Skip to content

Commit 05f99cc

Browse files
BrentOzarBrentOzar
authored
Merge pull request #3300 from erikdarlingdata/Issue_3292
Add some permissions checks to sp_Blitz
2 parents ba1bb20 + d639835 commit 05f99cc

File tree

1 file changed

+231
-49
lines changed

1 file changed

+231
-49
lines changed

‎sp_Blitz.sql‎

Lines changed: 231 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -186,11 +186,129 @@ AS
186186
,@CurrentComponentVersionCheckModeOK BIT
187187
,@canExitLoop BIT
188188
,@frkIsConsistent BIT
189-
,@NeedToTurnNumericRoundabortBackOn BIT;
189+
,@NeedToTurnNumericRoundabortBackOn BIT
190+
,@sa bit = 1
191+
,@SUSER_NAME sysname = SUSER_SNAME()
192+
,@SkipDBCC bit = 0
193+
,@SkipTrace bit = 0
194+
,@SkipXPRegRead bit = 0
195+
,@SkipXPFixedDrives bit = 0
196+
,@SkipXPCMDShell bit = 0
197+
,@SkipMaster bit = 0
198+
,@SkipMSDB bit = 0
199+
,@SkipModel bit = 0
200+
,@SkipTempDB bit = 0
201+
,@SkipValidateLogins bit = 0;
202+
203+
DECLARE
204+
@db_perms table
205+
(
206+
database_name sysname,
207+
permission_name sysname
208+
);
209+
210+
INSERT
211+
@db_perms
212+
(
213+
database_name,
214+
permission_name
215+
)
216+
SELECT
217+
database_name =
218+
DB_NAME(d.database_id),
219+
fmp.permission_name
220+
FROM sys.databases AS d
221+
CROSS APPLY fn_my_permissions(d.name, 'DATABASE') AS fmp
222+
WHERE fmp.permission_name = N'SELECT' /*Databases where we don't have read permissions*/
190223

191224
/* End of declarations for First Responder Kit consistency check:*/
192225
;
193226

227+
/*Starting permissions checks here, but only if we're not a sysadmin*/
228+
IF
229+
(
230+
SELECT
231+
sa =
232+
ISNULL
233+
(
234+
IS_SRVROLEMEMBER(N'sysadmin'),
235+
0
236+
)
237+
) = 0
238+
BEGIN
239+
IF @Debug IN (1, 2) RAISERROR('User not SA, checking permissions', 0, 1) WITH NOWAIT;
240+
241+
SET @sa = 0; /*Setting this to 0 to skip DBCC COMMANDS*/
242+
243+
IF NOT EXISTS
244+
(
245+
SELECT
246+
1/0
247+
FROM sys.fn_my_permissions(NULL, NULL) AS fmp
248+
WHERE fmp.permission_name = N'VIEW SERVER STATE'
249+
)
250+
BEGIN
251+
RAISERROR('The user %s does not have VIEW SERVER STATE permissions.', 0, 11, @SUSER_NAME) WITH NOWAIT;
252+
RETURN;
253+
END; /*If we don't have this, we can't do anything at all.*/
254+
255+
IF NOT EXISTS
256+
(
257+
SELECT
258+
1/0
259+
FROM fn_my_permissions(N'sys.traces', N'OBJECT') AS fmp
260+
WHERE fmp.permission_name = N'ALTER'
261+
)
262+
BEGIN
263+
SET @SkipTrace = 1;
264+
END; /*We need this permission to execute trace stuff, apparently*/
265+
266+
IF NOT EXISTS
267+
(
268+
SELECT
269+
1/0
270+
FROM fn_my_permissions(N'xp_regread', N'OBJECT') AS fmp
271+
WHERE fmp.permission_name = N'EXECUTE'
272+
)
273+
BEGIN
274+
SET @SkipXPRegRead = 1;
275+
END; /*Need execute on xp_regread*/
276+
277+
IF NOT EXISTS
278+
(
279+
SELECT
280+
1/0
281+
FROM fn_my_permissions(N'xp_fixeddrives', N'OBJECT') AS fmp
282+
WHERE fmp.permission_name = N'EXECUTE'
283+
)
284+
BEGIN
285+
SET @SkipXPFixedDrives = 1;
286+
END; /*Need execute on xp_fixeddrives*/
287+
288+
IF NOT EXISTS
289+
(
290+
SELECT
291+
1/0
292+
FROM fn_my_permissions(N'xp_cmdshell', N'OBJECT') AS fmp
293+
WHERE fmp.permission_name = N'EXECUTE'
294+
)
295+
BEGIN
296+
SET @SkipXPCMDShell = 1;
297+
END; /*Need execute on xp_cmdshell*/
298+
299+
IF NOT EXISTS
300+
(
301+
SELECT
302+
1/0
303+
FROM fn_my_permissions(N'sp_validatelogins', N'OBJECT') AS fmp
304+
WHERE fmp.permission_name = N'EXECUTE'
305+
)
306+
BEGIN
307+
SET @SkipValidateLogins = 1;
308+
END; /*Need execute on sp_validatelogins*/
309+
310+
END;
311+
194312
SET @crlf = NCHAR(13) + NCHAR(10);
195313
SET @ResultText = 'sp_Blitz Results: ' + @crlf;
196314

@@ -331,6 +449,66 @@ AS
331449
OR LOWER(d.name) IN ('dbatools', 'dbadmin', 'dbmaintenance'))
332450
OPTION(RECOMPILE);
333451

452+
/*Skip checks for database where we don't have read permissions*/
453+
INSERT INTO
454+
#SkipChecks
455+
(
456+
DatabaseName
457+
)
458+
SELECT
459+
DB_NAME(d.database_id)
460+
FROM sys.databases AS d
461+
WHERE NOT EXISTS
462+
(
463+
SELECT
464+
1/0
465+
FROM @db_perms AS dp
466+
WHERE dp.database_name = DB_NAME(d.database_id)
467+
);
468+
469+
/*Skip individial checks where we don't have permissions*/
470+
INSERT #SkipChecks (DatabaseName, CheckID, ServerName)
471+
SELECT
472+
v.*
473+
FROM (VALUES(NULL, 29, NULL)) AS v (DatabaseName, CheckID, ServerName) /*Looks for user tables in model*/
474+
WHERE NOT EXISTS (SELECT 1/0 FROM @db_perms AS dp WHERE dp.database_name = 'model');
475+
476+
INSERT #SkipChecks (DatabaseName, CheckID, ServerName)
477+
SELECT
478+
v.*
479+
FROM (VALUES(NULL, 68, NULL)) AS v (DatabaseName, CheckID, ServerName) /*DBCC command*/
480+
WHERE @sa = 0;
481+
482+
INSERT #SkipChecks (DatabaseName, CheckID, ServerName)
483+
SELECT
484+
v.*
485+
FROM (VALUES(NULL, 69, NULL)) AS v (DatabaseName, CheckID, ServerName) /*DBCC command*/
486+
WHERE @sa = 0;
487+
488+
INSERT #SkipChecks (DatabaseName, CheckID, ServerName)
489+
SELECT
490+
v.*
491+
FROM (VALUES(NULL, 92, NULL)) AS v (DatabaseName, CheckID, ServerName) /*xp_fixeddrives*/
492+
WHERE @SkipXPFixedDrives = 1;
493+
494+
INSERT #SkipChecks (DatabaseName, CheckID, ServerName)
495+
SELECT
496+
v.*
497+
FROM (VALUES(NULL, 211, NULL)) AS v (DatabaseName, CheckID, ServerName) /*xp_regread*/
498+
WHERE @SkipXPRegRead = 1;
499+
500+
INSERT #SkipChecks (DatabaseName, CheckID, ServerName)
501+
SELECT
502+
v.*
503+
FROM (VALUES(NULL, 212, NULL)) AS v (DatabaseName, CheckID, ServerName) /*xp_regread*/
504+
WHERE @SkipXPCMDShell = 1;
505+
506+
INSERT #SkipChecks (DatabaseName, CheckID, ServerName)
507+
SELECT
508+
v.*
509+
FROM (VALUES(NULL, 2301, NULL)) AS v (DatabaseName, CheckID, ServerName) /*sp_validatelogins*/
510+
WHERE @SkipValidateLogins = 1
511+
334512
IF(OBJECT_ID('tempdb..#InvalidLogins') IS NOT NULL)
335513
BEGIN
336514
EXEC sp_executesql N'DROP TABLE #InvalidLogins;';
@@ -372,7 +550,8 @@ AS
372550
SELECT @IsWindowsOperatingSystem = 1 ;
373551
END;
374552

375-
IF NOT EXISTS ( SELECT 1
553+
554+
IF NOT EXISTS ( SELECT 1
376555
FROM #SkipChecks
377556
WHERE DatabaseName IS NULL AND CheckID = 106 )
378557
AND (select convert(int,value_in_use) from sys.configurations where name = 'default trace enabled' ) = 1
@@ -4158,53 +4337,56 @@ AS
41584337

41594338
/* First, let's check that there aren't any issues with the trace files */
41604339
BEGIN TRY
4161-
4162-
INSERT INTO #fnTraceGettable
4163-
( TextData ,
4164-
DatabaseName ,
4165-
EventClass ,
4166-
Severity ,
4167-
StartTime ,
4168-
EndTime ,
4169-
Duration ,
4170-
NTUserName ,
4171-
NTDomainName ,
4172-
HostName ,
4173-
ApplicationName ,
4174-
LoginName ,
4175-
DBUserName
4176-
)
4177-
SELECT TOP 20000
4178-
CONVERT(NVARCHAR(4000),t.TextData) ,
4179-
t.DatabaseName ,
4180-
t.EventClass ,
4181-
t.Severity ,
4182-
t.StartTime ,
4183-
t.EndTime ,
4184-
t.Duration ,
4185-
t.NTUserName ,
4186-
t.NTDomainName ,
4187-
t.HostName ,
4188-
t.ApplicationName ,
4189-
t.LoginName ,
4190-
t.DBUserName
4191-
FROM sys.fn_trace_gettable(@base_tracefilename, DEFAULT) t
4192-
WHERE
4193-
(
4194-
t.EventClass = 22
4195-
AND t.Severity >= 17
4196-
AND t.StartTime > DATEADD(dd, -30, GETDATE())
4197-
)
4198-
OR
4199-
(
4200-
t.EventClass IN (92, 93)
4201-
AND t.StartTime > DATEADD(dd, -30, GETDATE())
4202-
AND t.Duration > 15000000
4203-
)
4204-
OR
4205-
(
4206-
t.EventClass IN (94, 95, 116)
4207-
)
4340+
4341+
IF @SkipTrace = 0
4342+
BEGIN
4343+
INSERT INTO #fnTraceGettable
4344+
( TextData ,
4345+
DatabaseName ,
4346+
EventClass ,
4347+
Severity ,
4348+
StartTime ,
4349+
EndTime ,
4350+
Duration ,
4351+
NTUserName ,
4352+
NTDomainName ,
4353+
HostName ,
4354+
ApplicationName ,
4355+
LoginName ,
4356+
DBUserName
4357+
)
4358+
SELECT TOP 20000
4359+
CONVERT(NVARCHAR(4000),t.TextData) ,
4360+
t.DatabaseName ,
4361+
t.EventClass ,
4362+
t.Severity ,
4363+
t.StartTime ,
4364+
t.EndTime ,
4365+
t.Duration ,
4366+
t.NTUserName ,
4367+
t.NTDomainName ,
4368+
t.HostName ,
4369+
t.ApplicationName ,
4370+
t.LoginName ,
4371+
t.DBUserName
4372+
FROM sys.fn_trace_gettable(@base_tracefilename, DEFAULT) t
4373+
WHERE
4374+
(
4375+
t.EventClass = 22
4376+
AND t.Severity >= 17
4377+
AND t.StartTime > DATEADD(dd, -30, GETDATE())
4378+
)
4379+
OR
4380+
(
4381+
t.EventClass IN (92, 93)
4382+
AND t.StartTime > DATEADD(dd, -30, GETDATE())
4383+
AND t.Duration > 15000000
4384+
)
4385+
OR
4386+
(
4387+
t.EventClass IN (94, 95, 116)
4388+
)
4389+
END;
42084390

42094391
SET @TraceFileIssue = 0
42104392

0 commit comments

Comments
 (0)