Allow user to execute eval() command on MongoDB 3.x

Written by Claudio Kuenzler - 1 comments

Published on May 26th 2015 - Listed in DB MongoDB Database

---

User wants to execute eval functions in mongodb, but doesnt have the rights and got the following error message:

"errmsg" : "not authorized on LOG to execute command { $eval: \"Test(2)\" }",

The mongodb user has the following roles assigned:

> use LOG
switched to db LOG
> db.getUser("dbuser")
{
    "_id" : "LOG.dbuser",
    "user" : "dbuser",
    "db" : "LOG",
    "roles" : [
        {
            "role" : "readWrite",
            "db" : "LOG"
        },
        {
            "role" : "dbAdmin",
            "db" : "LOG"
        },
        {
            "role" : "dbOwner",
            "db" : "LOG"
        }
    ]
}

But that's not enough. According to the MongoDB documentation for db.eval command:

If authorization is enabled, you must have access to all actions on all resources in order to run eval. Providing such access is not recommended, but if your organization requires a user to run eval, create a role that grants anyAction on anyResource.

The "anyAction" privilege action is, next to "internal", the only privilege action which isn't assigned to a Built-In Role.
To be able to assign this privilege action to the final user, a new role must be created and this new role has to be assigned to the db user.

So lets create this new role, which I called "executeFunctions". It is important to create this role in the admin db, because the role requires "anyAction" to "anyResource" as stated in the documentation.
Therefore the role cannot be created on the user's db (LOG) but must be created in the admin db.

> use admin
switched to db admin
> db.createRole( { role: "executeFunctions", privileges: [ { resource: { anyResource: true }, actions: [ "anyAction" ] } ], roles: [] } )
{
    "role" : "executeFunctions",
    "privileges" : [
        {
            "resource" : {
                "anyResource" : true
            },
            "actions" : [
                "anyAction"
            ]
        }
    ],
    "roles" : [ ]
}

Afterwards I assigned this new role as an additional role to the db user.
Important here is also that the new role must be assigned on the admin database (you'd get an error otherwise):

> use LOG
switched to db LOG
> db.grantRolesToUser("dbuser", [ { role: "executeFunctions", db: "admin" } ])

The new created role "executeFunctions" should be assigned to the db user now. Verification with db.getUser again:

> db.getUser("dbuser")
{
    "_id" : "LOG.dbuser",
    "user" : "dbuser",
    "db" : "LOG",
    "roles" : [
        {
            "role" : "executeFunctions",
            "db" : "admin"
        },
        {
            "role" : "readWrite",
            "db" : "LOG"
        },
        {
            "role" : "dbAdmin",
            "db" : "LOG"
        },
        {
            "role" : "dbOwner",
            "db" : "LOG"
        }
    ]
}

Voilà. Afterwards the db user was able to run eval.

Add a comment

Show form to leave a comment

Comments (newest first)

Craig from Orlando, FL wrote on Sep 18th, 2017:

This is a helpful post. I was trying to figure out why a user with role "root" was being denied permission to run db.version(). It took a while for me to realize that the problem is "eval", and not the specific method being called..

---