Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

sp_Blitz Fails when tricked in thinking you have read permissions in the model database (Check 29) #3334

Closed
Montro1981 opened this issue Sep 14, 2023 · 2 comments
Assignees
Labels

Comments

@Montro1981
Copy link
Contributor

Version of the script
Version 8.16
VersionDate 2023-08-20

What is the current behavior?
During the "declarations for First Responder Kit consistency check" step, a script is executed to retrieve all the databases where we have SELECT permissions, the model database can be included in this list.
Since we have SELECT permissions, the script assumes that we can also view the objects in the current security context.

If the current behavior is a bug, please provide the steps to reproduce.
Create a user on the SQL server with VIEW SERVER STATE rights that is not mapped to the master or model databases.
Execute: SELECT 1/0 FROM model.sys.objects;
This should fail.

What is the expected behavior?
A sanity check must be included to verify that we can view the objects in the model database. If we can't view the objects Check 29 must be added to the #SkipChecks table

Which versions of SQL Server and which OS are affected by this issue? Did this work in previous versions of our procedures?
SQL server 2017 (Web)

@Montro1981 Montro1981 changed the title [sp-Blitz] sp_Blitz Fails when tricked in thinking you have read permissions in the model database (Check 29) sp_Blitz Fails when tricked in thinking you have read permissions in the model database (Check 29) Sep 14, 2023
@BrentOzar
Copy link
Member

I closed the pull request because it added a confusing parameter. If you're okay with just skipping model, then use the existing @SkipModel parameter. Otherwise, to solve the problem you're discussing here, your original design would be correct:

A sanity check must be included to verify that we can view the objects in the model database. If we can't view the objects Check 29 must be added to the #SkipChecks table

If you don't have the time to do that, I totally understand - just let me know and I can close this issue.

BrentOzar added a commit that referenced this issue Sep 21, 2023
Issue #3334: sp_Blitz Fails because of permissions
@BrentOzar BrentOzar added this to the 2023-10 Release milestone Sep 21, 2023
@BrentOzar
Copy link
Member

Thanks for the pull request! Looks good, merging into the dev branch, will be in the next release with credit to you in the release notes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants