• Harkrishn Patro's avatar
    Set default channel permission to resetchannels for 7.0 (#10181) · a43b6922
    Harkrishn Patro authored
    For backwards compatibility in 6.x, channels default permission was set to `allchannels` however with 7.0,
    we should modify it and the default value should be `resetchannels` for better security posture.
    Also, with selectors in ACL, a client doesn't have to set channel rules everytime and by default
    the value will be `resetchannels`.
    
    Before this change
    ```
    127.0.0.1:6379> acl list
    1) "user default on nopass ~* &* +@all"
    127.0.0.1:6379>  acl setuser hp on nopass +@all ~*
    OK
    127.0.0.1:6379> acl list
    1) "user default on nopass ~* &* +@all"
    2) "user hp on nopass ~* &* +@all"
    127.0.0.1:6379>  acl setuser hp1 on nopass -@all (%R~sales*)
    OK
    127.0.0.1:6379> acl list
    1) "user default on nopass ~* &* +@all"
    2) "user hp on nopass ~* &* +@all"
    3) "user hp1 on nopass &* -@all (%R~sales* &* -@all)"
    ```
    
    After this change
    ```
    127.0.0.1:6379> acl list
    1) "user default on nopass ~* &* +@all"
    127.0.0.1:6379> acl setuser hp on nopass +@all ~*
    OK
    127.0.0.1:6379> acl list
    1) "user default on nopass ~* &* +@all"
    2) "user hp on nopass ~* resetchannels +@all"
    127.0.0.1:6379> acl setuser hp1 on nopass -@all (%R~sales*)
    OK
    127.0.0.1:6379> acl list
    1) "user default on nopass ~* &* +@all"
    2) "user hp on nopass ~* resetchannels +@all"
    3) "user hp1 on nopass resetchannels -@all (%R~sales* resetchannels -@all)"
    ```
    a43b6922
acl.tcl 31.5 KB