SERVER-36149: Make $setFeatureCompatibilityVersion a non-normal resource

2 files changed, 7 insertions, 2 deletions

diff --git a/jstests/auth/lib/commands_lib.js b/jstests/auth/lib/commands_lib.js
index 092856a4170..97be3e19890 100644
--- a/jstests/auth/lib/commands_lib.js
+++ b/jstests/auth/lib/commands_lib.js
@@ -4874,7 +4874,7 @@ var authCommandsLib = {
           testcases: [
               {
                 runOnDb: adminDbName,
-                roles: Object.extend({readWriteAnyDatabase: 1}, roles_clusterManager),
+                roles: roles_clusterManager,
                 privileges: [{
                     resource: {db: '$setFeatureCompatibilityVersion', collection: 'version'},
                     actions: ['update']
diff --git a/src/mongo/db/auth/authorization_session.cpp b/src/mongo/db/auth/authorization_session.cpp
index 6b3e0800c2f..f755ed561d7 100644
--- a/src/mongo/db/auth/authorization_session.cpp
+++ b/src/mongo/db/auth/authorization_session.cpp
@@ -753,7 +753,12 @@ static int buildResourceSearchList(const ResourcePattern& target,
             // Some databases should not be matchable with ResourcePattern::forAnyNormalResource.
             // 'local' and 'config' are used to store special system collections, which user level
             // administrators should not be able to manipulate.
-            if (target.ns().db() != "local" && target.ns().db() != "config") {
+            // '$setFeatureCompatibilityVersion' is a virtual database that
+            // setFeatureCompatibilityVersion performs auth checks against. When this command was
+            // first written, there was a moratorium on creating new ActionTypes. SERVER-31983
+            // introduced the ActionType after the moratorium expired.
+            if (target.ns().db() != "local" && target.ns().db() != "config" &&
+                target.ns().db() != "$setFeatureCompatibilityVersion") {
                 resourceSearchList[size++] = ResourcePattern::forAnyNormalResource();
             }
             resourceSearchList[size++] = ResourcePattern::forDatabaseName(target.ns().db());