`` - read sharding metadata for routing." +msgstr "" +"- `read` на ``_ddl_sharding_key`` - чтение метаданных шардирования для " +"маршрутизации." + +msgid "" +"In addition to the privileges for reading system spaces, reading and writing " +"data requires privileges for reading and writing data in specific user " +"spaces. In the example below the privileges are granted for the `bands` " +"space:" +msgstr "" +"В дополнение к правам на чтение системных спейсов, для чтения и записи " +"данных пользователю требуются права на чтение и запись данных в конкретные " +"пользовательские спейсы. В примере ниже права выданы на спейс `bands`:" + +msgid "" +"Without these privileges the user will get an access error when executing " +"CRUD operations. The error can occur either on the router side or on the " +"storage side, depending on which component cannot access the system space." +msgstr "" +"Без указанных выше прав пользователь получит ошибку доступа при выполнении " +"CRUD-операций. Ошибка может возникать как на стороне роутера, так и на " +"стороне хранилища, в зависимости от того, какой компонент не может получить " +"доступ к системному спейсу." + + From b1b40eed91af6db75ba82b32316cb004e75e0072 Mon Sep 17 00:00:00 2001 From: "m.lichko" Date: Mon, 24 Aug 2026 17:46:49 +0300 Subject: [PATCH 3/3] correcions for access control crud --- doc/book/admin/access_control.rst | 111 +++++++++++++++++++++++++----- 1 file changed, 92 insertions(+), 19 deletions(-) diff --git a/doc/book/admin/access_control.rst b/doc/book/admin/access_control.rst index fd832dbe2a..26cde893c3 100644 --- a/doc/book/admin/access_control.rst +++ b/doc/book/admin/access_control.rst @@ -12,8 +12,11 @@ Access control See the list of minimum required privileges for reading and writing through CRUD in the :ref:`Minimum set of privileges in typical Tarantool scenarios ` section. - Without these privileges the user will get an access error when executing CRUD operations. - The error can occur either on the router side or on the storage side, depending on which component cannot access the system space. + Without these privileges, the user will get an access error when executing CRUD operations. + The error can occur either on the router side or on the storage side, depending on which component lacks the required permissions. + For example, the error may be caused by missing access to routing metadata, + missing ``read``/ ``write`` privileges for the target user space, or missing ``execute`` privileges to call the required ``crud.*`` methods on the router. + This section explains how Tarantool makes it possible for administrators to prevent unauthorized access to the database and to certain functions. @@ -403,35 +406,105 @@ This section provides a list of the minimum required privileges for the followin Reading and writing data with CRUD ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -CRUD and vshard modules execute requests on the storage side on behalf of the same user who initiated the request on the -router. +CRUD passes the name of the user who initiated the operation on the router to the storage side. +The internal call is performed via the vshard service user, +after which CRUD switches to the forwarded user and executes the operation with that user’s privileges. + For the correct operation of CRUD methods, the user on behalf of whom requests are made to the cluster through the router must be granted a minimum set of privileges **on each storage instance**. -Starting from crud 1.6.0 (crud-ee 1.7.3) the minimum set of privileges for reading and writing data with CRUD looks as follows: +Starting from crud 1.6.0, grant the user the required privileges on +the user spaces and, if applicable, on the DDL sharding metadata spaces. -.. code-block:: lua +Starting from crud 1.7.0, also grant the user the ``read`` privilege +on the ``_bucket`` space. + +Router-side privileges +^^^^^^^^^^^^^^^^^^^^^^ + +It is **not recommended** to grant an application user the ``execute`` privilege on universe, +because it allows executing arbitrary Lua code and significantly broadens the user’s permissions. +Instead, grant execute narrowly — only for the required ``crud.*`` methods invoked via ``lua_call``: + +.. code-block:: yaml - box.schema.user.grant('db_user', 'execute', 'universe') - box.schema.user.grant('db_user', 'read', 'space', '_bucket') - box.schema.user.grant('db_user', 'read', 'space', '_ddl_sharding_key') + credentials: + users: + db_user: + password: 'secret' + privileges: + - permissions: [execute] + lua_call: + - crud.select + - crud.get + - crud.insert + - crud.replace + - crud.update + - crud.upsert + - crud.delete -In the example above, the user ``db_user`` is granted the following privileges: -- `execute` on ``universe`` — executing auxiliary stored procedures on storage instances. - CRUD and vshard modules call internal functions on the storage side, and without the `execute` privilege these calls will be denied; -- `read` on ``_bucket`` — read the bucket map for request routing and checking bucket ownership; -- `read` on ``_ddl_sharding_key`` — read sharding metadata for routing. +Storage-side privileges +^^^^^^^^^^^^^^^^^^^^^^^ -In addition to the privileges for reading system spaces, reading and writing data requires privileges for -reading and writing data in specific user spaces. In the example below the privileges are granted for the `bands` space: +The minimum set of privileges on a storage instance depends on the enabled functionality and the CRUD version. +To read and write data, the user must have read and write access to the target user spaces, for example, the ``bands`` space: .. code-block:: lua box.schema.user.grant('db_user', 'read,write', 'space', 'bands') -.. note:: +**Access to routing-related system spaces** + +* Read access to ``_bucket`` — starting from CRUD 1.7.0, storage-side operations ``bucket_ref``/ ``bucket_unref`` require it to verify the bucket state and ownership. +* If DDL-based routing metadata is used, ``read`` access to ``_ddl_sharding_key`` and ``_ddl_sharding_func`` is required. + + .. note:: + + Privileges for DDL sharding metadata are required only in configurations where + CRUD routing relies on metadata stored in DDL. + + CRUD loads sharding metadata from the system spaces + ``_ddl_sharding_key`` and ``_ddl_sharding_func``: - Without these privileges the user will get an access error when executing CRUD operations. - The error can occur either on the router side or on the storage side, depending on which component cannot access the system space. + * ``_ddl_sharding_key`` — sharding key metadata; + * ``_ddl_sharding_func`` — user-defined sharding function metadata. + + If the cluster uses a user-defined sharding function, you need to grant + read access to both spaces. + + .. code-block:: lua + + box.schema.user.grant('db_user', 'read', 'space', '_ddl_sharding_key') + box.schema.user.grant('db_user', 'read', 'space', '_ddl_sharding_func') + +An example of configuring storage-side privileges via YAML: + +.. code-block:: YAML + + credentials: + users: + db_user: + password: 'secret' + privileges: + - permissions: [read] + spaces: [_bucket] + - permissions: [read] + spaces: [_ddl_sharding_key, _ddl_sharding_func] + - permissions: [read, write] + spaces: [bands] + + +Internal vshard/CRUD calls on storage +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +In some configurations (in particular, on Tarantool 2.x or when privileges are configured manually), +internal calls on storage may require the ``execute`` privilege for a set of service functions ``vshard.storage.*`` (``setuid``). +Granting ``execute`` on ``universe`` is not recommended. + +.. note:: + Without these privileges, the user will get an access error when executing CRUD operations. + The error can occur either on the router side or on the storage side, depending on which component lacks the required permissions. + For example, the error may be caused by missing access to routing metadata, + missing ``read``/``write`` privileges for the target user space, or missing ``execute`` privileges to call the required ``crud.*`` methods on the router.