Isolate writes to the internal system database root.__system

example/trigger/src/main/java/org/apache/iotdb/trigger/StatisticsUpdaterTrigger.java

@@ -45,7 +45,7 @@ public class StatisticsUpdaterTrigger implements Trigger {
 
   private static final Logger LOGGER = LoggerFactory.getLogger(StatisticsUpdaterTrigger.class);
 
-  private static final String TARGET_DEVICE = "root.__system.statistics";
+  private static final String TARGET_DEVICE = "root.statistics";
 
   private static final String TARGET_SERIES = "total_count";
   private String ip;

iotdb-core/datanode/src/main/java/org/apache/iotdb/db/auth/AuthorityChecker.java

@@ -226,6 +226,7 @@ public static TSStatus checkAuthority(Statement statement, IAuditEntity auditEnt
                             auditEntity.getUserId(),
                             auditEntity.getUsername(),
                             auditEntity.getCliHostname())
+                        .setInternal(auditEntity.isInternal())
                         .setSqlString(auditEntity.getSqlString()));
       }
       return status;

iotdb-core/datanode/src/main/java/org/apache/iotdb/db/protocol/thrift/impl/DataNodeInternalRPCServiceImpl.java

@@ -3557,12 +3557,13 @@ public TSStatus insertRecord(TSInsertRecordReq req) throws TException {
       InsertRowStatement statement = StatementGenerator.createStatement(req);
       SessionInfo sessionInfo =
           new SessionInfo(
-              0,
-              new UserEntity(
-                  AuthorityChecker.SUPER_USER_ID,
-                  AuthorityChecker.SUPER_USER,
-                  IoTDBDescriptor.getInstance().getConfig().getInternalAddress()),
-              ZoneId.systemDefault());
+                  0,
+                  new UserEntity(
+                      AuthorityChecker.SUPER_USER_ID,
+                      AuthorityChecker.SUPER_USER,
+                      IoTDBDescriptor.getInstance().getConfig().getInternalAddress()),
+                  ZoneId.systemDefault())
+              .setInternal(true);
 
       long queryId = SESSION_MANAGER.requestQueryId();
       ExecutionResult result =

iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/common/MPPQueryContext.java

@@ -1086,6 +1086,11 @@ public String getUsername() {
     return session.getUserName();
   }
 
+  @Override
+  public boolean isInternal() {
+    return session != null && session.isInternal();
+  }
+
   @Override
   public String getCliHostname() {
     if (session == null || session.getCliHostname() == null) {

iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/analyze/AnalyzeUtils.java

@@ -20,7 +20,9 @@
 package org.apache.iotdb.db.queryengine.plan.analyze;
 
 import org.apache.iotdb.common.rpc.thrift.TRegionReplicaSet;
+import org.apache.iotdb.common.rpc.thrift.TSStatus;
 import org.apache.iotdb.common.rpc.thrift.TTimePartitionSlot;
+import org.apache.iotdb.commons.audit.IAuditEntity;
 import org.apache.iotdb.commons.exception.IoTDBException;
 import org.apache.iotdb.commons.exception.IoTDBRuntimeException;
 import org.apache.iotdb.commons.exception.SemanticException;
@@ -56,6 +58,7 @@
 import org.apache.iotdb.db.queryengine.plan.relational.metadata.fetcher.TableDeviceSchemaFetcher;
 import org.apache.iotdb.db.queryengine.plan.relational.planner.ir.ExpressionRewriter;
 import org.apache.iotdb.db.queryengine.plan.relational.planner.ir.ExpressionTreeRewriter;
+import org.apache.iotdb.db.queryengine.plan.relational.security.TreeAccessCheckVisitor;
 import org.apache.iotdb.db.queryengine.plan.relational.sql.ast.Delete;
 import org.apache.iotdb.db.queryengine.plan.relational.sql.ast.TimeRange;
 import org.apache.iotdb.db.queryengine.plan.statement.crud.InsertBaseStatement;
@@ -168,7 +171,9 @@ public static InsertBaseStatement analyzeInsert(
     validateSchema(analysis, insertBaseStatement, schemaValidation);
 
     InsertBaseStatement realStatement =
-        removeLogicalView ? removeLogicalView(analysis, insertBaseStatement) : insertBaseStatement;
+        removeLogicalView
+            ? removeLogicalView(analysis, insertBaseStatement, context)
+            : insertBaseStatement;
     if (analysis.isFinishQueryAfterAnalyze()) {
       return realStatement;
     }
@@ -343,9 +348,19 @@ public static void validateSchema(
   }
 
   public static InsertBaseStatement removeLogicalView(
-      IAnalysis analysis, InsertBaseStatement insertBaseStatement) {
+      IAnalysis analysis, InsertBaseStatement insertBaseStatement, IAuditEntity context) {
     try {
-      return insertBaseStatement.removeLogicalView();
+      final InsertBaseStatement realStatement = insertBaseStatement.removeLogicalView();
+      // Inserts into a logical view are rewritten to the view's source series. Check the real
+      // target paths so a view created before this restriction cannot write root.__system.
+      final TSStatus systemDatabaseStatus =
+          TreeAccessCheckVisitor.checkSystemDatabaseWrite(
+              context, realStatement.getDevicePathsStream().toList());
+      if (systemDatabaseStatus != null) {
+        analysis.setFinishQueryAfterAnalyze(true);
+        analysis.setFailStatus(systemDatabaseStatus);
+      }
+      return realStatement;
     } catch (SemanticException e) {
       analysis.setFinishQueryAfterAnalyze(true);
       if (e.getCause() instanceof IoTDBException) {

iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/analyze/AnalyzeVisitor.java

@@ -87,6 +87,7 @@
 import org.apache.iotdb.db.queryengine.plan.planner.plan.parameter.GroupByVariationParameter;
 import org.apache.iotdb.db.queryengine.plan.planner.plan.parameter.IntoPathDescriptor;
 import org.apache.iotdb.db.queryengine.plan.planner.plan.parameter.OrderByParameter;
+import org.apache.iotdb.db.queryengine.plan.relational.security.TreeAccessCheckVisitor;
 import org.apache.iotdb.db.queryengine.plan.statement.StatementNode;
 import org.apache.iotdb.db.queryengine.plan.statement.StatementVisitor;
 import org.apache.iotdb.db.queryengine.plan.statement.component.FillComponent;
@@ -2903,7 +2904,8 @@ public Analysis visitInsertRow(InsertRowStatement insertRowStatement, MPPQueryCo
         analysis,
         insertRowStatement,
         () -> SchemaValidator.validate(schemaFetcher, insertRowStatement, context));
-    InsertBaseStatement realInsertStatement = removeLogicalView(analysis, insertRowStatement);
+    InsertBaseStatement realInsertStatement =
+        removeLogicalView(analysis, insertRowStatement, context);
     if (analysis.isFinishQueryAfterAnalyze()) {
       return analysis;
     }
@@ -2943,7 +2945,7 @@ public Analysis visitInsertRows(
         insertRowsStatement,
         () -> SchemaValidator.validate(schemaFetcher, insertRowsStatement, context));
     InsertRowsStatement realInsertRowsStatement =
-        (InsertRowsStatement) removeLogicalView(analysis, insertRowsStatement);
+        (InsertRowsStatement) removeLogicalView(analysis, insertRowsStatement, context);
     if (analysis.isFinishQueryAfterAnalyze()) {
       return analysis;
     }
@@ -2968,7 +2970,8 @@ public Analysis visitInsertMultiTablets(
         insertMultiTabletsStatement,
         () -> SchemaValidator.validate(schemaFetcher, insertMultiTabletsStatement, context));
     InsertMultiTabletsStatement realStatement =
-        (InsertMultiTabletsStatement) removeLogicalView(analysis, insertMultiTabletsStatement);
+        (InsertMultiTabletsStatement)
+            removeLogicalView(analysis, insertMultiTabletsStatement, context);
     if (analysis.isFinishQueryAfterAnalyze()) {
       return analysis;
     }
@@ -2993,7 +2996,7 @@ public Analysis visitInsertRowsOfOneDevice(
         insertRowsOfOneDeviceStatement,
         () -> SchemaValidator.validate(schemaFetcher, insertRowsOfOneDeviceStatement, context));
     InsertBaseStatement realInsertStatement =
-        removeLogicalView(analysis, insertRowsOfOneDeviceStatement);
+        removeLogicalView(analysis, insertRowsOfOneDeviceStatement, context);
     if (analysis.isFinishQueryAfterAnalyze()) {
       return analysis;
     }
@@ -3725,6 +3728,15 @@ public Analysis visitDeleteData(
         }
       }
       deleteDataStatement.setPathList(new ArrayList<>(deletePatternSet));
+      // Deletes through a writable view are rewritten to the view's source series as well.
+      final TSStatus systemDatabaseStatus =
+          TreeAccessCheckVisitor.checkSystemDatabaseWrite(
+              context, deleteDataStatement.getPathList());
+      if (systemDatabaseStatus != null) {
+        analysis.setFinishQueryAfterAnalyze(true);
+        analysis.setFailStatus(systemDatabaseStatus);
+        return analysis;
+      }
     } else {
       for (PartialPath devicePattern : patternTree.getAllDevicePaths()) {
         schemaTree

iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/analyze/schema/AutoCreateSchemaExecutor.java

@@ -567,8 +567,7 @@ private List<MeasurementPath> executeInternalCreateTimeSeriesStatement(
 
   private void internalActivateTemplate(PartialPath devicePath, MPPQueryContext context) {
     ActivateTemplateStatement statement = new ActivateTemplateStatement(devicePath);
-    TSStatus status =
-        AuthorityChecker.checkAuthority(statement, context.getSession().getUserEntity());
+    TSStatus status = AuthorityChecker.checkAuthority(statement, context);
     if (status.getCode() != TSStatusCode.SUCCESS_STATUS.getStatusCode()) {
       throw new IoTDBRuntimeException(status.getMessage(), status.getCode());
     }
@@ -585,8 +584,7 @@ private void internalActivateTemplate(
       MPPQueryContext context) {
     InternalBatchActivateTemplateStatement statement =
         new InternalBatchActivateTemplateStatement(devicesNeedActivateTemplate);
-    TSStatus status =
-        AuthorityChecker.checkAuthority(statement, context.getSession().getUserEntity());
+    TSStatus status = AuthorityChecker.checkAuthority(statement, context);
     if (status.getCode() != TSStatusCode.SUCCESS_STATUS.getStatusCode()) {
       throw new IoTDBRuntimeException(status.getMessage(), status.getCode());
     }

iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/relational/security/AccessControlImpl.java

@@ -606,6 +606,12 @@ public TSStatus checkFullPathWriteDataPermission(
       IAuditEntity auditEntity, IDeviceID device, String measurementId) {
     try {
       PartialPath path = new MeasurementPath(device, measurementId);
+      final TSStatus systemDatabaseStatus =
+          TreeAccessCheckVisitor.checkSystemDatabaseWrite(
+              auditEntity, Collections.singletonList(path));
+      if (systemDatabaseStatus != null) {
+        return systemDatabaseStatus;
+      }
       // Apache IoTDB does not support external writes to the audit database.
       if (includeByAuditTreeDB(path)
           && !auditEntity.getUsername().equals(AuthorityChecker.INTERNAL_AUDIT_USER)) {
@@ -633,6 +639,20 @@ public TSStatus checkCanAlterTemplate(IAuditEntity entity, Supplier<String> audi
   @Override
   public TSStatus checkCanAlterView(
       IAuditEntity entity, List<PartialPath> sourcePaths, List<PartialPath> targetPaths) {
+    if (sourcePaths != null) {
+      final TSStatus sourceSystemDatabaseStatus =
+          TreeAccessCheckVisitor.checkSystemDatabaseWrite(entity, sourcePaths);
+      if (sourceSystemDatabaseStatus != null) {
+        return sourceSystemDatabaseStatus;
+      }
+    }
+    if (targetPaths != null) {
+      final TSStatus targetSystemDatabaseStatus =
+          TreeAccessCheckVisitor.checkSystemDatabaseWrite(entity, targetPaths);
+      if (targetSystemDatabaseStatus != null) {
+        return targetSystemDatabaseStatus;
+      }
+    }
     if (AuthorityChecker.SUPER_USER_ID == entity.getUserId()) {
       DNAuditLogger.getInstance()
           .recordObjectAuthenticationAuditLog(

iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/relational/security/TreeAccessCheckContext.java

@@ -32,6 +32,7 @@ public class TreeAccessCheckContext implements IAuditEntity {
   private final long userId;
   private final String username;
   private final String cliHostname;
+  private boolean internal;
 
   public TreeAccessCheckContext(long userId, String username, String cliHostname) {
     this.userId = userId;
@@ -54,6 +55,16 @@ public String getCliHostname() {
     return cliHostname;
   }
 
+  @Override
+  public boolean isInternal() {
+    return internal;
+  }
+
+  public TreeAccessCheckContext setInternal(final boolean internal) {
+    this.internal = internal;
+    return this;
+  }
+
   private AuditEventType auditEventType;
   private AuditLogOperation auditLogOperation;
   private List<PrivilegeType> privilegeTypeList;