database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2026-10-23 18:49:29 +03:00
Code Activity

MDEV-37256 Add permission check for LOAD INDEX INTO CACHE and CACHE INDEX

Browse Source 
Previously, no access check was done for these commands. Now, we require
any table-level permission, which consistent with other admin commands
like CHECKSUM.
This commit is contained in:
Vladislav Vaintroub
2026-03-16 16:31:31 +01:00
parent b09ce6268a
commit 8bb4e20ae7
3 changed files with 67 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
mysql-test/main/grant5.result
View File

@@ -472,3 +472,25 @@ DROP USER foo@localhost;
CREATE USER foo@localhost IDENTIFIED VIA not_installed_plugin;
ERROR HY000: Plugin 'not_installed_plugin' is not loaded
# End of 10.5 tests
#
# MDEV-37256: The permission check of LOAD INDEX INTO CACHE and CACHE INDEX is broken
#
create table t1 (c int primary key);
insert t1 values (1),(2);
create user foo@localhost;
connect foo,localhost,foo;
use test;
ERROR 42000: Access denied for user 'foo'@'localhost' to database 'test'
cache index test.t1 in default;
ERROR 42000: CACHE INDEX command denied to user 'foo'@'localhost' for table `test`.`t1`
load index into cache test.t1 key (primary);
ERROR 42000: LOAD INDEX INTO CACHE command denied to user 'foo'@'localhost' for table `test`.`t1`
cache index test.t2 in default;
ERROR 42000: CACHE INDEX command denied to user 'foo'@'localhost' for table `test`.`t2`
load index into cache test.t2 key (i2);
ERROR 42000: LOAD INDEX INTO CACHE command denied to user 'foo'@'localhost' for table `test`.`t2`
disconnect foo;
connection default;
drop table t1;
drop user foo@localhost;
# End of 10.11 tests

26
mysql-test/main/grant5.test
View File

@@ -436,3 +436,29 @@ DROP USER foo@localhost;
CREATE USER foo@localhost IDENTIFIED VIA not_installed_plugin;
--echo # End of 10.5 tests
--echo #
--echo # MDEV-37256: The permission check of LOAD INDEX INTO CACHE and CACHE INDEX is broken
--echo #
create table t1 (c int primary key);
insert t1 values (1),(2);
create user foo@localhost;
--connect foo,localhost,foo
--error ER_DBACCESS_DENIED_ERROR
use test;
--error ER_TABLEACCESS_DENIED_ERROR
cache index test.t1 in default;
--error ER_TABLEACCESS_DENIED_ERROR
load index into cache test.t1 key (primary);
--error ER_TABLEACCESS_DENIED_ERROR
# Check that the error for non-existing and existing tables are the same
cache index test.t2 in default;
--error ER_TABLEACCESS_DENIED_ERROR
load index into cache test.t2 key (i2);
--disconnect foo
--connection default
# Cleanup
drop table t1;
drop user foo@localhost;
--echo # End of 10.11 tests

19
sql/sql_admin.cc
View File

@@ -1500,6 +1500,15 @@ bool mysql_assign_to_keycache(THD* thd, TABLE_LIST* tables,
KEY_CACHE *key_cache;
DBUG_ENTER("mysql_assign_to_keycache");
if (check_some_access(thd, TABLE_ACLS, tables))
{
my_error(ER_TABLEACCESS_DENIED_ERROR, MYF(0), "CACHE INDEX",
thd->security_ctx->priv_user,
thd->security_ctx->host_or_ip,
tables->db.str, tables->table_name.str);
DBUG_RETURN(TRUE);
}
THD_STAGE_INFO(thd, stage_finding_key_cache);
check_opt.init();
mysql_mutex_lock(&LOCK_global_system_variables);
@@ -1539,6 +1548,16 @@ bool mysql_assign_to_keycache(THD* thd, TABLE_LIST* tables,
bool mysql_preload_keys(THD* thd, TABLE_LIST* tables)
{
DBUG_ENTER("mysql_preload_keys");
if (check_some_access(thd, TABLE_ACLS, tables))
{
my_error(ER_TABLEACCESS_DENIED_ERROR, MYF(0), "LOAD INDEX INTO CACHE",
thd->security_ctx->priv_user,
thd->security_ctx->host_or_ip,
tables->db.str, tables->table_name.str);
DBUG_RETURN(TRUE);
}
/*
We cannot allow concurrent inserts. The storage engine reads
directly from the index file, bypassing the cache. It could read