From 8bbe3a3cd2bac614bcbfcf733249d6d37e911a58 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Mon, 10 Jul 2023 12:15:30 +1000 Subject: [PATCH] MDEV-21194: mariadb-install-db doesn't properly grant proxy privileges to all created user accounts mariadb-install-db --auth-root-authentication-method=normal created 4 root accounts by default, but only two of these had PROXY privilege granted. mariadb-install-db (default option --auth-root-authentication-method=socket) as non-root user also didn't grant PROXY priv to the created nonroot@localhost user. To fix this, in mysql_system_tables_data.sql, we re-use tmp_user_nopasswd as this contains the list of all root users. REPLACE INTO tmp_proxies_priv SELECT @current_hostname, IFNULL(@auth_root_socket, 'root') creates the $user@$current_host but will not error if @auth_root_socket is null. Note @current_hostname lines are filtered out with --cross-bootstrap in mariadb-install-db so it was needed to include this expression for consistency. Like the existing mysql_system_tables.sql is used to create teh $user@localhost proxies_priv. Test cases roles.acl_statistics, perfschema,privilege_table_io depends on the number of proxy users. After: --auth-root-authentication-method=normal: MariaDB [mysql]> select * from global_priv; +-----------+-------------+--------------------------------------------------------------------------------------------------------------------------+ | Host | User | Priv | +-----------+-------------+--------------------------------------------------------------------------------------------------------------------------+ | localhost | mariadb.sys | {"access":0,"plugin":"mysql_native_password","authentication_string":"","account_locked":true,"password_last_changed":0} | | localhost | root | {"access":18446744073709551615} | | bark | root | {"access":18446744073709551615} | | 127.0.0.1 | root | {"access":18446744073709551615} | | ::1 | root | {"access":18446744073709551615} | | localhost | | {} | | bark | | {} | +-----------+-------------+--------------------------------------------------------------------------------------------------------------------------+ 7 rows in set (0.001 sec) MariaDB [mysql]> select * from proxies_priv; +-----------+------+--------------+--------------+------------+---------+---------------------+ | Host | User | Proxied_host | Proxied_user | With_grant | Grantor | Timestamp | +-----------+------+--------------+--------------+------------+---------+---------------------+ | localhost | root | | | 1 | | 2023-07-10 12:12:24 | | 127.0.0.1 | root | | | 1 | | 2023-07-10 12:12:24 | | ::1 | root | | | 1 | | 2023-07-10 12:12:24 | | bark | root | | | 1 | | 2023-07-10 12:12:24 | +-----------+------+--------------+--------------+------------+---------+---------------------+ --auth-root-authentication-method=socket: MariaDB [mysql]> select * from proxies_priv; +-----------+------+--------------+--------------+------------+---------+---------------------+ | Host | User | Proxied_host | Proxied_user | With_grant | Grantor | Timestamp | +-----------+------+--------------+--------------+------------+---------+---------------------+ | localhost | root | | | 1 | | 2023-07-10 12:11:55 | | localhost | dan | | | 1 | | 2023-07-10 12:11:55 | | bark | dan | | | 1 | | 2023-07-10 12:11:55 | +-----------+------+--------------+--------------+------------+---------+---------------------+ 3 rows in set (0.017 sec) MariaDB [mysql]> select * from global_priv; +-----------+-------------+--------------------------------------------------------------------------------------------------------------------------------------------+ | Host | User | Priv | +-----------+-------------+--------------------------------------------------------------------------------------------------------------------------------------------+ | localhost | mariadb.sys | {"access":0,"plugin":"mysql_native_password","authentication_string":"","account_locked":true,"password_last_changed":0} | | localhost | root | {"access":18446744073709551615,"plugin":"mysql_native_password","authentication_string":"invalid","auth_or":[{},{"plugin":"unix_socket"}]} | | localhost | dan | {"access":18446744073709551615,"plugin":"mysql_native_password","authentication_string":"invalid","auth_or":[{},{"plugin":"unix_socket"}]} | | localhost | | {} | | bark | | {} | +-----------+-------------+--------------------------------------------------------------------------------------------------------------------------------------------+ 5 rows in set (0.000 sec) MariaDB [mysql]> show grants; +----------------------------------------------------------------------------------------------------------------------------------------+ | Grants for dan@localhost | +----------------------------------------------------------------------------------------------------------------------------------------+ | GRANT ALL PRIVILEGES ON *.* TO `dan`@`localhost` IDENTIFIED VIA mysql_native_password USING 'invalid' OR unix_socket WITH GRANT OPTION | | GRANT PROXY ON ''@'%' TO 'dan'@'localhost' WITH GRANT OPTION | +----------------------------------------------------------------------------------------------------------------------------------------+ --- mysql-test/suite/perfschema/r/privilege_table_io.result | 2 ++ mysql-test/suite/roles/acl_statistics.result | 8 ++++---- scripts/mysql_system_tables.sql | 1 + scripts/mysql_system_tables_data.sql | 6 +++--- 4 files changed, 10 insertions(+), 7 deletions(-) diff --git a/mysql-test/suite/perfschema/r/privilege_table_io.result b/mysql-test/suite/perfschema/r/privilege_table_io.result index fd56d3e1776..553744431e3 100644 --- a/mysql-test/suite/perfschema/r/privilege_table_io.result +++ b/mysql-test/suite/perfschema/r/privilege_table_io.result @@ -108,6 +108,8 @@ wait/io/table/sql/handler handler.cc: TABLE mysql db fetch NULL wait/io/table/sql/handler handler.cc: TABLE mysql proxies_priv fetch NULL wait/io/table/sql/handler handler.cc: TABLE mysql proxies_priv fetch NULL wait/io/table/sql/handler handler.cc: TABLE mysql proxies_priv fetch NULL +wait/io/table/sql/handler handler.cc: TABLE mysql proxies_priv fetch NULL +wait/io/table/sql/handler handler.cc: TABLE mysql proxies_priv fetch NULL wait/io/table/sql/handler handler.cc: TABLE mysql roles_mapping fetch NULL wait/io/table/sql/handler handler.cc: TABLE mysql tables_priv fetch NULL wait/io/table/sql/handler handler.cc: TABLE mysql tables_priv fetch NULL diff --git a/mysql-test/suite/roles/acl_statistics.result b/mysql-test/suite/roles/acl_statistics.result index f43f692cc48..172d011400b 100644 --- a/mysql-test/suite/roles/acl_statistics.result +++ b/mysql-test/suite/roles/acl_statistics.result @@ -6,7 +6,7 @@ Acl_function_grants 0 Acl_procedure_grants 0 Acl_package_spec_grants 0 Acl_package_body_grants 0 -Acl_proxy_users 2 +Acl_proxy_users 4 Acl_role_grants 0 Acl_roles 0 Acl_table_grants 1 @@ -25,7 +25,7 @@ PROCEDURE_GRANTS 0 SELECT count(*) PROXY_USERS from mysql.proxies_priv; PROXY_USERS -2 +4 SELECT count(*) ROLE_GRANTS from mysql.roles_mapping; ROLE_GRANTS 0 @@ -71,7 +71,7 @@ Acl_function_grants 3 Acl_procedure_grants 2 Acl_package_spec_grants 0 Acl_package_body_grants 0 -Acl_proxy_users 3 +Acl_proxy_users 5 Acl_role_grants 4 Acl_roles 2 Acl_table_grants 3 @@ -90,7 +90,7 @@ PROCEDURE_GRANTS 2 SELECT count(*) PROXY_USERS from mysql.proxies_priv; PROXY_USERS -3 +5 SELECT count(*) ROLE_GRANTS from mysql.roles_mapping; ROLE_GRANTS 4 diff --git a/scripts/mysql_system_tables.sql b/scripts/mysql_system_tables.sql index 26639f613de..300210c48ab 100644 --- a/scripts/mysql_system_tables.sql +++ b/scripts/mysql_system_tables.sql @@ -303,6 +303,7 @@ set @had_proxies_priv_table= @@warning_count != 0; -- and for upgrades CREATE TEMPORARY TABLE tmp_proxies_priv LIKE proxies_priv; INSERT INTO tmp_proxies_priv VALUES ('localhost', 'root', '', '', TRUE, '', now()); +REPLACE INTO tmp_proxies_priv SELECT 'localhost',IFNULL(@auth_root_socket, 'root'), '', '', TRUE, '', now() FROM DUAL; INSERT INTO proxies_priv SELECT * FROM tmp_proxies_priv WHERE @had_proxies_priv_table=0; DROP TABLE tmp_proxies_priv; diff --git a/scripts/mysql_system_tables_data.sql b/scripts/mysql_system_tables_data.sql index ab3dd704d2e..b7cab1e17f2 100644 --- a/scripts/mysql_system_tables_data.sql +++ b/scripts/mysql_system_tables_data.sql @@ -47,9 +47,9 @@ IF @auth_root_socket is not null THEN INSERT INTO global_priv SELECT * FROM tmp_user_nopasswd WHERE @had_user_table=0 AND @auth_root_socket IS NULL; INSERT INTO global_priv SELECT * FROM tmp_user_socket WHERE @had_user_table=0 AND @auth_root_socket IS NOT NULL; -DROP TABLE tmp_user_nopasswd, tmp_user_socket; CREATE TEMPORARY TABLE tmp_proxies_priv LIKE proxies_priv; -INSERT INTO tmp_proxies_priv SELECT @current_hostname, 'root', '', '', TRUE, '', now() FROM DUAL WHERE @current_hostname != 'localhost'; +INSERT INTO tmp_proxies_priv SELECT Host, User, '', '', TRUE, '', now() FROM tmp_user_nopasswd WHERE Host != 'localhost' AND @auth_root_socket IS NULL; +REPLACE INTO tmp_proxies_priv SELECT @current_hostname, IFNULL(@auth_root_socket, 'root'), '', '', TRUE, '', now() FROM DUAL WHERE @current_hostname != 'localhost'; INSERT INTO proxies_priv SELECT * FROM tmp_proxies_priv WHERE @had_proxies_priv_table=0; -DROP TABLE tmp_proxies_priv; +DROP TABLE tmp_user_nopasswd, tmp_user_socket, tmp_proxies_priv;