From 692f5ec24867350adeab72b46fc2b406e82c5a28 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Grzegorz=20Kokosi=C5=84ski?= Date: Thu, 20 Apr 2023 15:27:01 +0200 Subject: [PATCH] Document changes in default access control --- docs/src/main/sphinx/release/release-414.md | 5 ++++- .../sphinx/security/built-in-system-access-control.rst | 8 +++++++- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/docs/src/main/sphinx/release/release-414.md b/docs/src/main/sphinx/release/release-414.md index 4eba893c5309..55ca17d2a986 100644 --- a/docs/src/main/sphinx/release/release-414.md +++ b/docs/src/main/sphinx/release/release-414.md @@ -20,10 +20,13 @@ ## Security -* Disallow writing system information with the `default` system access control. +* Disallow updating node system information with the `default` system access control. + This provides default authorization for requesting node shutdown. System information writes can be re-enabled by setting the `access-control.name` configuration property to `allow-all`, or by configuring [system information rules](system-file-auth-system_information). ({issue}`17105`) + Notice that access control for updating node system information needs to be configured + on all worker nodes. ## Delta Lake connector diff --git a/docs/src/main/sphinx/security/built-in-system-access-control.rst b/docs/src/main/sphinx/security/built-in-system-access-control.rst index 26a36daacf64..3d266395c221 100644 --- a/docs/src/main/sphinx/security/built-in-system-access-control.rst +++ b/docs/src/main/sphinx/security/built-in-system-access-control.rst @@ -17,7 +17,9 @@ Trino offers the following built-in implementations: ================================================== ================================================================= System access control name Description ================================================== ================================================================= -``default`` All operations are permitted, except for user impersonation. +``default`` All operations are permitted, except for user impersonation or + updating node system information (like node shutdown). + This is the default access control if none are configured. ``allow-all`` All operations are permitted. @@ -32,6 +34,10 @@ System access control name Description If you want to limit access on a system level in any other way than the ones listed above, you must implement a custom :doc:`/develop/system-access-control`. +Notice that access control needs to be configured on the coordinator. However authorization for certain operations +like updating node system information that covers request of node shutdown is performed on worker. In such cases +access control should be configured on workers too. + Read only system access control ===============================