Skip to content

Commit cdb3d4f

Browse files
ArneTRArneTR
committed
Clarified SQL permissions with comments, removed public statements and added DEFAULT revokes
1 parent 749f596 commit cdb3d4f

1 file changed

Lines changed: 65 additions & 58 deletions

File tree

‎content/en/docs/cluster/security.md‎

Lines changed: 65 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -22,11 +22,13 @@ REVOKE ALL PRIVILEGES ON DATABASE "green-coding" FROM server;
2222
REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA public FROM server;
2323
REVOKE ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public FROM server;
2424
REVOKE ALL PRIVILEGES ON ALL FUNCTIONS IN SCHEMA public FROM server;
25+
ALTER DEFAULT PRIVILEGES IN SCHEMA public REVOKE ALL ON TABLES FROM server;
26+
ALTER DEFAULT PRIVILEGES IN SCHEMA public REVOKE ALL ON SEQUENCES FROM server;
2527

2628
GRANT DELETE ON
27-
jobs,
28-
system_logs,
29-
watchlist
29+
jobs, -- clear old jobs
30+
system_logs, -- delete system_logs in cluster-status
31+
watchlist -- delete watchlist item via API
3032
TO server;
3133

3234
GRANT INSERT ON
@@ -108,10 +110,14 @@ REVOKE ALL PRIVILEGES ON DATABASE "green-coding" FROM manager;
108110
REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA public FROM manager;
109111
REVOKE ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public FROM manager;
110112
REVOKE ALL PRIVILEGES ON ALL FUNCTIONS IN SCHEMA public FROM manager;
113+
ALTER DEFAULT PRIVILEGES IN SCHEMA public REVOKE ALL ON TABLES FROM manager;
114+
ALTER DEFAULT PRIVILEGES IN SCHEMA public REVOKE ALL ON SEQUENCES FROM manager;
115+
111116

112117
GRANT TEMPORARY ON DATABASE "green-coding" TO manager;
113118

114-
GRANT DELETE ON carbondb_data_raw TO manager;
119+
GRANT DELETE ON carbondb_data_raw TO manager; -- carbondb compress
120+
GRANT DELETE ON TABLE measurement_metrics, measurement_values to manager; -- delete expired data
115121

116122
GRANT INSERT ON carbon_intensity TO manager;
117123
GRANT INSERT ON carbondb_data TO manager;
@@ -158,13 +164,13 @@ GRANT SELECT ON users TO manager;
158164
GRANT SELECT ON warnings TO manager;
159165

160166

161-
GRANT UPDATE ON public.carbondb_data TO manager;
162-
GRANT UPDATE ON public.carbondb_data_raw TO manager;
163-
GRANT UPDATE ON public.carbondb_machines TO manager;
164-
GRANT UPDATE ON public.carbondb_projects TO manager;
165-
GRANT UPDATE ON public.carbondb_sources TO manager;
166-
GRANT UPDATE ON public.carbondb_tags TO manager;
167-
GRANT UPDATE ON public.carbondb_types TO manager;
167+
GRANT UPDATE ON carbondb_data TO manager;
168+
GRANT UPDATE ON carbondb_data_raw TO manager;
169+
GRANT UPDATE ON carbondb_machines TO manager;
170+
GRANT UPDATE ON carbondb_projects TO manager;
171+
GRANT UPDATE ON carbondb_sources TO manager;
172+
GRANT UPDATE ON carbondb_tags TO manager;
173+
GRANT UPDATE ON carbondb_types TO manager;
168174

169175
GRANT UPDATE (latitude, longitude, carbon_intensity_g, carbon_ug) ON ci_measurements TO manager;
170176
GRANT UPDATE (latitude, longitude, carbon_intensity_g, operational_carbon_ug) ON hog_simplified_measurements TO manager;
@@ -204,58 +210,59 @@ We recommend NOT to have SMTP credentials on the machines and also connect to th
204210
```sql
205211
CREATE USER client WITH PASSWORD 'YOUR_PASSWORD';
206212

207-
208-
GRANT SELECT ON TABLE runs TO client; -- only needs a full select if optimizations are run on the measurement machines. Otherwise can be locked down
209-
210213
REVOKE ALL PRIVILEGES ON DATABASE "green-coding" FROM client;
211214
REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA public FROM client;
212215
REVOKE ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public FROM client;
213216
REVOKE ALL PRIVILEGES ON ALL FUNCTIONS IN SCHEMA public FROM client;
217+
ALTER DEFAULT PRIVILEGES IN SCHEMA public REVOKE ALL ON TABLES FROM client;
218+
ALTER DEFAULT PRIVILEGES IN SCHEMA public REVOKE ALL ON SEQUENCES FROM client;
219+
220+
GRANT INSERT ON jobs TO client;
221+
GRANT INSERT ON measurement_metrics TO client;
222+
GRANT INSERT ON measurement_values TO client;
223+
GRANT INSERT ON network_intercepts TO client;
224+
GRANT INSERT ON notes TO client;
225+
GRANT INSERT ON optimizations TO client;
226+
GRANT INSERT ON phase_stats TO client;
227+
GRANT INSERT ON runs TO client;
228+
GRANT INSERT ON system_logs TO client;
229+
GRANT INSERT ON warnings TO client;
230+
GRANT INSERT ON machines TO client;
231+
232+
GRANT USAGE, SELECT ON SEQUENCE jobs_id_seq TO client;
233+
GRANT USAGE, SELECT ON SEQUENCE measurement_metrics_id_seq TO client;
234+
GRANT USAGE, SELECT ON SEQUENCE measurement_values_id_seq TO client;
235+
GRANT USAGE, SELECT ON SEQUENCE network_intercepts_id_seq TO client;
236+
GRANT USAGE, SELECT ON SEQUENCE notes_id_seq TO client;
237+
GRANT USAGE, SELECT ON SEQUENCE optimizations_id_seq TO client;
238+
GRANT USAGE, SELECT ON SEQUENCE phase_stats_id_seq TO client;
239+
GRANT USAGE, SELECT ON SEQUENCE system_logs_id_seq TO client;
240+
GRANT USAGE, SELECT ON SEQUENCE warnings_id_seq TO client;
241+
GRANT USAGE, SELECT ON SEQUENCE machines_id_seq TO client;
242+
243+
244+
GRANT SELECT (branch, carbon_simulation, category_ids, commit_hash, created_at, filename, id, machine_id, message, name, run_id, state, type, updated_at, url, usage_scenario_variables, user_id) ON jobs TO client; -- no email
245+
GRANT SELECT ON TABLE runs TO client; -- only needs a full select if optimizations are run on the measurement machines. Otherwise can be locked down
246+
214247

215-
GRANT INSERT ON public.jobs TO client;
216-
GRANT INSERT ON public.measurement_metrics TO client;
217-
GRANT INSERT ON public.measurement_values TO client;
218-
GRANT INSERT ON public.network_intercepts TO client;
219-
GRANT INSERT ON public.notes TO client;
220-
GRANT INSERT ON public.optimizations TO client;
221-
GRANT INSERT ON public.phase_stats TO client;
222-
GRANT INSERT ON public.runs TO client;
223-
GRANT INSERT ON public.system_logs TO client;
224-
GRANT INSERT ON public.warnings TO client;
225-
226-
GRANT USAGE, SELECT ON SEQUENCE jobs_id_sql TO client;
227-
GRANT USAGE, SELECT ON SEQUENCE measurement_metrics_id_sql TO client;
228-
GRANT USAGE, SELECT ON SEQUENCE measurement_values_id_sql TO client;
229-
GRANT USAGE, SELECT ON SEQUENCE network_intercepts_id_sql TO client;
230-
GRANT USAGE, SELECT ON SEQUENCE notes_id_sql TO client;
231-
GRANT USAGE, SELECT ON SEQUENCE optimizations_id_sql TO client;
232-
GRANT USAGE, SELECT ON SEQUENCE phase_stats_id_sql TO client;
233-
GRANT USAGE, SELECT ON SEQUENCE runs_id_sql TO client;
234-
GRANT USAGE, SELECT ON SEQUENCE system_logs_id_sql TO client;
235-
GRANT USAGE, SELECT ON SEQUENCE warnings_id_sql TO client;
236-
237-
238-
GRANT SELECT (branch, carbon_simulation, category_ids, commit_hash, created_at, filename, id, machine_id, message, name, run_id, state, type, updated_at, url, usage_scenario_variables, user_id) ON public.jobs TO client; -- no email
239-
240-
241-
GRANT SELECT ON public.categories TO client;
242-
GRANT SELECT ON public.machines TO client;
243-
GRANT SELECT ON public.measurement_metrics TO client;
244-
GRANT SELECT ON public.measurement_values TO client;
245-
GRANT SELECT ON public.network_intercepts TO client;
246-
GRANT SELECT ON public.notes TO client;
247-
GRANT SELECT ON public.optimizations TO client;
248-
GRANT SELECT ON public.phase_stats TO client;
249-
GRANT SELECT ON public.runs TO client;
250-
GRANT SELECT ON public.users TO client;
251-
GRANT SELECT ON public.warnings TO client;
252-
253-
254-
GRANT UPDATE (capabilities) ON public.users TO client;
255-
GRANT UPDATE (usage_scenario_dependencies, containers, end_measurement, failed, gmt_hash, logs, machine_id, machine_specs, measurement_config, phases, start_measurement, usage_scenario) ON public.runs TO client;
256-
GRANT UPDATE (state) ON public.jobs TO client;
257-
GRANT UPDATE ON public.machines TO client;
258-
GRANT UPDATE ON public.phase_stats TO client;
248+
GRANT SELECT ON categories TO client;
249+
GRANT SELECT ON machines TO client;
250+
GRANT SELECT ON measurement_metrics TO client;
251+
GRANT SELECT ON measurement_values TO client;
252+
GRANT SELECT ON network_intercepts TO client;
253+
GRANT SELECT ON notes TO client;
254+
GRANT SELECT ON optimizations TO client;
255+
GRANT SELECT ON phase_stats TO client;
256+
GRANT SELECT ON runs TO client;
257+
GRANT SELECT ON users TO client;
258+
GRANT SELECT ON warnings TO client;
259+
260+
261+
GRANT UPDATE (capabilities) ON users TO client;
262+
GRANT UPDATE (containers, container_dependencies, end_measurement, failed, gmt_hash, logs, machine_id, machine_specs, measurement_config, phases, start_measurement, usage_scenario, usage_scenario_variables) ON runs TO client;
263+
GRANT UPDATE (state) ON jobs TO client;
264+
GRANT UPDATE ON machines TO client;
265+
GRANT UPDATE ON phase_stats TO client;
259266

260267
```
261268

0 commit comments

Comments
 (0)