database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-08-08 11:22:35 +03:00
Code Activity

MDEV-29668 SUPER should not allow actions that have fine-grained dedicated privileges

Browse Source 
SUPER privilege used to allow various actions that were alternatively
allowed by one of BINLOG ADMIN, BINLOG MONITOR, BINLOG REPLAY,
CONNECTION ADMIN, FEDERATED ADMIN, REPL MASTER ADMIN, REPL SLAVE ADMIN,
SET USER, SLAVE MONITOR.

Now SUPER no longer does that, one has to grant one of the fine-grained
privileges above to be to perform corresponding actions.

On upgrade from MariaDB versions 10.11 and below all the privileges
above are granted automatically if the user has SUPER.

As a side-effect, such an upgrade will allow SUPER-user to run SHOW
BINLOG EVENTS, SHOW RELAYLOG EVENTS, SHOW SLAVE HOSTS, even if he wasn't
able to do it before the upgrade.
This commit is contained in:
Sergei Golubchik
2022-12-10 12:08:31 +01:00
parent 0ac5132505
commit d6e3d89c80
142 changed files with 551 additions and 2145 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
mysql-test/suite/sys_vars/r/slave_parallel_threads_grant.result
View File

@@ -2,14 +2,14 @@
# MDEV-21966 Bind REPLICATION SLAVE ADMIN to a number of global system variables
#
SET @global=@@global.slave_parallel_threads;
# Test that "SET slave_parallel_threads" is not allowed without REPLICATION SLAVE ADMIN or SUPER
# Test that "SET slave_parallel_threads" is not allowed without REPLICATION SLAVE ADMIN
CREATE USER user1@localhost;
GRANT ALL PRIVILEGES ON *.* TO user1@localhost;
REVOKE REPLICATION SLAVE ADMIN, SUPER ON *.* FROM user1@localhost;
REVOKE REPLICATION SLAVE ADMIN ON *.* FROM user1@localhost;
connect user1,localhost,user1,,;
connection user1;
SET GLOBAL slave_parallel_threads=256;
ERROR 42000: Access denied; you need (at least one of) the SUPER, REPLICATION SLAVE ADMIN privilege(s) for this operation
ERROR 42000: Access denied; you need (at least one of) the REPLICATION SLAVE ADMIN privilege(s) for this operation
SET slave_parallel_threads=256;
ERROR HY000: Variable 'slave_parallel_threads' is a GLOBAL variable and should be set with SET GLOBAL
SET SESSION slave_parallel_threads=256;
@@ -30,17 +30,4 @@ ERROR HY000: Variable 'slave_parallel_threads' is a GLOBAL variable and should b
disconnect user1;
connection default;
DROP USER user1@localhost;
# Test that "SET slave_parallel_threads" is allowed with SUPER
CREATE USER user1@localhost;
GRANT SUPER ON *.* TO user1@localhost;
connect user1,localhost,user1,,;
connection user1;
SET GLOBAL slave_parallel_threads=256;
SET slave_parallel_threads=256;
ERROR HY000: Variable 'slave_parallel_threads' is a GLOBAL variable and should be set with SET GLOBAL
SET SESSION slave_parallel_threads=256;
ERROR HY000: Variable 'slave_parallel_threads' is a GLOBAL variable and should be set with SET GLOBAL
disconnect user1;
connection default;
DROP USER user1@localhost;
SET @@global.slave_parallel_threads=@global;