Header RSS Feed
 
If you only want to see the articles of a certain category, please click on the desired category below:
ALL Android Backup BSD Database Hacks Hardware Internet Linux Mail MySQL Monitoring Network Personal PHP Proxy Shell Solaris Unix Virtualization VMware Windows Wyse

Allow user to execute eval() command on MongoDB 3.x
Tuesday - May 26th 2015 - by - (0 comments)

User wants to execute eval functions in mongodb, but doesnt have the rights and got the following error message:

"errmsg" : "not authorized on LOG to execute command { $eval: \"Test(2)\" }",

The mongodb user has the following roles assigned:

> use LOG
switched to db LOG
> db.getUser("dbuser")
{
    "_id" : "LOG.dbuser",
    "user" : "dbuser",
    "db" : "LOG",
    "roles" : [
        {
            "role" : "readWrite",
            "db" : "LOG"
        },
        {
            "role" : "dbAdmin",
            "db" : "LOG"
        },
        {
            "role" : "dbOwner",
            "db" : "LOG"
        }
    ]
}

But that's not enough. According to the MongoDB documentation for db.eval command:

If authorization is enabled, you must have access to all actions on all resources in order to run eval. Providing such access is not recommended, but if your organization requires a user to run eval, create a role that grants anyAction on anyResource.

The "anyAction" privilege action is, next to "internal", the only privilege action which isn't assigned to a Built-In Role.
To be able to assign this privilege action to the final user, a new role must be created and this new role has to be assigned to the db user.

So lets create this new role, which I called "executeFunctions". It is important to create this role in the admin db, because the role requires "anyAction" to "anyResource" as stated in the documentation.
Therefore the role cannot be created on the user's db (LOG) but must be created in the admin db.

> use admin
switched to db admin
> db.createRole( { role: "executeFunctions", privileges: [ { resource: { anyResource: true }, actions: [ "anyAction" ] } ], roles: [] } )
{
    "role" : "executeFunctions",
    "privileges" : [
        {
            "resource" : {
                "anyResource" : true
            },
            "actions" : [
                "anyAction"
            ]
        }
    ],
    "roles" : [ ]
}

Afterwards I assigned this new role as an additional role to the db user.
Important here is also that the new role must be assigned on the admin database (you'd get an error otherwise):

> use LOG
switched to db LOG
> db.grantRolesToUser("dbuser", [ { role: "executeFunctions", db: "admin" } ])

The new created role "executeFunctions" should be assigned to the db user now. Verification with db.getUser again:

> db.getUser("dbuser")
{
    "_id" : "LOG.dbuser",
    "user" : "dbuser",
    "db" : "LOG",
    "roles" : [
        {
            "role" : "executeFunctions",
            "db" : "admin"
        },
        {
            "role" : "readWrite",
            "db" : "LOG"
        },
        {
            "role" : "dbAdmin",
            "db" : "LOG"
        },
        {
            "role" : "dbOwner",
            "db" : "LOG"
        }
    ]
}

Voilą. Afterwards the db user was able to run eval.

 

Add a comment

Show form to leave a comment

Comments (newest first):

No comments yet.

Go to Homepage home
Linux Howtos how to's
Nagios Plugins nagios plugins
Links links

Valid HTML 4.01 Transitional
Valid CSS!
[Valid RSS]

7639 Days
until Death of Computers
Why?