Skip to content

Commit

Permalink
Make checkCanWriteSystemInformation to deny by default
Browse files Browse the repository at this point in the history
This is in order to prevent accidental access to modify the worker state
in case there was no configured access control on worker.
  • Loading branch information
kokosing committed Apr 19, 2023
1 parent f0a298b commit c38a1c0
Showing 1 changed file with 7 additions and 0 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@

import static com.google.common.base.Preconditions.checkArgument;
import static io.trino.spi.security.AccessDeniedException.denyImpersonateUser;
import static io.trino.spi.security.AccessDeniedException.denyWriteSystemInformationAccess;

/**
* Default system access control rules.
Expand Down Expand Up @@ -55,4 +56,10 @@ public void checkCanImpersonateUser(SystemSecurityContext context, String userNa
{
denyImpersonateUser(context.getIdentity().getUser(), userName);
}

@Override
public void checkCanWriteSystemInformation(SystemSecurityContext context)
{
denyWriteSystemInformationAccess();
}
}

0 comments on commit c38a1c0

Please sign in to comment.