Hello folks, I have a question about Redis Lua scripts functionality, the version I am currently using is 6.0.

Is there any way we can use to prevent user from calling certain operations, without disabling user ability to write and call their own script? or is there a workaround for this problem? For example, two use case would be:

  1. admin will give client permission to call EVAL/EVALSHA, however, inside the script redis.call('set') is not allowed.
  2. admin will give client permission to call EVAL/EVALSHA, but not allowing clients call redis.log function since it may give a chance for clients to overwhelming the Redis logs.

This is a similar scenario to ACL, however, the access control happens when executing the user script. Thanks!

Comment From: mgravell

Surely "1" is just "use an account with those permissions to run the script"; I'm assuming ACLs propagate to script invocations - I'd be hugely surprised if the do not (although I'm happy to be corrected)

"2" sounds more interesting, indeed. I can see a case for wanting to limit that, although to be honest: if you're letting hostile users have access to the server, you're already in a world of pain, even if ACLs slow them down. They could, for example, just overload the server by issuing lots and lots and lots of the things that they are allowed to do.

Comment From: daidaotong

hi @mgravell , thanks for your reply. for case 1 I tested and verified that the ACL works on the Lua script. so there shouldn't be problem on that. for case 2, I found there is no permission control on redis.log call when executing scripts. this would be a potential limitation on Redis especially when we provide that as a cloud offering services. I understand the user might have another way to overwhelming the server log, but it would be a nice thing to have if Redis can control the permission on the user executing the redis.log call in scripts. Thanks.

Comment From: madolson

I agree that case 2 is interesting, but I'm not sure there is much we should do there. I wouldn't consider logging to be that dangerous of a command, it will just slow Redis down in the worst case. There are some other options that we also might disable like allowing disabling replication within a script. I'm not sure there is low hanging fruit, and someone might need to spend time to think this through more deeply.

As a managed solution you are free to make internal changes to limit the number of calls to redis.log().

Comment From: itamarhaber

@mgravell you are correct wrt "ACLs propagate to script invocations".

Comment From: madolson

Closing, based on the responses seems like we're okay not implementing this.