Bug#32167 another privilege bypass with DATA/INDEX DIRECORY(3rd version for 5.1)

added new function test_if_data_home_dir() which checks that path does not contain mysql data home directory. Using of 'mysql data home'/'any db name' in DATA DIRECTORY & INDEX DIRECTORY is disallowed
2025-09-02 09:41:40 +03:00 · 2008-02-28 16:46:52 +04:00
parent 314b2377c6
commit 9d42a09675
13 changed files with 327 additions and 146 deletions
--- a/mysql-test/r/partition.result
+++ b/mysql-test/r/partition.result
@@ -1320,6 +1320,34 @@ ERROR 42000: You have an error in your SQL syntax; check the manual that corresp
 ALTER TABLE t1 ANALYZE PARTITION p1 EXTENDED;
 ERROR 42000: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'EXTENDED' at line 1
 DROP TABLE t1;
+CREATE TABLE t1(a INT)
+PARTITION BY KEY (a)
+(PARTITION p0 DATA DIRECTORY 'TEST_DIR/master-data/test');
+ERROR HY000: Incorrect arguments to DATA DIRECORY
+CREATE TABLE t1(a INT)
+PARTITION BY KEY (a)
+(PARTITION p0 INDEX DIRECTORY 'TEST_DIR/master-data/test');
+ERROR HY000: Incorrect arguments to INDEX DIRECORY
+CREATE TABLE ts (id INT, purchased DATE)
+PARTITION BY RANGE(YEAR(purchased))
+SUBPARTITION BY HASH(TO_DAYS(purchased)) (
+PARTITION p0 VALUES LESS THAN (1990) (
+SUBPARTITION s0a
+DATA DIRECTORY = 'TEST_DIR/master-data/test',
+SUBPARTITION s0b
+DATA DIRECTORY = 'TEST_DIR/master-data/test'
+));
+ERROR HY000: Incorrect arguments to DATA DIRECORY
+CREATE TABLE ts (id INT, purchased DATE)
+PARTITION BY RANGE(YEAR(purchased))
+SUBPARTITION BY HASH(TO_DAYS(purchased)) (
+PARTITION p0 VALUES LESS THAN (1990) (
+SUBPARTITION s0a
+INDEX DIRECTORY = 'TEST_DIR/master-data/test',
+SUBPARTITION s0b
+INDEX DIRECTORY = 'TEST_DIR/master-data/test'
+));
+ERROR HY000: Incorrect arguments to INDEX DIRECORY
 CREATE TABLE t1 (s1 BIGINT UNSIGNED)
 PARTITION BY RANGE (s1) (
 PARTITION p0 VALUES LESS THAN (0), 
--- a/mysql-test/r/partition_not_windows.result
+++ b/mysql-test/r/partition_not_windows.result
@@ -1,13 +1,13 @@
 create table t1 (a int) engine myisam
 partition by range (a)
 subpartition by hash (a)
-(partition p0 VALUES LESS THAN (1) DATA DIRECTORY = 'MYSQLTEST_VARDIR/master-data/tmpdata' INDEX DIRECTORY = 'MYSQLTEST_VARDIR/master-data/tmpinx'
+(partition p0 VALUES LESS THAN (1) DATA DIRECTORY = 'MYSQLTEST_VARDIR/tmp' INDEX DIRECTORY = 'MYSQLTEST_VARDIR/tmp'
 (SUBPARTITION subpart00, SUBPARTITION subpart01));
 Checking if file exists before alter
 ALTER TABLE t1 REORGANIZE PARTITION p0 INTO
-(partition p1 VALUES LESS THAN (1) DATA DIRECTORY = 'MYSQLTEST_VARDIR/master-data/tmpdata' INDEX DIRECTORY = 'MYSQLTEST_VARDIR/master-data/tmpinx'
+(partition p1 VALUES LESS THAN (1) DATA DIRECTORY = 'MYSQLTEST_VARDIR/tmp' INDEX DIRECTORY = 'MYSQLTEST_VARDIR/tmp'
 (SUBPARTITION subpart10, SUBPARTITION subpart11),
-partition p2 VALUES LESS THAN (2) DATA DIRECTORY = 'MYSQLTEST_VARDIR/master-data/tmpdata' INDEX DIRECTORY = 'MYSQLTEST_VARDIR/master-data/tmpinx'
+partition p2 VALUES LESS THAN (2) DATA DIRECTORY = 'MYSQLTEST_VARDIR/tmp' INDEX DIRECTORY = 'MYSQLTEST_VARDIR/tmp'
 (SUBPARTITION subpart20, SUBPARTITION subpart21));
 Checking if file exists after alter
 drop table t1;
--- a/mysql-test/r/partition_symlink.result
+++ b/mysql-test/r/partition_symlink.result
@@ -13,11 +13,11 @@ USE test;
 CREATE TABLE t1 (a INT)
 PARTITION BY LIST (a) (
 PARTITION p0 VALUES IN (0)
-DATA DIRECTORY 'MYSQLTEST_VARDIR/master-data/mysqltest2'
-     INDEX DIRECTORY 'MYSQLTEST_VARDIR/master-data/mysqltest2',
+DATA DIRECTORY 'MYSQLTEST_VARDIR/tmp'
+     INDEX DIRECTORY 'MYSQLTEST_VARDIR/tmp',
 PARTITION p1 VALUES IN (1)
-DATA DIRECTORY 'MYSQLTEST_VARDIR/master-data/test'
-     INDEX DIRECTORY 'MYSQLTEST_VARDIR/master-data/test',
+DATA DIRECTORY 'MYSQLTEST_VARDIR/tmp'
+     INDEX DIRECTORY 'MYSQLTEST_VARDIR/tmp',
 PARTITION p2 VALUES IN (2)
 );
 # without the patch for bug#32091 this would create
@@ -49,32 +49,32 @@ USE mysqltest2;
 CREATE TABLE t1 (a INT)
 PARTITION BY LIST (a) (
 PARTITION p0 VALUES IN (0)
-DATA DIRECTORY 'MYSQLTEST_VARDIR/master-data/mysqltest2'
-     INDEX DIRECTORY 'MYSQLTEST_VARDIR/master-data/mysqltest2',
+DATA DIRECTORY 'MYSQLTEST_VARDIR/tmp'
+     INDEX DIRECTORY 'MYSQLTEST_VARDIR/tmp',
 PARTITION p1 VALUES IN (1)
-DATA DIRECTORY 'MYSQLTEST_VARDIR/master-data/test'
-     INDEX DIRECTORY 'MYSQLTEST_VARDIR/master-data/test'
+DATA DIRECTORY 'MYSQLTEST_VARDIR/tmp'
+     INDEX DIRECTORY 'MYSQLTEST_VARDIR/tmp'
   );
 # user mysqltest_1:
 USE test;
 CREATE TABLE t1 (a INT)
 PARTITION BY LIST (a) (
 PARTITION p0 VALUES IN (0)
-DATA DIRECTORY 'MYSQLTEST_VARDIR/master-data/mysqltest2'
-     INDEX DIRECTORY 'MYSQLTEST_VARDIR/master-data/mysqltest2',
+DATA DIRECTORY 'MYSQLTEST_VARDIR/tmp'
+     INDEX DIRECTORY 'MYSQLTEST_VARDIR/tmp',
 PARTITION p1 VALUES IN (1)
-DATA DIRECTORY 'MYSQLTEST_VARDIR/master-data/test'
-     INDEX DIRECTORY 'MYSQLTEST_VARDIR/master-data/test'
+DATA DIRECTORY 'MYSQLTEST_VARDIR/tmp'
+     INDEX DIRECTORY 'MYSQLTEST_VARDIR/tmp'
   );
 Got one of the listed errors
 CREATE TABLE t1 (a INT)
 PARTITION BY LIST (a) (
 PARTITION p0 VALUES IN (0)
-DATA DIRECTORY 'MYSQLTEST_VARDIR/master-data/test'
-     INDEX DIRECTORY 'MYSQLTEST_VARDIR/master-data/test',
+DATA DIRECTORY 'MYSQLTEST_VARDIR/tmp'
+     INDEX DIRECTORY 'MYSQLTEST_VARDIR/tmp',
 PARTITION p1 VALUES IN (1)
-DATA DIRECTORY 'MYSQLTEST_VARDIR/master-data/mysqltest2'
-     INDEX DIRECTORY 'MYSQLTEST_VARDIR/master-data/mysqltest2'
+DATA DIRECTORY 'MYSQLTEST_VARDIR/tmp'
+     INDEX DIRECTORY 'MYSQLTEST_VARDIR/tmp'
  );
 Got one of the listed errors
 # user root (cleanup):
--- a/mysql-test/r/symlink.result
+++ b/mysql-test/r/symlink.result
@@ -100,23 +100,15 @@ t1	CREATE TABLE `t1` (
 ) ENGINE=MyISAM DEFAULT CHARSET=latin1
 drop table t1;
 CREATE TABLE t1(a INT)
-DATA DIRECTORY='TEST_DIR/master-data/mysql'
-INDEX DIRECTORY='TEST_DIR/master-data/mysql';
-RENAME TABLE t1 TO user;
-ERROR HY000: Can't create/write to file 'TEST_DIR/master-data/mysql/user.MYI' (Errcode: 17)
-DROP TABLE t1;
-show create table t1;
-Table	Create Table
-t1	CREATE TABLE `t1` (
-  `i` int(11) DEFAULT NULL
-) ENGINE=MyISAM DEFAULT CHARSET=latin1
-drop table t1;
-show create table t1;
-Table	Create Table
-t1	CREATE TABLE `t1` (
-  `i` int(11) DEFAULT NULL
-) ENGINE=MyISAM DEFAULT CHARSET=latin1
-drop table t1;
+DATA DIRECTORY='TEST_DIR/tmp'
+INDEX DIRECTORY='TEST_DIR/tmp';
+ERROR HY000: Can't create/write to file 'TEST_DIR/tmp/t1.MYI' (Errcode: 17)
+CREATE TABLE t2(a INT)
+DATA DIRECTORY='TEST_DIR/tmp'
+INDEX DIRECTORY='TEST_DIR/tmp';
+RENAME TABLE t2 TO t1;
+ERROR HY000: Can't create/write to file 'TEST_DIR/tmp/t1.MYI' (Errcode: 17)
+DROP TABLE t2;
 show create table t1;
 Table	Create Table
 t1	CREATE TEMPORARY TABLE `t1` (
@@ -139,26 +131,25 @@ a
 42
 drop table t1;
 End of 4.1 tests
-CREATE DATABASE db1;
-CREATE DATABASE db2;
-USE db2;
-INSERT INTO db2.t1 VALUES (1);
-SELECT * FROM db2.t1;
-b
-1
-RESET QUERY CACHE;
-USE db1;
 SET SESSION keep_files_on_create = TRUE;
 CREATE TABLE t1 (a INT) ENGINE MYISAM;
-Got one of the listed errors
-CREATE TABLE t3 (a INT) Engine=MyISAM;
-INSERT INTO t3 VALUES (1),(2),(3);
-TRUNCATE TABLE t3;
-SELECT * from t3;
-a
-SET SESSION keep_files_on_create = DEFAULT;
-DROP TABLE db2.t1, db1.t3;
-DROP DATABASE db1;
-DROP DATABASE db2;
-USE test;
+ERROR HY000: Can't create/write to file './test/t1.MYD' (Errcode: 17)
+SET SESSION keep_files_on_create = FALSE;
+CREATE TABLE t1 (a INT) ENGINE MYISAM;
+DROP TABLE t1;
 End of 5.0 tests
+CREATE TABLE t1(a INT)
+INDEX DIRECTORY='TEST_DIR/master-data/mysql';
+ERROR HY000: Incorrect arguments to INDEX DIRECORY
+CREATE TABLE t1(a INT)
+DATA DIRECTORY='TEST_DIR/master-data/test';
+ERROR HY000: Incorrect arguments to DATA DIRECORY
+CREATE TABLE t1(a INT)
+DATA DIRECTORY='TEST_DIR/master-data/';
+DROP TABLE t1;
+CREATE TABLE t1(a INT)
+INDEX DIRECTORY='TEST_DIR/master-data';
+DROP TABLE t1;
+CREATE TABLE t1(a INT)
+INDEX DIRECTORY='TEST_DIR/master-data_var';
+ERROR HY000: Can't create/write to file 'TEST_DIR/master-data_var/t1.MYI' (Errcode: 2)
--- a/mysql-test/t/partition.test
+++ b/mysql-test/t/partition.test
@@ -1407,8 +1407,8 @@ eval create table t2 (i int )
 partition by range (i)
 (
    partition p01 values less than (1000)
-    data directory="$MYSQLTEST_VARDIR/master-data/test/"
-    index directory="$MYSQLTEST_VARDIR/master-data/test/"
+    data directory="$MYSQLTEST_VARDIR/tmp/"
+    index directory="$MYSQLTEST_VARDIR/tmp/"
 );
 enable_query_log;

@@ -1574,6 +1574,44 @@ ALTER TABLE t1 OPTIMIZE PARTITION p1 EXTENDED;
 ALTER TABLE t1 ANALYZE PARTITION p1 EXTENDED;
 DROP TABLE t1;

+#
+# Bug#32167: another privilege bypass with DATA/INDEX DIRECTORY
+#
+--replace_result $MYSQLTEST_VARDIR TEST_DIR
+--error 1210
+eval CREATE TABLE t1(a INT)
+PARTITION BY KEY (a)
+(PARTITION p0 DATA DIRECTORY '$MYSQLTEST_VARDIR/master-data/test');
+--replace_result $MYSQLTEST_VARDIR TEST_DIR
+--error 1210
+eval CREATE TABLE t1(a INT)
+PARTITION BY KEY (a)
+(PARTITION p0 INDEX DIRECTORY '$MYSQLTEST_VARDIR/master-data/test');
+
+--replace_result $MYSQLTEST_VARDIR TEST_DIR
+--error 1210
+eval CREATE TABLE ts (id INT, purchased DATE)
+PARTITION BY RANGE(YEAR(purchased))
+SUBPARTITION BY HASH(TO_DAYS(purchased)) (
+PARTITION p0 VALUES LESS THAN (1990) (
+SUBPARTITION s0a
+  DATA DIRECTORY = '$MYSQLTEST_VARDIR/master-data/test',
+SUBPARTITION s0b
+  DATA DIRECTORY = '$MYSQLTEST_VARDIR/master-data/test'
+));
+
+--replace_result $MYSQLTEST_VARDIR TEST_DIR
+--error 1210
+eval CREATE TABLE ts (id INT, purchased DATE)
+PARTITION BY RANGE(YEAR(purchased))
+SUBPARTITION BY HASH(TO_DAYS(purchased)) (
+PARTITION p0 VALUES LESS THAN (1990) (
+SUBPARTITION s0a
+  INDEX DIRECTORY = '$MYSQLTEST_VARDIR/master-data/test',
+SUBPARTITION s0b
+  INDEX DIRECTORY = '$MYSQLTEST_VARDIR/master-data/test'
+));
+
 #
 # Bug #29258: Partitions: search fails for maximum unsigned bigint
 #
--- a/mysql-test/t/partition_not_windows.test
+++ b/mysql-test/t/partition_not_windows.test
@@ -12,12 +12,10 @@
 #                       doesn't remove old directory

 --disable_query_log
--exec mkdir $MYSQLTEST_VARDIR/master-data/tmpdata || true
-eval SET @data_dir = 'DATA DIRECTORY = ''$MYSQLTEST_VARDIR/master-data/tmpdata''';
+eval SET @data_dir = 'DATA DIRECTORY = ''$MYSQLTEST_VARDIR/tmp''';
 let $data_directory = `select @data_dir`;

--exec mkdir $MYSQLTEST_VARDIR/master-data/tmpinx || true
-eval SET @inx_dir = 'INDEX DIRECTORY = ''$MYSQLTEST_VARDIR/master-data/tmpinx''';
+eval SET @inx_dir = 'INDEX DIRECTORY = ''$MYSQLTEST_VARDIR/tmp''';
 let $inx_directory = `select @inx_dir`;
 --enable_query_log

@@ -35,10 +33,10 @@ subpartition by hash (a)
 --file_exists $MYSQLTEST_VARDIR/master-data/test/t1#P#p0#SP#subpart00.MYI
 --file_exists $MYSQLTEST_VARDIR/master-data/test/t1#P#p0#SP#subpart01.MYD
 --file_exists $MYSQLTEST_VARDIR/master-data/test/t1#P#p0#SP#subpart01.MYI
--file_exists $MYSQLTEST_VARDIR/master-data/tmpdata/t1#P#p0#SP#subpart00.MYD
--file_exists $MYSQLTEST_VARDIR/master-data/tmpdata/t1#P#p0#SP#subpart01.MYD
--file_exists $MYSQLTEST_VARDIR/master-data/tmpinx/t1#P#p0#SP#subpart00.MYI
--file_exists $MYSQLTEST_VARDIR/master-data/tmpinx/t1#P#p0#SP#subpart01.MYI
+--file_exists $MYSQLTEST_VARDIR/tmp/t1#P#p0#SP#subpart00.MYD
+--file_exists $MYSQLTEST_VARDIR/tmp/t1#P#p0#SP#subpart01.MYD
+--file_exists $MYSQLTEST_VARDIR/tmp/t1#P#p0#SP#subpart00.MYI
+--file_exists $MYSQLTEST_VARDIR/tmp/t1#P#p0#SP#subpart01.MYI

 --replace_result $MYSQLTEST_VARDIR MYSQLTEST_VARDIR
 eval ALTER TABLE t1 REORGANIZE PARTITION p0 INTO
@@ -58,18 +56,16 @@ eval ALTER TABLE t1 REORGANIZE PARTITION p0 INTO
 --file_exists $MYSQLTEST_VARDIR/master-data/test/t1#P#p2#SP#subpart20.MYI
 --file_exists $MYSQLTEST_VARDIR/master-data/test/t1#P#p2#SP#subpart21.MYD
 --file_exists $MYSQLTEST_VARDIR/master-data/test/t1#P#p2#SP#subpart21.MYI
--file_exists $MYSQLTEST_VARDIR/master-data/tmpdata/t1#P#p1#SP#subpart10.MYD
--file_exists $MYSQLTEST_VARDIR/master-data/tmpdata/t1#P#p1#SP#subpart11.MYD
--file_exists $MYSQLTEST_VARDIR/master-data/tmpdata/t1#P#p2#SP#subpart20.MYD
--file_exists $MYSQLTEST_VARDIR/master-data/tmpdata/t1#P#p2#SP#subpart21.MYD
--file_exists $MYSQLTEST_VARDIR/master-data/tmpinx/t1#P#p1#SP#subpart10.MYI
--file_exists $MYSQLTEST_VARDIR/master-data/tmpinx/t1#P#p1#SP#subpart11.MYI
--file_exists $MYSQLTEST_VARDIR/master-data/tmpinx/t1#P#p2#SP#subpart20.MYI
--file_exists $MYSQLTEST_VARDIR/master-data/tmpinx/t1#P#p2#SP#subpart21.MYI
+--file_exists $MYSQLTEST_VARDIR/tmp/t1#P#p1#SP#subpart10.MYD
+--file_exists $MYSQLTEST_VARDIR/tmp/t1#P#p1#SP#subpart11.MYD
+--file_exists $MYSQLTEST_VARDIR/tmp/t1#P#p2#SP#subpart20.MYD
+--file_exists $MYSQLTEST_VARDIR/tmp/t1#P#p2#SP#subpart21.MYD
+--file_exists $MYSQLTEST_VARDIR/tmp/t1#P#p1#SP#subpart10.MYI
+--file_exists $MYSQLTEST_VARDIR/tmp/t1#P#p1#SP#subpart11.MYI
+--file_exists $MYSQLTEST_VARDIR/tmp/t1#P#p2#SP#subpart20.MYI
+--file_exists $MYSQLTEST_VARDIR/tmp/t1#P#p2#SP#subpart21.MYI

 drop table t1;
--exec rmdir $MYSQLTEST_VARDIR/master-data/tmpdata || true
--exec rmdir $MYSQLTEST_VARDIR/master-data/tmpinx || true

 # End Windows specific test failures.

--- a/mysql-test/t/partition_symlink.test
+++ b/mysql-test/t/partition_symlink.test
@@ -24,6 +24,10 @@ DROP DATABASE IF EXISTS mysqltest2;
 # files, but not the other way around (any db-user can use any
 # directory or file that the mysqld-process can use, via DATA/INDEX DIR)
 # this is the security flaw that was used in bug#32091 and bug#32111
+
+#--exec mkdir $MYSQLTEST_VARDIR/tmp/test || true
+#--exec mkdir $MYSQLTEST_VARDIR/tmp/mysqltest2 || true
+
 -- echo # Creating two non colliding tables mysqltest2.t1 and test.t1
 -- echo # test.t1 have partitions in mysqltest2-directory!
 -- echo # user root:
@@ -39,11 +43,11 @@ connect(con1,localhost,mysqltest_1,,);
  eval CREATE TABLE t1 (a INT)
   PARTITION BY LIST (a) (
    PARTITION p0 VALUES IN (0)
-     DATA DIRECTORY '$MYSQLTEST_VARDIR/master-data/mysqltest2'
-     INDEX DIRECTORY '$MYSQLTEST_VARDIR/master-data/mysqltest2',
+     DATA DIRECTORY '$MYSQLTEST_VARDIR/tmp'
+     INDEX DIRECTORY '$MYSQLTEST_VARDIR/tmp',
    PARTITION p1 VALUES IN (1)
-     DATA DIRECTORY '$MYSQLTEST_VARDIR/master-data/test'
-     INDEX DIRECTORY '$MYSQLTEST_VARDIR/master-data/test',
+     DATA DIRECTORY '$MYSQLTEST_VARDIR/tmp'
+     INDEX DIRECTORY '$MYSQLTEST_VARDIR/tmp',
    PARTITION p2 VALUES IN (2)
  );
  -- echo # without the patch for bug#32091 this would create
@@ -74,17 +78,18 @@ connection default;
 # So it is using/blocking 2 files in (in 2 different directories
 -- echo # test that symlinks can not overwrite files when CREATE TABLE
 -- echo # user root:
+
  CREATE DATABASE mysqltest2;
  USE mysqltest2;
  -- replace_result $MYSQLTEST_VARDIR MYSQLTEST_VARDIR
  eval CREATE TABLE t1 (a INT)
   PARTITION BY LIST (a) (
    PARTITION p0 VALUES IN (0)
-     DATA DIRECTORY '$MYSQLTEST_VARDIR/master-data/mysqltest2'
-     INDEX DIRECTORY '$MYSQLTEST_VARDIR/master-data/mysqltest2',
+     DATA DIRECTORY '$MYSQLTEST_VARDIR/tmp'
+     INDEX DIRECTORY '$MYSQLTEST_VARDIR/tmp',
    PARTITION p1 VALUES IN (1)
-     DATA DIRECTORY '$MYSQLTEST_VARDIR/master-data/test'
-     INDEX DIRECTORY '$MYSQLTEST_VARDIR/master-data/test'
+     DATA DIRECTORY '$MYSQLTEST_VARDIR/tmp'
+     INDEX DIRECTORY '$MYSQLTEST_VARDIR/tmp'
   );
 connection con1;
 -- echo # user mysqltest_1:
@@ -94,22 +99,22 @@ connection con1;
  eval CREATE TABLE t1 (a INT)
   PARTITION BY LIST (a) (
    PARTITION p0 VALUES IN (0)
-     DATA DIRECTORY '$MYSQLTEST_VARDIR/master-data/mysqltest2'
-     INDEX DIRECTORY '$MYSQLTEST_VARDIR/master-data/mysqltest2',
+     DATA DIRECTORY '$MYSQLTEST_VARDIR/tmp'
+     INDEX DIRECTORY '$MYSQLTEST_VARDIR/tmp',
    PARTITION p1 VALUES IN (1)
-     DATA DIRECTORY '$MYSQLTEST_VARDIR/master-data/test'
-     INDEX DIRECTORY '$MYSQLTEST_VARDIR/master-data/test'
+     DATA DIRECTORY '$MYSQLTEST_VARDIR/tmp'
+     INDEX DIRECTORY '$MYSQLTEST_VARDIR/tmp'
   );
  -- replace_result $MYSQLTEST_VARDIR MYSQLTEST_VARDIR
  -- error 1,1
  eval CREATE TABLE t1 (a INT)
   PARTITION BY LIST (a) (
    PARTITION p0 VALUES IN (0)
-     DATA DIRECTORY '$MYSQLTEST_VARDIR/master-data/test'
-     INDEX DIRECTORY '$MYSQLTEST_VARDIR/master-data/test',
+     DATA DIRECTORY '$MYSQLTEST_VARDIR/tmp'
+     INDEX DIRECTORY '$MYSQLTEST_VARDIR/tmp',
    PARTITION p1 VALUES IN (1)
-     DATA DIRECTORY '$MYSQLTEST_VARDIR/master-data/mysqltest2'
-     INDEX DIRECTORY '$MYSQLTEST_VARDIR/master-data/mysqltest2'
+     DATA DIRECTORY '$MYSQLTEST_VARDIR/tmp'
+     INDEX DIRECTORY '$MYSQLTEST_VARDIR/tmp'
  );
 connection default;
 -- echo # user root (cleanup):
@@ -118,4 +123,5 @@ connection default;
  DROP USER mysqltest_1@localhost;
  disconnect con1;

-
+#--exec rmdir $MYSQLTEST_VARDIR/tmp/test || true
+#--exec rmdir $MYSQLTEST_VARDIR/tmp/mysqltest2 || true
--- a/mysql-test/t/symlink.test
+++ b/mysql-test/t/symlink.test
@@ -123,29 +123,22 @@ drop table t1;
 #
 # BUG#32111 - Security Breach via DATA/INDEX DIRECORY and RENAME TABLE
 #
--replace_result $MYSQLTEST_VARDIR TEST_DIR
-eval CREATE TABLE t1(a INT)
-DATA DIRECTORY='$MYSQLTEST_VARDIR/master-data/mysql'
-INDEX DIRECTORY='$MYSQLTEST_VARDIR/master-data/mysql';
+--write_file $MYSQLTEST_VARDIR/tmp/t1.MYI
+EOF
 --replace_result $MYSQLTEST_VARDIR TEST_DIR
 --error 1
-RENAME TABLE t1 TO user;
-DROP TABLE t1;
-
-#
-# Test specifying DATA DIRECTORY that is the same as what would normally
-# have been chosen. (Bug #8707)
-#
-disable_query_log;
-eval create table t1 (i int) data directory = "$MYSQLTEST_VARDIR/master-data/test/";
-enable_query_log;
-show create table t1;
-drop table t1;
-disable_query_log;
-eval create table t1 (i int) index directory = "$MYSQLTEST_VARDIR/master-data/test/";
-enable_query_log;
-show create table t1;
-drop table t1;
+eval CREATE TABLE t1(a INT)
+DATA DIRECTORY='$MYSQLTEST_VARDIR/tmp'
+INDEX DIRECTORY='$MYSQLTEST_VARDIR/tmp';
+--replace_result $MYSQLTEST_VARDIR TEST_DIR
+eval CREATE TABLE t2(a INT)
+DATA DIRECTORY='$MYSQLTEST_VARDIR/tmp'
+INDEX DIRECTORY='$MYSQLTEST_VARDIR/tmp';
+--replace_result $MYSQLTEST_VARDIR TEST_DIR
+--error 1
+RENAME TABLE t2 TO t1;
+DROP TABLE t2;
+--remove_file $MYSQLTEST_VARDIR/tmp/t1.MYI

 #
 # Bug#8706 - temporary table with data directory option fails
@@ -189,40 +182,41 @@ drop table t1;
 #
 # Bug #29325: create table overwrites .MYD file of other table (datadir)
 #
-
-CREATE DATABASE db1; 
-CREATE DATABASE db2;
-
-USE db2;
--disable_query_log
-eval CREATE TABLE t1 (b INT) ENGINE MYISAM
-DATA DIRECTORY = '$MYSQLTEST_VARDIR/master-data/db1/';
--enable_query_log
-
-INSERT INTO db2.t1 VALUES (1);
-SELECT * FROM db2.t1;
-RESET QUERY CACHE;
-
-USE db1;
-
-#no warning from create table
 SET SESSION keep_files_on_create = TRUE;
+--write_file $MYSQLTEST_VARDIR/master-data/test/t1.MYD
+EOF
 --disable_abort_on_error
--error 1,1
+--error 1
 CREATE TABLE t1 (a INT) ENGINE MYISAM;
+--error 0,1
+--remove_file $MYSQLTEST_VARDIR/master-data/test/t1.MYD;
 --enable_abort_on_error
-
-CREATE TABLE t3 (a INT) Engine=MyISAM;
-INSERT INTO t3 VALUES (1),(2),(3);
-TRUNCATE TABLE t3;
-SELECT * from t3;
-
-SET SESSION keep_files_on_create = DEFAULT;
-
-DROP TABLE db2.t1, db1.t3;
-DROP DATABASE db1;
-DROP DATABASE db2;
-USE test;
-
+SET SESSION keep_files_on_create = FALSE;
+CREATE TABLE t1 (a INT) ENGINE MYISAM;
+DROP TABLE t1;

 --echo End of 5.0 tests
+
+#
+# Bug#32167: another privilege bypass with DATA/INDEX DIRECTORY
+#
+--replace_result $MYSQLTEST_VARDIR TEST_DIR
+--error 1210
+eval CREATE TABLE t1(a INT)
+INDEX DIRECTORY='$MYSQLTEST_VARDIR/master-data/mysql';
+--replace_result $MYSQLTEST_VARDIR TEST_DIR
+--error 1210
+eval CREATE TABLE t1(a INT)
+DATA DIRECTORY='$MYSQLTEST_VARDIR/master-data/test';
+--replace_result $MYSQLTEST_VARDIR TEST_DIR
+eval CREATE TABLE t1(a INT)
+DATA DIRECTORY='$MYSQLTEST_VARDIR/master-data/';
+DROP TABLE t1;
+--replace_result $MYSQLTEST_VARDIR TEST_DIR
+eval CREATE TABLE t1(a INT)
+INDEX DIRECTORY='$MYSQLTEST_VARDIR/master-data';
+DROP TABLE t1;
+--replace_result $MYSQLTEST_VARDIR TEST_DIR
+--error 1
+eval CREATE TABLE t1(a INT)
+INDEX DIRECTORY='$MYSQLTEST_VARDIR/master-data_var';