redis
config_error
ai_generated
true
ERR 用户 'myuser' 的 ACL 类别 'write' 和 'readonly' 不能组合
ERR ACL categories 'write' and 'readonly' cannot be combined for user 'myuser'
ID: redis/acl-category-inheritance-conflict
95%修复率
88%置信度
1证据数
2024-07-10首次发现
版本兼容性
| 版本 | 状态 | 引入 | 弃用 | 备注 |
|---|---|---|---|---|
| Redis 7.0.0 | active | — | — | — |
| Redis 7.2.0 | active | — | — | — |
| Redis 7.4.0 | active | — | — | — |
根因分析
用户配置包含冲突的 ACL 类别权限；'write' 允许写入命令，而 'readonly' 限制为只读，导致无效状态。
English
User configuration contains conflicting ACL category permissions; 'write' allows write commands while 'readonly' restricts to read-only, causing an invalid state.
官方文档
https://redis.io/docs/latest/operate/oss_and_stack/management/security/acl/解决方案
-
使用 ACL SETUSER myuser -readonly（或 -write）移除冲突的类别，确保只有一组权限处于活动状态。
-
使用单一类别重新创建用户：ACL SETUSER myuser on >password +@readonly ~* 授予只读访问权限，不包含写入权限。
-
审计 ACL 规则文件（例如 users.acl）并手动编辑以移除冲突行，然后使用 ACL LOAD 重新加载。
无效尝试
常见但无效的做法:
-
90% 失败
Adding more conflicting categories (e.g., both 'admin' and 'restricted') only exacerbates the conflict without resolving it.
-
95% 失败
Deleting the user and recreating with the same conflicting categories will reproduce the same error.
-
70% 失败
Ignoring the error and proceeding with other operations may leave the user in an inconsistent state, causing unpredictable behavior.