mirror of
https://github.com/MariaDB/server.git
synced 2025-11-15 09:02:33 +03:00
09ce0b330b
Implement fine-grained control over access to stored procedures
Privileges are cached (same way as existing table/column privs)
mysql-test/include/system_db_struct.inc:
WL#925 - Privileges for stored routines
New system table: procs_priv
mysql-test/r/connect.result:
WL#925 - Privileges for stored routines
New system table: procs_priv
mysql-test/r/grant.result:
WL#925 - Privileges for stored routines
user table has additional privilege attributes
SHOW PRIVILEGES amended
mysql-test/r/grant2.result:
Fix result
mysql-test/r/information_schema.result:
WL#925 - Privileges for stored routines
New system table procs_priv
New user privileges
mysql-test/r/show_check.result:
Fix result
mysql-test/r/sp-security.result:
WL#925 - Privileges for stored routines
Fix existing tests to work with new privileges
New tests for new privileges
mysql-test/r/sp.result:
WL#925 - Privileges for stored routines
Fix SHOW PRIVILEGES results
mysql-test/r/system_mysql_db.result:
WL#925 - Privileges for stored routines
New system table: procs_priv
user and db tables have new privilege attributes
mysql-test/t/grant2.test:
Fix test
mysql-test/t/show_check.test:
Fix test
mysql-test/t/sp-security.test:
WL#925 - Privileges for stored routines
Allow existing tests to run with new privilege checks
New tests for privileges
mysql-test/t/system_mysql_db_fix.test:
WL#925 - Privileges for stored routines
New system table: procs_priv
scripts/mysql_create_system_tables.sh:
WL#925 - Privileges for stored routines
db and user has new privilege attributes
new system table: procs_priv
scripts/mysql_fix_privilege_tables.sql:
WL#925 - Privileges for stored routines
new system table: procs_priv
scripts/mysql_install_db.sh:
WL#925 - Privileges for stored routines
Amend comment
sql/item_func.cc:
WL#925 - Privileges for stored routines
Privilege check for stored FUNCTION routine
sql/lex.h:
WL#925 - Privileges for stored routines
new token ROUTINE
sql/mysql_priv.h:
WL#925 - Privileges for stored routines
New function: check_procedure_access()
sql/mysqld.cc:
WL#925 - Privileges for stored routines
system option automatic-sp-privileges
sql/set_var.cc:
WL#925 - Privileges for stored routines
system option automatic-sp-privileges
sql/share/errmsg.txt:
WL#925 - Privileges for stored routines
rename errormessage to conform:
ER_SP_ACCESS_DENIED_ERROR -> ER_PROCACCESS_DENIED_ERROR
New error messages
ER_NONEXISTING_PROC_GRANT, ER_PROC_AUTO_GRANT_FAIL, ER_PROC_AUTO_REVOKE_FAIL
sql/sp.cc:
WL#925 - Privileges for stored routines
new function: sp_exists_routine()
sql/sp.h:
WL#925 - Privileges for stored routines
new function: sp_exists_routine()
sql/sql_acl.cc:
WL#925 - Privileges for stored routines
Implementation for SP privileges.
Privileges are cached in memory hash.
New functions:
mysql_procedure_grant()
check_grant_procedure()
sp_revoke_privileges()
sp_grant_privileges()
sql/sql_acl.h:
WL#925 - Privileges for stored routines
New privilege bits: CREATE_PROC_ACL, ALTER_PROC_ACL
Alter confusing bit-segments to be shifted
New macros: fix_rights_for_procedure() get_rights_for_procedure()
New functions:
mysql_procedure_grant()
check_grant_procedure()
sp_grant_privileges()
sp_revoke_privileges()
sql/sql_lex.h:
WL#925 - Privileges for stored routines
new all_privileges attribute in LEX
sql/sql_parse.cc:
WL#925 - Privileges for stored routines
Remove function: check_sp_definer_access()
Add handling for SP grants/revokes
Add privilege checks for stored procedure invocation
sql/sql_show.cc:
WL#925 - Privileges for stored routines
update result for SHOW PRIVILEGES
sql/sql_yacc.yy:
WL#925 - Privileges for stored routines
New token ROUTINE
rename some rules
handle CREATE ROUTINE / ALTER ROUTINE privileges
157 lines
8.2 KiB
Plaintext
157 lines
8.2 KiB
Plaintext
show tables;
|
|
Tables_in_db
|
|
columns_priv
|
|
db
|
|
func
|
|
help_category
|
|
help_keyword
|
|
help_relation
|
|
help_topic
|
|
host
|
|
proc
|
|
procs_priv
|
|
tables_priv
|
|
time_zone
|
|
time_zone_leap_second
|
|
time_zone_name
|
|
time_zone_transition
|
|
time_zone_transition_type
|
|
user
|
|
show create table db;
|
|
Table Create Table
|
|
db CREATE TABLE `db` (
|
|
`Host` char(60) collate utf8_bin NOT NULL default '',
|
|
`Db` char(64) collate utf8_bin NOT NULL default '',
|
|
`User` char(16) collate utf8_bin NOT NULL default '',
|
|
`Select_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Insert_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Update_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Delete_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Create_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Drop_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Grant_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`References_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Index_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Alter_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Create_tmp_table_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Lock_tables_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Create_view_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Show_view_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Create_routine_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Alter_routine_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Execute_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
PRIMARY KEY (`Host`,`Db`,`User`),
|
|
KEY `User` (`User`)
|
|
) ENGINE=MyISAM DEFAULT CHARSET=utf8 COLLATE=utf8_bin COMMENT='Database privileges'
|
|
show create table host;
|
|
Table Create Table
|
|
host CREATE TABLE `host` (
|
|
`Host` char(60) collate utf8_bin NOT NULL default '',
|
|
`Db` char(64) collate utf8_bin NOT NULL default '',
|
|
`Select_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Insert_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Update_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Delete_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Create_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Drop_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Grant_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`References_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Index_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Alter_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Create_tmp_table_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Lock_tables_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Create_view_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Show_view_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
PRIMARY KEY (`Host`,`Db`)
|
|
) ENGINE=MyISAM DEFAULT CHARSET=utf8 COLLATE=utf8_bin COMMENT='Host privileges; Merged with database privileges'
|
|
show create table user;
|
|
Table Create Table
|
|
user CREATE TABLE `user` (
|
|
`Host` char(60) collate utf8_bin NOT NULL default '',
|
|
`User` char(16) collate utf8_bin NOT NULL default '',
|
|
`Password` char(41) collate utf8_bin NOT NULL default '',
|
|
`Select_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Insert_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Update_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Delete_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Create_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Drop_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Reload_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Shutdown_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Process_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`File_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Grant_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`References_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Index_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Alter_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Show_db_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Super_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Create_tmp_table_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Lock_tables_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Execute_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Repl_slave_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Repl_client_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Create_view_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Show_view_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Create_routine_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`Alter_routine_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
|
|
`ssl_type` enum('','ANY','X509','SPECIFIED') collate utf8_bin NOT NULL default '',
|
|
`ssl_cipher` blob NOT NULL,
|
|
`x509_issuer` blob NOT NULL,
|
|
`x509_subject` blob NOT NULL,
|
|
`max_questions` int(11) unsigned NOT NULL default '0',
|
|
`max_updates` int(11) unsigned NOT NULL default '0',
|
|
`max_connections` int(11) unsigned NOT NULL default '0',
|
|
PRIMARY KEY (`Host`,`User`)
|
|
) ENGINE=MyISAM DEFAULT CHARSET=utf8 COLLATE=utf8_bin COMMENT='Users and global privileges'
|
|
show create table func;
|
|
Table Create Table
|
|
func CREATE TABLE `func` (
|
|
`name` char(64) collate utf8_bin NOT NULL default '',
|
|
`ret` tinyint(1) NOT NULL default '0',
|
|
`dl` char(128) collate utf8_bin NOT NULL default '',
|
|
`type` enum('function','aggregate') collate utf8_bin NOT NULL default 'function',
|
|
PRIMARY KEY (`name`)
|
|
) ENGINE=MyISAM DEFAULT CHARSET=utf8 COLLATE=utf8_bin COMMENT='User defined functions'
|
|
show create table tables_priv;
|
|
Table Create Table
|
|
tables_priv CREATE TABLE `tables_priv` (
|
|
`Host` char(60) collate utf8_bin NOT NULL default '',
|
|
`Db` char(64) collate utf8_bin NOT NULL default '',
|
|
`User` char(16) collate utf8_bin NOT NULL default '',
|
|
`Table_name` char(64) collate utf8_bin NOT NULL default '',
|
|
`Grantor` char(77) collate utf8_bin NOT NULL default '',
|
|
`Timestamp` timestamp NOT NULL default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP,
|
|
`Table_priv` set('Select','Insert','Update','Delete','Create','Drop','Grant','References','Index','Alter') collate utf8_bin NOT NULL default '',
|
|
`Column_priv` set('Select','Insert','Update','References') collate utf8_bin NOT NULL default '',
|
|
PRIMARY KEY (`Host`,`Db`,`User`,`Table_name`),
|
|
KEY `Grantor` (`Grantor`)
|
|
) ENGINE=MyISAM DEFAULT CHARSET=utf8 COLLATE=utf8_bin COMMENT='Table privileges'
|
|
show create table columns_priv;
|
|
Table Create Table
|
|
columns_priv CREATE TABLE `columns_priv` (
|
|
`Host` char(60) collate utf8_bin NOT NULL default '',
|
|
`Db` char(64) collate utf8_bin NOT NULL default '',
|
|
`User` char(16) collate utf8_bin NOT NULL default '',
|
|
`Table_name` char(64) collate utf8_bin NOT NULL default '',
|
|
`Column_name` char(64) collate utf8_bin NOT NULL default '',
|
|
`Timestamp` timestamp NOT NULL default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP,
|
|
`Column_priv` set('Select','Insert','Update','References') collate utf8_bin NOT NULL default '',
|
|
PRIMARY KEY (`Host`,`Db`,`User`,`Table_name`,`Column_name`)
|
|
) ENGINE=MyISAM DEFAULT CHARSET=utf8 COLLATE=utf8_bin COMMENT='Column privileges'
|
|
show create table procs_priv;
|
|
Table Create Table
|
|
procs_priv CREATE TABLE `procs_priv` (
|
|
`Host` char(60) collate utf8_bin NOT NULL default '',
|
|
`Db` char(64) collate utf8_bin NOT NULL default '',
|
|
`User` char(16) collate utf8_bin NOT NULL default '',
|
|
`Routine_name` char(64) collate utf8_bin NOT NULL default '',
|
|
`Grantor` char(77) collate utf8_bin NOT NULL default '',
|
|
`Timestamp` timestamp NOT NULL default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP,
|
|
`Proc_priv` set('Execute','Alter Routine','Grant') collate utf8_bin NOT NULL default '',
|
|
PRIMARY KEY (`Host`,`Db`,`User`,`Routine_name`),
|
|
KEY `Grantor` (`Grantor`)
|
|
) ENGINE=MyISAM DEFAULT CHARSET=utf8 COLLATE=utf8_bin COMMENT='Procedure privileges'
|
|
show tables;
|
|
Tables_in_test
|