Skip to content

Conversation

Y--
Copy link
Collaborator

@Y-- Y-- commented Jan 20, 2025

Today, non super-users are going to face an error when querying S3 objects like:

ERROR:  (PGDuckDB/CreatePlan) Prepared query returned an error: 'Permission Error: File system LocalFileSystem has been disabled by configuration

The reason is that the current cache mechanism uses the DB's FileSystem which non-super users cannot access.

To fix it, we create a dedicated FS that the extension is allow to access (but not the user directly).

  • the custom FS which can only open files by name located under the cache_file_directory (no path)
  • all methods beside OpenFile are throwing a permission error.

@Y-- Y-- requested a review from JelteF January 20, 2025 17:03
@JelteF JelteF requested a review from mkaruza January 22, 2025 09:42
Copy link
Collaborator

@JelteF JelteF left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tried it out. It indeed solves the problem. Also the general approach seems quite reasonable.

}

{
lock_guard<mutex> lock(cached_fs_mutex);
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is probably a bit overkill since GetFS is only called under a lock already, but feels more future-proof

@Y-- Y-- requested review from mkaruza and JelteF January 23, 2025 10:13
return LocalFileSystem::OpenFile(oss.str(), flags, opener);
}

void AssertSameCacheDir(const string &other_dir) {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When I read Assert I expect it's a thing that's only checked if assertions are enabled, so let's name this differently.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Given it's only used in one place, maybe just inline it.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But then I have to make the cache_file_directory public just for this method? I preferred to not leak it :-)

Y-- and others added 2 commits January 23, 2025 14:55
Co-authored-by: Jelte Fennema-Nio <jelte@motherduck.com>
@@ -78,6 +80,13 @@ class CachedFileHandle {
shared_ptr<CachedFile> file;
};

class LocalCacheFileSystem: public LocalFileSystem {
// TODO: we could lock down the LocalFileSystem to only allow path that are in the cache directory
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

let's remove this comment

@Y-- Y-- enabled auto-merge (squash) January 23, 2025 14:12
@Y-- Y-- merged commit 6effc0a into main Jan 23, 2025
5 checks passed
@Y-- Y-- deleted the yl/cache-no-su branch January 23, 2025 14:15
@Y--
Copy link
Collaborator Author

Y-- commented Jan 23, 2025

For posterity - we've discussed 24891f4 (#550) with @JelteF and decided it wasn't worth it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants