SERVER-32169 Allow killCursors to kill across lsids

6 files changed, 29 insertions, 15 deletions

diff --git a/src/mongo/db/commands/killcursors_cmd.cpp b/src/mongo/db/commands/killcursors_cmd.cpp
index 0810d02797d..dbee95b4976 100644
--- a/src/mongo/db/commands/killcursors_cmd.cpp
+++ b/src/mongo/db/commands/killcursors_cmd.cpp
@@ -51,7 +51,7 @@ private:
     Status _checkAuth(Client* client, const NamespaceString& nss, CursorId id) const final {
         auto opCtx = client->getOperationContext();
         const auto check = [client, opCtx, id](CursorManager* manager) {
-            auto ccPin = manager->pinCursor(opCtx, id);
+            auto ccPin = manager->pinCursor(opCtx, id, CursorManager::kNoCheckSession);
             if (!ccPin.isOK()) {
                 return ccPin.getStatus();
             }
diff --git a/src/mongo/db/cursor_manager.cpp b/src/mongo/db/cursor_manager.cpp
index a85830cfaa0..1b542bc27e7 100644
--- a/src/mongo/db/cursor_manager.cpp
+++ b/src/mongo/db/cursor_manager.cpp
@@ -173,7 +173,7 @@ bool GlobalCursorIdCache::eraseCursor(OperationContext* opCtx, CursorId id, bool
     // Figure out what the namespace of this cursor is.
     NamespaceString nss;
     if (CursorManager::isGloballyManagedCursor(id)) {
-        auto pin = globalCursorManager->pinCursor(opCtx, id);
+        auto pin = globalCursorManager->pinCursor(opCtx, id, CursorManager::kNoCheckSession);
         if (!pin.isOK()) {
             invariant(pin == ErrorCodes::CursorNotFound || pin == ErrorCodes::Unauthorized);
             // No such cursor.  TODO: Consider writing to audit log here (even though we don't
@@ -198,7 +198,7 @@ bool GlobalCursorIdCache::eraseCursor(OperationContext* opCtx, CursorId id, bool
     if (checkAuth) {
         auto status = CursorManager::withCursorManager(
             opCtx, id, nss, [nss, id, opCtx](CursorManager* manager) {
-                auto ccPin = manager->pinCursor(opCtx, id);
+                auto ccPin = manager->pinCursor(opCtx, id, CursorManager::kNoCheckSession);
                 if (!ccPin.isOK()) {
                     return ccPin.getStatus();
                 }
@@ -526,7 +526,9 @@ void CursorManager::deregisterExecutor(PlanExecutor* exec) {
     }
 }
 
-StatusWith<ClientCursorPin> CursorManager::pinCursor(OperationContext* opCtx, CursorId id) {
+StatusWith<ClientCursorPin> CursorManager::pinCursor(OperationContext* opCtx,
+                                                     CursorId id,
+                                                     AuthCheck checkSessionAuth) {
     auto lockedPartition = _cursorMap->lockOnePartition(id);
     auto it = lockedPartition->find(id);
     if (it == lockedPartition->end()) {
@@ -548,10 +550,11 @@ StatusWith<ClientCursorPin> CursorManager::pinCursor(OperationContext* opCtx, Cu
         return error;
     }
 
-    auto cursorPrivilegeStatus = checkCursorSessionPrivilege(opCtx, cursor->getSessionId());
-
-    if (!cursorPrivilegeStatus.isOK()) {
-        return cursorPrivilegeStatus;
+    if (checkSessionAuth == kCheckSession) {
+        auto cursorPrivilegeStatus = checkCursorSessionPrivilege(opCtx, cursor->getSessionId());
+        if (!cursorPrivilegeStatus.isOK()) {
+            return cursorPrivilegeStatus;
+        }
     }
 
     cursor->_isPinned = true;
diff --git a/src/mongo/db/cursor_manager.h b/src/mongo/db/cursor_manager.h
index 2736fd181b6..a292867cea1 100644
--- a/src/mongo/db/cursor_manager.h
+++ b/src/mongo/db/cursor_manager.h
@@ -167,7 +167,10 @@ public:
      * handle this error, as it should only happen if a misbehaving client attempts to
      * simultaneously issue two operations against the same cursor id.
      */
-    StatusWith<ClientCursorPin> pinCursor(OperationContext* opCtx, CursorId id);
+    enum AuthCheck { kCheckSession = true, kNoCheckSession = false };
+    StatusWith<ClientCursorPin> pinCursor(OperationContext* opCtx,
+                                          CursorId id,
+                                          AuthCheck checkSessionAuth = kCheckSession);
 
     /**
      * Returns an OK status if the cursor was successfully erased.
diff --git a/src/mongo/s/commands/cluster_killcursors_cmd.cpp b/src/mongo/s/commands/cluster_killcursors_cmd.cpp
index 901feca75bb..6f4bc9c296e 100644
--- a/src/mongo/s/commands/cluster_killcursors_cmd.cpp
+++ b/src/mongo/s/commands/cluster_killcursors_cmd.cpp
@@ -46,7 +46,8 @@ private:
         invariant(as);
 
         auto* opCtx = client->getOperationContext();
-        auto ccPin = grid.getCursorManager()->checkOutCursor(nss, cursorId, opCtx);
+        auto ccPin = grid.getCursorManager()->checkOutCursor(
+            nss, cursorId, opCtx, ClusterCursorManager::kNoCheckSession);
         if (!ccPin.isOK()) {
             return ccPin.getStatus();
         }
diff --git a/src/mongo/s/query/cluster_cursor_manager.cpp b/src/mongo/s/query/cluster_cursor_manager.cpp
index fd7927e90ea..253d9f84652 100644
--- a/src/mongo/s/query/cluster_cursor_manager.cpp
+++ b/src/mongo/s/query/cluster_cursor_manager.cpp
@@ -276,7 +276,10 @@ StatusWith<CursorId> ClusterCursorManager::registerCursor(
 }
 
 StatusWith<ClusterCursorManager::PinnedCursor> ClusterCursorManager::checkOutCursor(
-    const NamespaceString& nss, CursorId cursorId, OperationContext* opCtx) {
+    const NamespaceString& nss,
+    CursorId cursorId,
+    OperationContext* opCtx,
+    AuthCheck checkSessionAuth) {
     stdx::lock_guard<stdx::mutex> lk(_mutex);
 
     if (_inShutdown) {
@@ -292,9 +295,11 @@ StatusWith<ClusterCursorManager::PinnedCursor> ClusterCursorManager::checkOutCur
         return cursorNotFoundStatus(nss, cursorId);
     }
 
-    const auto cursorPrivilegeStatus = checkCursorSessionPrivilege(opCtx, entry->getLsid());
-    if (!cursorPrivilegeStatus.isOK()) {
-        return cursorPrivilegeStatus;
+    if (checkSessionAuth == kCheckSession) {
+        const auto cursorPrivilegeStatus = checkCursorSessionPrivilege(opCtx, entry->getLsid());
+        if (!cursorPrivilegeStatus.isOK()) {
+            return cursorPrivilegeStatus;
+        }
     }
 
     std::unique_ptr<ClusterClientCursor> cursor = entry->releaseCursor();
diff --git a/src/mongo/s/query/cluster_cursor_manager.h b/src/mongo/s/query/cluster_cursor_manager.h
index d82e1727e15..8357117099f 100644
--- a/src/mongo/s/query/cluster_cursor_manager.h
+++ b/src/mongo/s/query/cluster_cursor_manager.h
@@ -314,9 +314,11 @@ public:
      *
      * Does not block.
      */
+    enum AuthCheck { kCheckSession = true, kNoCheckSession = false };
     StatusWith<PinnedCursor> checkOutCursor(const NamespaceString& nss,
                                             CursorId cursorId,
-                                            OperationContext* opCtx);
+                                            OperationContext* opCtx,
+                                            AuthCheck checkSessionAuth = kCheckSession);
 
     /**
      * Informs the manager that the given cursor should be killed.  The cursor need not necessarily