Skip to content

Get rid of the unnecessary permissions for implicit domains#8937

Open
dyemanov wants to merge 4 commits intomasterfrom
work/8881
Open

Get rid of the unnecessary permissions for implicit domains#8937
dyemanov wants to merge 4 commits intomasterfrom
work/8881

Conversation

@dyemanov
Copy link
Member

This PR addresses some issues spotted in #8881:

  1. Dropping a field / parameter which is based on implicit domain leaves orphan records inside RDB$USER_PRIVILEGES and RDB$SECURITY_CLASSES
  2. No privileges should be assigned to implicit domains created under the hood

…ed (see #8881: Large amount of unnecessary privileges in RDB for SYSDBA)
…AGE permissions (and don't create a security class) for implicit domains (see #8881: Large amount of unnecessary privileges in RDB for SYSDBA).
@dyemanov dyemanov self-assigned this Mar 10, 2026
@aafemt
Copy link
Contributor

aafemt commented Mar 10, 2026

While you are at it, could you also mark implicit domains as system, please?..

@dyemanov
Copy link
Member Author

While you are at it, could you also mark implicit domains as system, please?..

I'm not sure this is correct (and that it will not cause backward compatibility issues).

@aafemt
Copy link
Contributor

aafemt commented Mar 10, 2026

But it would allow to clean out the hack with RDB$ prefix comparison from Firebird code and give users more freedom in domain naming.

@sim1984
Copy link
Contributor

sim1984 commented Mar 10, 2026

In my mind, a system domain is a domain that is used in system tables. You can add the automatically generated domain flag to ods 14.

@aafemt
Copy link
Contributor

aafemt commented Mar 10, 2026

I always read it as "created and maintained by system" in contrast to "created by user".

// second pass
if (alterIndividualParameters)
executeAlterIndividualParameters(tdbb, dsqlScratch, transaction, !altered, true, false);
executeAlterIndividualParameters(tdbb, dsqlScratch, transaction, false, true, false);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry that I did not mention it at once - in that case no reasons to have create parameter in executeAlterIndividualParameters, false is always passed to it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Large amount of unnecessary privileges in RDB$USER_PRIVILEGES for SYSDBA

4 participants