mirror of
https://github.com/MariaDB/server.git
synced 2025-11-16 20:23:18 +03:00
09ce0b330b
Implement fine-grained control over access to stored procedures
Privileges are cached (same way as existing table/column privs)
mysql-test/include/system_db_struct.inc:
WL#925 - Privileges for stored routines
New system table: procs_priv
mysql-test/r/connect.result:
WL#925 - Privileges for stored routines
New system table: procs_priv
mysql-test/r/grant.result:
WL#925 - Privileges for stored routines
user table has additional privilege attributes
SHOW PRIVILEGES amended
mysql-test/r/grant2.result:
Fix result
mysql-test/r/information_schema.result:
WL#925 - Privileges for stored routines
New system table procs_priv
New user privileges
mysql-test/r/show_check.result:
Fix result
mysql-test/r/sp-security.result:
WL#925 - Privileges for stored routines
Fix existing tests to work with new privileges
New tests for new privileges
mysql-test/r/sp.result:
WL#925 - Privileges for stored routines
Fix SHOW PRIVILEGES results
mysql-test/r/system_mysql_db.result:
WL#925 - Privileges for stored routines
New system table: procs_priv
user and db tables have new privilege attributes
mysql-test/t/grant2.test:
Fix test
mysql-test/t/show_check.test:
Fix test
mysql-test/t/sp-security.test:
WL#925 - Privileges for stored routines
Allow existing tests to run with new privilege checks
New tests for privileges
mysql-test/t/system_mysql_db_fix.test:
WL#925 - Privileges for stored routines
New system table: procs_priv
scripts/mysql_create_system_tables.sh:
WL#925 - Privileges for stored routines
db and user has new privilege attributes
new system table: procs_priv
scripts/mysql_fix_privilege_tables.sql:
WL#925 - Privileges for stored routines
new system table: procs_priv
scripts/mysql_install_db.sh:
WL#925 - Privileges for stored routines
Amend comment
sql/item_func.cc:
WL#925 - Privileges for stored routines
Privilege check for stored FUNCTION routine
sql/lex.h:
WL#925 - Privileges for stored routines
new token ROUTINE
sql/mysql_priv.h:
WL#925 - Privileges for stored routines
New function: check_procedure_access()
sql/mysqld.cc:
WL#925 - Privileges for stored routines
system option automatic-sp-privileges
sql/set_var.cc:
WL#925 - Privileges for stored routines
system option automatic-sp-privileges
sql/share/errmsg.txt:
WL#925 - Privileges for stored routines
rename errormessage to conform:
ER_SP_ACCESS_DENIED_ERROR -> ER_PROCACCESS_DENIED_ERROR
New error messages
ER_NONEXISTING_PROC_GRANT, ER_PROC_AUTO_GRANT_FAIL, ER_PROC_AUTO_REVOKE_FAIL
sql/sp.cc:
WL#925 - Privileges for stored routines
new function: sp_exists_routine()
sql/sp.h:
WL#925 - Privileges for stored routines
new function: sp_exists_routine()
sql/sql_acl.cc:
WL#925 - Privileges for stored routines
Implementation for SP privileges.
Privileges are cached in memory hash.
New functions:
mysql_procedure_grant()
check_grant_procedure()
sp_revoke_privileges()
sp_grant_privileges()
sql/sql_acl.h:
WL#925 - Privileges for stored routines
New privilege bits: CREATE_PROC_ACL, ALTER_PROC_ACL
Alter confusing bit-segments to be shifted
New macros: fix_rights_for_procedure() get_rights_for_procedure()
New functions:
mysql_procedure_grant()
check_grant_procedure()
sp_grant_privileges()
sp_revoke_privileges()
sql/sql_lex.h:
WL#925 - Privileges for stored routines
new all_privileges attribute in LEX
sql/sql_parse.cc:
WL#925 - Privileges for stored routines
Remove function: check_sp_definer_access()
Add handling for SP grants/revokes
Add privilege checks for stored procedure invocation
sql/sql_show.cc:
WL#925 - Privileges for stored routines
update result for SHOW PRIVILEGES
sql/sql_yacc.yy:
WL#925 - Privileges for stored routines
New token ROUTINE
rename some rules
handle CREATE ROUTINE / ALTER ROUTINE privileges
83 lines
2.6 KiB
Plaintext
83 lines
2.6 KiB
Plaintext
#
|
|
# This is the test for mysql_fix_privilege_tables
|
|
#
|
|
|
|
-- disable_result_log
|
|
-- disable_query_log
|
|
|
|
use test;
|
|
|
|
# create system tables as in mysql-3.20
|
|
|
|
--disable_warnings
|
|
CREATE TABLE db (
|
|
Host char(60) binary DEFAULT '' NOT NULL,
|
|
Db char(32) binary DEFAULT '' NOT NULL,
|
|
User char(16) binary DEFAULT '' NOT NULL,
|
|
Select_priv enum('N','Y') DEFAULT 'N' NOT NULL,
|
|
Insert_priv enum('N','Y') DEFAULT 'N' NOT NULL,
|
|
Update_priv enum('N','Y') DEFAULT 'N' NOT NULL,
|
|
Delete_priv enum('N','Y') DEFAULT 'N' NOT NULL,
|
|
Create_priv enum('N','Y') DEFAULT 'N' NOT NULL,
|
|
Drop_priv enum('N','Y') DEFAULT 'N' NOT NULL,
|
|
PRIMARY KEY Host (Host,Db,User),
|
|
KEY User (User)
|
|
)
|
|
type=ISAM;
|
|
--enable-warnings
|
|
|
|
INSERT INTO db VALUES ('%','test', '','Y','Y','Y','Y','Y','Y');
|
|
INSERT INTO db VALUES ('%','test\_%','','Y','Y','Y','Y','Y','Y');
|
|
|
|
--disable_warnings
|
|
CREATE TABLE host (
|
|
Host char(60) binary DEFAULT '' NOT NULL,
|
|
Db char(32) binary DEFAULT '' NOT NULL,
|
|
Select_priv enum('N','Y') DEFAULT 'N' NOT NULL,
|
|
Insert_priv enum('N','Y') DEFAULT 'N' NOT NULL,
|
|
Update_priv enum('N','Y') DEFAULT 'N' NOT NULL,
|
|
Delete_priv enum('N','Y') DEFAULT 'N' NOT NULL,
|
|
Create_priv enum('N','Y') DEFAULT 'N' NOT NULL,
|
|
Drop_priv enum('N','Y') DEFAULT 'N' NOT NULL,
|
|
PRIMARY KEY Host (Host,Db)
|
|
)
|
|
type=ISAM;
|
|
--enable-warnings
|
|
|
|
--disable_warnings
|
|
CREATE TABLE user (
|
|
Host char(60) binary DEFAULT '' NOT NULL,
|
|
User char(16) binary DEFAULT '' NOT NULL,
|
|
Password char(16),
|
|
Select_priv enum('N','Y') DEFAULT 'N' NOT NULL,
|
|
Insert_priv enum('N','Y') DEFAULT 'N' NOT NULL,
|
|
Update_priv enum('N','Y') DEFAULT 'N' NOT NULL,
|
|
Delete_priv enum('N','Y') DEFAULT 'N' NOT NULL,
|
|
Create_priv enum('N','Y') DEFAULT 'N' NOT NULL,
|
|
Drop_priv enum('N','Y') DEFAULT 'N' NOT NULL,
|
|
Reload_priv enum('N','Y') DEFAULT 'N' NOT NULL,
|
|
Shutdown_priv enum('N','Y') DEFAULT 'N' NOT NULL,
|
|
Process_priv enum('N','Y') DEFAULT 'N' NOT NULL,
|
|
PRIMARY KEY Host (Host,User)
|
|
)
|
|
type=ISAM;
|
|
--enable-warnings
|
|
|
|
INSERT INTO user VALUES ('localhost','root','','Y','Y','Y','Y','Y','Y','Y','Y','Y');
|
|
INSERT INTO user VALUES ('localhost','', '','N','N','N','N','N','N','N','N','N');
|
|
|
|
-- exec $MYSQL_FIX_SYSTEM_TABLES --database=test
|
|
-- enable_query_log
|
|
-- enable_result_log
|
|
|
|
-- source include/system_db_struct.inc
|
|
|
|
-- disable_query_log
|
|
|
|
DROP TABLE db, host, user, func, tables_priv, columns_priv, procs_priv, help_category, help_keyword, help_relation, help_topic, proc, time_zone, time_zone_leap_second, time_zone_name, time_zone_transition, time_zone_transition_type;
|
|
|
|
-- enable_query_log
|
|
|
|
# check that we droped all system tables
|
|
show tables;
|