|
| 1 | +// Copyright 2023 The Cockroach Authors. |
| 2 | +// |
| 3 | +// Licensed as a CockroachDB Enterprise file under the Cockroach Community |
| 4 | +// License (the "License"); you may not use this file except in compliance with |
| 5 | +// the License. You may obtain a copy of the License at |
| 6 | +// |
| 7 | +// https://github.com/cockroachdb/cockroach/blob/master/licenses/CCL.txt |
| 8 | + |
| 9 | +package fipsccl |
| 10 | + |
| 11 | +import ( |
| 12 | + "context" |
| 13 | + |
| 14 | + "github.com/cockroachdb/cockroach/pkg/ccl/utilccl" |
| 15 | + "github.com/cockroachdb/cockroach/pkg/sql/privilege" |
| 16 | + "github.com/cockroachdb/cockroach/pkg/sql/roleoption" |
| 17 | + "github.com/cockroachdb/cockroach/pkg/sql/sem/eval" |
| 18 | + "github.com/cockroachdb/cockroach/pkg/sql/sem/tree" |
| 19 | + "github.com/cockroachdb/cockroach/pkg/sql/sem/volatility" |
| 20 | + "github.com/cockroachdb/cockroach/pkg/sql/syntheticprivilege" |
| 21 | + "github.com/cockroachdb/cockroach/pkg/sql/types" |
| 22 | +) |
| 23 | + |
| 24 | +func init() { |
| 25 | + overload := tree.Overload{ |
| 26 | + Types: tree.ParamTypes{}, |
| 27 | + ReturnType: tree.FixedReturnType(types.Bool), |
| 28 | + Fn: func(ctx context.Context, evalCtx *eval.Context, args tree.Datums) (tree.Datum, error) { |
| 29 | + if err := utilccl.CheckEnterpriseEnabled( |
| 30 | + evalCtx.Settings, evalCtx.ClusterID, "fips_ready", |
| 31 | + ); err != nil { |
| 32 | + return nil, err |
| 33 | + } |
| 34 | + // It's debatable whether we need a permission check here at all. |
| 35 | + // It's not very sensitive and is (currently) a very cheap function |
| 36 | + // call. However, it's something that regular users should have no |
| 37 | + // reason to look at so in the interest of least privilege we put it |
| 38 | + // behind the VIEWCLUSTERSETTING privilige. |
| 39 | + session := evalCtx.SessionAccessor |
| 40 | + isAdmin, err := session.HasAdminRole(ctx) |
| 41 | + if err != nil { |
| 42 | + return nil, err |
| 43 | + } |
| 44 | + if !isAdmin { |
| 45 | + hasView, err := session.HasRoleOption(ctx, roleoption.VIEWCLUSTERSETTING) |
| 46 | + if err != nil { |
| 47 | + return nil, err |
| 48 | + } |
| 49 | + if !hasView { |
| 50 | + if err := session.CheckPrivilege(ctx, syntheticprivilege.GlobalPrivilegeObject, privilege.VIEWCLUSTERSETTING); err != nil { |
| 51 | + return nil, err |
| 52 | + } |
| 53 | + } |
| 54 | + } |
| 55 | + return tree.MakeDBool(tree.DBool(IsFIPSReady())), nil |
| 56 | + }, |
| 57 | + Class: tree.NormalClass, |
| 58 | + Volatility: volatility.Stable, |
| 59 | + } |
| 60 | + |
| 61 | + utilccl.RegisterCCLBuiltin("crdb_internal.fips_ready", |
| 62 | + `Returns true if all FIPS readiness checks pass.`, |
| 63 | + overload) |
| 64 | +} |
0 commit comments