database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-08-07 00:04:31 +03:00
Code Activity

MDEV-36425 Extend read_only to also block share locks and super user

Browse Source 
The main purpose of this allow one to use the --read-only
option to ensure that no one can issue a query that can
block replication.

The --read-only option can now take 4 different values:
0  No read only (as before).
1  Blocks changes for users without the 'READ ONLY ADMIN'
   privilege (as before).
2  Blocks in addition LOCK TABLES and SELECT IN SHARE MODE
   for not 'READ ONLY ADMIN' users.
3  Blocks in addition 'READ_ONLY_ADMIN' users for all the
   previous statements.

read_only is changed to an enum and one can use the following
names for the lock levels:
OFF, ON, NO_LOCK, NO_LOCK_NO_ADMIN

Too keep things compatible with older versions config files, one can
still use values FALSE and TRUE, which are mapped to OFF and ON.

The main visible changes are:
- 'show variables like "read_only"' now returns a string
   instead of a number.
- Error messages related to read_only violations now contains
  the current value off readonly.

Other things:
- is_read_only_ctx() renamed to check_read_only_with_error()
- Moved TL_READ_SKIP_LOCKED to it's logical place

Reviewed by: Sergei Golubchik <serg@mariadb.org>
This commit is contained in:
Monty
2025-03-31 20:07:13 +03:00
parent 595e834946
commit ce8a74f235
37 changed files with 455 additions and 171 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
sql/sql_parse.cc
View File

@@ -1470,14 +1470,16 @@ out:
static bool deny_updates_if_read_only_option(THD *thd, TABLE_LIST *all_tables)
{
DBUG_ENTER("deny_updates_if_read_only_option");
DBUG_ASSERT(!thd->slave_thread); // Checked by caller
if (!opt_readonly)
DBUG_RETURN(FALSE);
LEX *lex= thd->lex;
/* Super user is allowed to do changes */
if ((thd->security_ctx->master_access & PRIV_IGNORE_READ_ONLY) != NO_ACL)
/* Super user is allowed to do changes in some cases */
if ((thd->security_ctx->master_access & PRIV_IGNORE_READ_ONLY) != NO_ACL &&
opt_readonly < READONLY_NO_LOCK_NO_ADMIN)
DBUG_RETURN(FALSE);
/* Check if command doesn't update anything */
@@ -3669,7 +3671,7 @@ mysql_execute_command(THD *thd, bool is_called_from_prepared_stmt)
*/
if (deny_updates_if_read_only_option(thd, all_tables))
{
my_error(ER_OPTION_PREVENTS_STATEMENT, MYF(0), "--read-only");
mariadb_error_read_only();
DBUG_RETURN(-1);
}
#ifdef HAVE_REPLICATION