{"record":{"id":"1cb5ab54c219d882","repo":"apache/cassandra","slug":"altering-permissions-on-builtin-functions-is-not-s","errorCode":null,"errorMessage":"Altering permissions on builtin functions is not supported","messagePattern":"Altering permissions on builtin functions is not supported","errorType":"exception","errorClass":"InvalidRequestException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/auth/FunctionResource.java","lineNumber":310,"sourceCode":"        switch (level)\n        {\n            case ROOT:\n            case KEYSPACE:\n                return COLLECTION_LEVEL_PERMISSIONS;\n            case FUNCTION:\n            {\n                Optional<UserFunction> function = Schema.instance.findUserFunction(getFunctionName(), argTypes);\n                assert function.isPresent() : \"Unable to find function object for resource \" + toString();\n                return function.get().isAggregate() ? AGGREGATE_FUNCTION_PERMISSIONS : SCALAR_FUNCTION_PERMISSIONS;\n            }\n        }\n        throw new AssertionError();\n    }\n\n    private void validate()\n    {\n        if (SchemaConstants.SYSTEM_KEYSPACE_NAME.equals(keyspace))\n            throw new InvalidRequestException(\"Altering permissions on builtin functions is not supported\");\n    }\n\n    public int compareTo(FunctionResource o)\n    {\n        return this.name.compareTo(o.name);\n    }\n\n    @Override\n    public String toString()\n    {\n        switch (level)\n        {\n            case ROOT:\n                return \"<all functions>\";\n            case KEYSPACE:\n                return String.format(\"<all functions in %s>\", keyspace);\n            case FUNCTION:\n                return String.format(\"<function %s.%s(%s)>\",","sourceCodeStart":292,"sourceCodeEnd":328,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/auth/FunctionResource.java#L292-L328","documentation":"FunctionResource.validate rejects any function-level resource whose keyspace is the system keyspace. Granting or revoking permissions on built-in system functions is not permitted, so the operation fails with InvalidRequestException before touching the permissions store.","triggerScenarios":"Issuing GRANT/REVOKE/LIST PERMISSIONS ON FUNCTION system.<fn>(...) — e.g. attempting to grant EXECUTE on a function in the 'system' keyspace.","commonSituations":"Scripts that iterate all keyspaces including system ones and grant EXECUTE on every function; automations that mirror permissions across keyspaces without filtering system keyspaces.","solutions":["Exclude the system keyspaces (system, system_schema, etc.) from functions you grant permissions on","Skip or guard the GRANT/REVOKE statement when FunctionResource.getKeyspace() equals SchemaConstants.SYSTEM_KEYSPACE_NAME","If the goal was a user function, correct the keyspace qualifier in the statement"],"exampleFix":"// before\nGRANT EXECUTE ON FUNCTION system.somefn(int) TO role1;\n// after\nGRANT EXECUTE ON FUNCTION myks.somefn(int) TO role1;","handlingStrategy":"validation","validationCode":"if (SchemaConstants.SYSTEM_KEYSPACE_NAME.equals(fnResource.getKeyspace()))\n    throw new IllegalArgumentException(\"Cannot grant permissions on system-keyspace functions\");","typeGuard":null,"tryCatchPattern":"try { execute(grant); } catch (InvalidRequestException e) { /* skip system-keyspace functions */ }","preventionTips":["Filter out system keyspaces when enumerating functions for permission grants","Never mirror permissions blindly across all keyspaces","Check the keyspace qualifier in grant statements before executing"],"tags":["cassandra","auth","permissions","system-keyspace"],"backgroundTag":"unsupported-operation","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}