Remove Write Permission from getMongoData Roles

[zhangyaoxing]

The getMongoData.js script is supposed to be readonly. But the 3 roles listed in the README.md contains update permission on some of the collections. They should be removed.

backup	readAnyDatabase	clusterMonitor
update/insert against config.settings.	readonly	readonly

[zhangyaoxing]

getMongoData Privileges.xlsx

Comparing all privileges in the backup role, most of them can be found in the other 2 roles. But not the following ones.

Resource	Action
config.settings	find
anyResource	collStats
anyResource	listCollections
anyResource	listIndexes
anyResource	listSearchIndexes
*.system.users	find
admin.system.backup_users	find
admin.system.roles	find
admin.system.version	find

• anyResource stands for every database and collection.
• The * for database resource stands for all databases except for config and local.
• The * for collection resource stands for all collections except for system.* collections.

[zhangyaoxing]

Although there are not exactly the same privilege in readAnyDatabase and clusterMonitor, the latter have some privileges that can fully or partly cover some of the above privileges:

Resource	Action	Fully Covered	Partly Covered
config.settings	find	clusterMonitor/config.*/find
anyResource	collStats		clusterMonitor/*.*/collStats
anyResource	listCollections		readAnyDatabase/*.*/listCollections
anyResource	listIndexes		readAnyDatabase/*.*/listIndexes
anyResource	listSearchIndexes		readAnyDatabase/*.*/listSearchIndexes
*.system.users	find
admin.system.backup_users	find
admin.system.roles	find
admin.system.version	find

[zhangyaoxing]

So far, listSearchIndexes is not used in the script. It can be removed.
anyResource - *.* =

• {db: "", collection: "system.users"}
• {db: "", collection: "system.roles"}
• {db: "", collection: "system.profile"}
• {db: "", collection: "system.version"}
• {db: "", collection: "system.js"}
• {db: "", collection: "system.views"}
• {db: "", collection: "system.indexBuilds"}
• {db: "", collection: "system.preimages"}
• {db: "", collection: "system.buckets"}
• In theory, some of the above collections can also in local and config. But they shouldn't be. So we don't include them.
• {db: "local", collection: ""}
• {db: "config", collection: ""}

So the final privileges are:

db.getSiblingDB("admin").createRole({
  role: "gmd",
  privileges: [
    {resource: {db: "", collection: "system.users"}, actions: ["collStats", "listIndexes", "find"]},
    {resource: {db: "", collection: "system.roles"}, actions: ["collStats", "listIndexes", "find"]},
    {resource: {db: "", collection: "system.version"}, actions: ["collStats", "listIndexes", "find"]},
    {resource: {db: "", collection: "system.profile"}, actions: ["collStats", "listIndexes"]},
    {resource: {db: "", collection: "system.js"}, actions: ["collStats", "listIndexes"]},
    {resource: {db: "", collection: "system.views"}, actions: ["collStats", "listIndexes"]},
    {resource: {db: "", collection: "system.indexBuilds"}, actions: ["collStats", "listIndexes"]},
    {resource: {db: "", collection: "system.preimages"}, actions: ["collStats", "listIndexes"]},
    {resource: {db: "", collection: "system.buckets"}, actions: ["collStats", "listIndexes"]},
    {resource: {db: "local", collection: ""}, actions: ["collStats", "listCollections", "listIndexes"]},
    {resource: {db: "config", collection: ""}, actions: ["collStats", "listCollections", "listIndexes"]},
  ],
  roles: ["readAnyDatabase", "clusterMonitor"]
});

[zhangyaoxing]

After reviewing the code, the stats and index stats against system collections actually doesn't make sense. And they fail even with the backup, readAnyDatabase and clusterMonitor roles. It doesn't cause any problem when we run with legacy shell because the legacy shell doesn't throw any exception. And the error end up printed as a message in the output.
Issue #163 is created to address the problem.
If the system.* collections are skipped, the necessary permissions are:

db.getSiblingDB("admin").createRole({
  role: "gmd",
  privileges: [
    {resource: {db: "", collection: "system.users"}, actions: ["find"]},
    {resource: {db: "", collection: "system.roles"}, actions: ["find"]}
  ],
  roles: ["readAnyDatabase", "clusterMonitor"]
});