Skip to content

Commit 2b7f6be

Browse files
ArneTRArneTR
committed
Updated permissions SQL for all users in cluster
1 parent 45d93fc commit 2b7f6be

1 file changed

Lines changed: 182 additions & 68 deletions

File tree

‎content/en/docs/cluster/security.md‎

Lines changed: 182 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,89 @@ In the default installation one user is installed for the database and also for
1212

1313
In a cluster installation we recommend restricting both.
1414

15+
16+
### Creating a server user
17+
18+
The API / Dashboard should run on a separate instance and the user should have no insert or update permissions for runs and also some other restrictions.
19+
20+
```sql
21+
REVOKE ALL PRIVILEGES ON DATABASE "green-coding" FROM server;
22+
REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA public FROM server;
23+
REVOKE ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public FROM server;
24+
REVOKE ALL PRIVILEGES ON ALL FUNCTIONS IN SCHEMA public FROM server;
25+
26+
GRANT DELETE ON
27+
jobs,
28+
system_logs,
29+
watchlist
30+
TO server;
31+
32+
GRANT INSERT ON
33+
hog_simplified_measurements
34+
ci_measurements,
35+
jobs,
36+
watchlist,
37+
carbondb_data_raw,
38+
ip_data,
39+
hog_top_processes,
40+
client_status,
41+
carbon_intensity,
42+
system_logs,
43+
TO server;
44+
45+
GRANT USAGE, SELECT ON SEQUENCE hog_simplified_measurements_id_seq to SERVER;
46+
GRANT USAGE, SELECT ON SEQUENCE ci_measurements_id_seq to SERVER;
47+
GRANT USAGE, SELECT ON SEQUENCE jobs_id_seq to SERVER;
48+
GRANT USAGE, SELECT ON SEQUENCE watchlist_id_seq to SERVER;
49+
GRANT USAGE, SELECT ON SEQUENCE carbondb_data_raw_id_seq to SERVER;
50+
GRANT USAGE, SELECT ON SEQUENCE ip_data_id_seq to SERVER;
51+
GRANT USAGE, SELECT ON SEQUENCE hog_top_processes_id_seq to SERVER;
52+
GRANT USAGE, SELECT ON SEQUENCE client_status_id_seq to SERVER;
53+
GRANT USAGE, SELECT ON SEQUENCE carbon_intensity to SERVER;
54+
GRANT USAGE, SELECT ON SEQUENCE system_logs to SERVER;
55+
56+
GRANT SELECT (id, type, state, name, url, branch, filename, category_ids, machine_id, message, created_at, updated_at, user_id, usage_scenario_variables, run_id, commit_hash, carbon_simulation) ON TABLE jobs to server; -- no email
57+
GRANT SELECT (id, branch, carbon_simulation, category_ids, created_at, filename, image_url, last_marker, last_scheduled, machine_id, name, repo_url, schedule_mode, updated_at, usage_scenario_variables, user_id) ON watchlist TO server; -- no email
58+
59+
GRANT SELECT ON
60+
hog_simplified_measurements,
61+
runs,
62+
machines,
63+
ci_measurements,
64+
software_tasks,
65+
users,
66+
softwares,
67+
ip_data,
68+
network_intercepts,
69+
hog_top_processes,
70+
optimizations,
71+
phase_stats,
72+
carbon_intensity,
73+
client_status,
74+
notes,
75+
cluster_status_messages,
76+
system_logs,
77+
carbondb_data_raw,
78+
carbondb_data,
79+
carbondb_machines,
80+
carbondb_projects,
81+
carbondb_sources,
82+
carbondb_tags,
83+
carbondb_types,
84+
warnings,
85+
categories,
86+
cluster_changelog,
87+
measurement_metrics,
88+
measurement_values
89+
TO server;
90+
91+
GRANT UPDATE (archived, branch, category_ids, commit_hash, commit_timestamp, container_dependencies, containers, created_at, end_measurement, failed, filename, gmt_hash, id, job_id, logs, machine_id, machine_specs, measurement_config, name, note, phases, public, relations, runner_arguments, start_measurement, updated_at, uri, usage_scenario, usage_scenario_variables, user_id) ON runs TO server;
92+
GRANT UPDATE (available, base_temperature, configuration, cooldown_time_after_job, created_at, current_temperature, description, gmt_hash, gmt_timestamp, id, jobs_processing, needs_revalidation, status_code, updated_at) ON machines TO server;
93+
GRANT UPDATE (run_id, state, updated_at) ON jobs TO server;
94+
GRANT UPDATE (last_marker, last_scheduled, updated_at) ON watchlist TO server;
95+
GRANT UPDATE (capabilities, docker_credentials, ssh_private_key) ON users TO server;
96+
```
97+
1598
### Creating a management user for delete operations
1699

17100
We recommend having the default user active for the API to only have *SELECT* and *INSERT* operations.
@@ -28,39 +111,61 @@ REVOKE ALL PRIVILEGES ON ALL FUNCTIONS IN SCHEMA public FROM manager;
28111

29112
GRANT TEMPORARY ON DATABASE "green-coding" TO manager;
30113

114+
GRANT DELETE ON carbondb_data_raw TO manager;
31115

32-
GRANT USAGE, SELECT ON SEQUENCE carbondb_types_id_seq TO manager;
33-
GRANT SELECT, INSERT ON TABLE carbondb_types TO manager;
116+
GRANT INSERT ON carbon_intensity TO manager;
117+
GRANT INSERT ON carbondb_data TO manager;
118+
GRANT INSERT ON carbondb_data_raw TO manager;
119+
GRANT INSERT ON carbondb_machines TO manager;
120+
GRANT INSERT ON carbondb_projects TO manager;
121+
GRANT INSERT ON carbondb_sources TO manager;
122+
GRANT INSERT ON carbondb_tags TO manager;
123+
GRANT INSERT ON carbondb_types TO manager;
124+
GRANT INSERT ON ip_data TO manager;
125+
GRANT INSERT ON jobs TO manager;
126+
GRANT INSERT ON system_logs TO manager;
34127

35-
GRANT USAGE, SELECT ON SEQUENCE carbondb_machines_id_seq TO manager;
36-
GRANT SELECT, INSERT ON TABLE carbondb_machines TO manager;
37-
38-
GRANT USAGE, SELECT ON SEQUENCE carbondb_tags_id_seq TO manager;
39-
GRANT SELECT, INSERT ON TABLE carbondb_tags TO manager;
40128

129+
GRANT USAGE, SELECT ON SEQUENCE carbondb_data_id_seq TO manager;
130+
GRANT USAGE, SELECT ON SEQUENCE carbondb_data_raw_id_seq TO manager;
131+
GRANT USAGE, SELECT ON SEQUENCE carbondb_machines_id_seq TO manager;
41132
GRANT USAGE, SELECT ON SEQUENCE carbondb_projects_id_seq TO manager;
42-
GRANT SELECT, INSERT ON TABLE carbondb_projects TO manager;
43-
44133
GRANT USAGE, SELECT ON SEQUENCE carbondb_sources_id_seq TO manager;
45-
GRANT SELECT, INSERT ON TABLE carbondb_sources TO manager;
46-
47-
GRANT USAGE, SELECT ON SEQUENCE carbondb_data_raw_id_seq TO manager;
48-
GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE carbondb_data_raw TO manager;
49-
50-
GRANT USAGE, SELECT ON SEQUENCE carbondb_data_id_seq TO manager;
51-
GRANT SELECT, INSERT, UPDATE ON TABLE carbondb_data TO manager;
52-
53-
GRANT SELECT ON TABLE ci_measurements TO manager;
54-
55-
GRANT SELECT ON TABLE runs TO manager;
56-
57-
GRANT SELECT ON TABLE phase_stats TO manager;
58-
59-
GRANT SELECT ON TABLE machines TO manager;
134+
GRANT USAGE, SELECT ON SEQUENCE carbondb_tags_id_seq TO manager;
135+
GRANT USAGE, SELECT ON SEQUENCE carbondb_types_id_seq TO manager;
136+
GRANT USAGE, SELECT ON SEQUENCE ip_data_id_seq TO manager;
137+
GRANT USAGE, SELECT ON SEQUENCE jobs_id_seq TO manager;
138+
GRANT USAGE, SELECT ON SEQUENCE system_logs_id_seq TO manager;
139+
140+
GRANT SELECT ON carbon_intensity TO manager;
141+
GRANT SELECT ON carbondb_data TO manager;
142+
GRANT SELECT ON carbondb_data_raw TO manager;
143+
GRANT SELECT ON carbondb_machines TO manager;
144+
GRANT SELECT ON carbondb_projects TO manager;
145+
GRANT SELECT ON carbondb_sources TO manager;
146+
GRANT SELECT ON carbondb_tags TO manager;
147+
GRANT SELECT ON carbondb_types TO manager;
148+
GRANT SELECT ON categories TO manager;
149+
GRANT SELECT ON ci_measurements TO manager;
150+
GRANT SELECT ON hog_simplified_measurements TO manager;
151+
GRANT SELECT ON ip_data TO manager;
152+
GRANT SELECT ON jobs TO manager;
153+
GRANT SELECT ON machines TO manager;
154+
GRANT SELECT ON measurement_metrics TO manager;
155+
GRANT SELECT ON phase_stats TO manager;
156+
GRANT SELECT ON runs TO manager;
157+
GRANT SELECT ON users TO manager;
158+
GRANT SELECT ON warnings TO manager;
159+
160+
161+
GRANT UPDATE ON public.carbondb_data TO manager;
162+
GRANT UPDATE ON public.carbondb_data_raw TO manager;
163+
GRANT UPDATE ON public.carbondb_machines TO manager;
164+
GRANT UPDATE ON public.carbondb_projects TO manager;
165+
GRANT UPDATE ON public.carbondb_sources TO manager;
166+
GRANT UPDATE ON public.carbondb_tags TO manager;
167+
GRANT UPDATE ON public.carbondb_types TO manager;
60168

61-
-- to insert errors
62-
GRANT USAGE, SELECT ON SEQUENCE jobs_new_id_seq TO manager;
63-
GRANT SELECT, INSERT ON TABLE jobs TO manager;
64169
```
65170

66171
To complement the configuration you need also have a different `config.yml` file present to read the credentials from.
@@ -95,50 +200,59 @@ We recommend NOT to have SMTP credentials on the machines and also connect to th
95200

96201
```sql
97202
CREATE USER client WITH PASSWORD 'YOUR_PASSWORD';
98-
REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA public FROM client;
99-
100-
GRANT SELECT ON TABLE runs TO client; -- only needs a full select if optimizations are run on the measurement machines. Otherwise can be locked down
101-
102-
GRANT INSERT ON TABLE runs TO client;
103-
GRANT UPDATE(start_measurement, end_measurement, phases, logs, machine_id, machine_specs, measurement_config, usage_scenario, gmt_hash, invalid_run, failed, usage_scenario_dependencies) ON TABLE runs TO client;
104-
105-
GRANT SELECT, INSERT, UPDATE ON TABLE machines TO client;
106-
107-
GRANT INSERT on TABLE optimizations to client;
108-
GRANT USAGE, SELECT ON SEQUENCE optimizations_id_seq TO client;
109-
GRANT SELECT on TABLE optimizations to client;
110203

111-
GRANT SELECT on TABLE categories to client;
112-
GRANT SELECT on TABLE notes to client;
113-
GRANT SELECT on TABLE network_intercepts to client;
114204

115-
GRANT SELECT,INSERT,DELETE ON TABLE jobs TO client;
116-
GRANT USAGE, SELECT ON SEQUENCE jobs_id_seq TO client;
117-
GRANT UPDATE(state) ON TABLE jobs TO client;
118-
119-
GRANT SELECT,INSERT ON TABLE client_status TO client;
120-
GRANT USAGE, SELECT ON SEQUENCE client_status_id_seq TO client;
121-
122-
GRANT SELECT(id) ON TABLE network_intercepts TO client;
123-
GRANT INSERT ON TABLE network_intercepts TO client;
124-
GRANT USAGE, SELECT ON SEQUENCE network_intercepts_id_seq TO client;
125-
126-
GRANT SELECT, INSERT ON TABLE measurements TO client;
127-
GRANT USAGE, SELECT ON SEQUENCE stats_id_seq TO client;
128-
129-
GRANT INSERT ON TABLE notes TO client;
130-
GRANT USAGE, SELECT ON SEQUENCE notes_id_seq TO client;
131-
132-
GRANT SELECT,INSERT ON TABLE phase_stats TO client;
133-
GRANT USAGE, SELECT ON SEQUENCE phase_stats_id_seq TO client;
134-
135-
GRANT INSERT on changelog to client;
136-
GRANT SELECT, USAGE on changelog_id_seq to client;
137-
138-
GRANT SELECT,INSERT on warnings to client;
139-
GRANT SELECT, USAGE on warnings_id_seq to client;
205+
GRANT SELECT ON TABLE runs TO client; -- only needs a full select if optimizations are run on the measurement machines. Otherwise can be locked down
140206

141-
GRANT INSERT ON TABLE system_logs TO client;
207+
REVOKE ALL PRIVILEGES ON DATABASE "green-coding" FROM client;
208+
REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA public FROM client;
209+
REVOKE ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public FROM client;
210+
REVOKE ALL PRIVILEGES ON ALL FUNCTIONS IN SCHEMA public FROM client;
211+
212+
GRANT INSERT ON public.jobs TO client;
213+
GRANT INSERT ON public.measurement_metrics TO client;
214+
GRANT INSERT ON public.measurement_values TO client;
215+
GRANT INSERT ON public.network_intercepts TO client;
216+
GRANT INSERT ON public.notes TO client;
217+
GRANT INSERT ON public.optimizations TO client;
218+
GRANT INSERT ON public.phase_stats TO client;
219+
GRANT INSERT ON public.runs TO client;
220+
GRANT INSERT ON public.system_logs TO client;
221+
GRANT INSERT ON public.warnings TO client;
222+
223+
GRANT USAGE, SELECT ON SEQUENCE jobs_id_sql TO client;
224+
GRANT USAGE, SELECT ON SEQUENCE measurement_metrics_id_sql TO client;
225+
GRANT USAGE, SELECT ON SEQUENCE measurement_values_id_sql TO client;
226+
GRANT USAGE, SELECT ON SEQUENCE network_intercepts_id_sql TO client;
227+
GRANT USAGE, SELECT ON SEQUENCE notes_id_sql TO client;
228+
GRANT USAGE, SELECT ON SEQUENCE optimizations_id_sql TO client;
229+
GRANT USAGE, SELECT ON SEQUENCE phase_stats_id_sql TO client;
230+
GRANT USAGE, SELECT ON SEQUENCE runs_id_sql TO client;
231+
GRANT USAGE, SELECT ON SEQUENCE system_logs_id_sql TO client;
232+
GRANT USAGE, SELECT ON SEQUENCE warnings_id_sql TO client;
233+
234+
235+
GRANT SELECT (branch, carbon_simulation, category_ids, commit_hash, created_at, filename, id, machine_id, message, name, run_id, state, type, updated_at, url, usage_scenario_variables, user_id) ON public.jobs TO client; -- no email
236+
237+
238+
GRANT SELECT ON public.categories TO client;
239+
GRANT SELECT ON public.machines TO client;
240+
GRANT SELECT ON public.measurement_metrics TO client;
241+
GRANT SELECT ON public.measurement_values TO client;
242+
GRANT SELECT ON public.network_intercepts TO client;
243+
GRANT SELECT ON public.notes TO client;
244+
GRANT SELECT ON public.optimizations TO client;
245+
GRANT SELECT ON public.phase_stats TO client;
246+
GRANT SELECT ON public.runs TO client;
247+
GRANT SELECT ON public.users TO client;
248+
GRANT SELECT ON public.warnings TO client;
249+
250+
251+
GRANT UPDATE (capabilities) ON public.users TO client;
252+
GRANT UPDATE (usage_scenario_dependencies, containers, end_measurement, failed, gmt_hash, logs, machine_id, machine_specs, measurement_config, phases, start_measurement, usage_scenario) ON public.runs TO client;
253+
GRANT UPDATE (state) ON public.jobs TO client;
254+
GRANT UPDATE ON public.machines TO client;
255+
GRANT UPDATE ON public.phase_stats TO client;
142256

143257
```
144258

0 commit comments

Comments
 (0)