include/master-slave.inc
Warnings:
Note	####	Sending passwords in plain text without SSL/TLS is extremely insecure.
Note	####	Storing MySQL user name or password information in the master info repository is not secure and is therefore not recommended. Please consider using the USER and PASSWORD connection options for START SLAVE; see the 'START SLAVE Syntax' in the MySQL Manual for more information.
[connection master]
SELECT @@global.partial_revokes;
@@global.partial_revokes
1
CREATE DATABASE pr_db;
CREATE DATABASE normal_db;
CREATE TABLE pr_db.t1(c1 int, c2 int);
INSERT INTO pr_db.t1 values (1,2), (3,4);
CREATE TABLE normal_db.t1(c1 int, c2 int);
INSERT INTO normal_db.t1 values (1,2), (3,4);
-------------------------------------------------------------------------
Tests related to users
-------------------------------------------------------------------------
#
# 1. Grantor does not have restriction list but has global priv
#
CREATE USER foo, bar;
GRANT INSERT,SELECT ON *.* TO foo WITH GRANT OPTION;
[connection foo_master]
# Must fail since no priv granted to bar yet.
REVOKE INSERT ON mysql.* FROM bar;
ERROR 42000: There is no such grant defined for user 'bar' on host '%'
# Create global insert priv with partial revoke for bar.
GRANT INSERT ON *.* TO bar;
REVOKE INSERT ON mysql.* FROM bar;
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT INSERT ON *.* TO `bar`@`%`
REVOKE INSERT ON `mysql`.* FROM `bar`@`%`
include/sync_slave_sql_with_master.inc
[connection slave]
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT INSERT ON *.* TO `bar`@`%`
REVOKE INSERT ON `mysql`.* FROM `bar`@`%`
[connection foo_master]
# Clear partial revoke from bar but global INSERT priv remains as it is
GRANT INSERT ON *.* TO bar;
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT INSERT ON *.* TO `bar`@`%`
include/sync_slave_sql_with_master.inc
[connection slave]
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT INSERT ON *.* TO `bar`@`%`
[connection foo_master]
# Create the partial revoke on mysql db again.
REVOKE INSERT ON mysql.* FROM bar;
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT INSERT ON *.* TO `bar`@`%`
REVOKE INSERT ON `mysql`.* FROM `bar`@`%`
include/sync_slave_sql_with_master.inc
[connection slave]
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT INSERT ON *.* TO `bar`@`%`
REVOKE INSERT ON `mysql`.* FROM `bar`@`%`
[connection foo_master]
# Remove partial revoke only
GRANT INSERT ON mysql.* TO bar;
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT INSERT ON *.* TO `bar`@`%`
include/sync_slave_sql_with_master.inc
[connection slave]
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT INSERT ON *.* TO `bar`@`%`
[connection foo_master]
# Grant DB level privilege only
GRANT INSERT ON mysql.* TO bar;
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT INSERT ON *.* TO `bar`@`%`
GRANT INSERT ON `mysql`.* TO `bar`@`%`
include/sync_slave_sql_with_master.inc
[connection slave]
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT INSERT ON *.* TO `bar`@`%`
GRANT INSERT ON `mysql`.* TO `bar`@`%`
[connection foo_master]
DROP USER foo, bar;
#
# 2. Grantor has restriction list and grantee has global priv
#
CREATE USER foo, bar;
GRANT INSERT, SELECT, UPDATE ON *.* TO foo WITH GRANT OPTION;
# Restrict INSERT on mysql DB.
REVOKE INSERT ON mysql.* FROM foo;
SHOW GRANTS FOR foo;
Grants for foo@%
GRANT SELECT, INSERT, UPDATE ON *.* TO `foo`@`%` WITH GRANT OPTION
REVOKE INSERT ON `mysql`.* FROM `foo`@`%`
# Restrict UPDATE on mysql DB as well.
REVOKE UPDATE ON mysql.* FROM foo;
SHOW GRANTS FOR foo;
Grants for foo@%
GRANT SELECT, INSERT, UPDATE ON *.* TO `foo`@`%` WITH GRANT OPTION
REVOKE INSERT, UPDATE ON `mysql`.* FROM `foo`@`%`
# Must fail, DELETE privilege is not granted
REVOKE DELETE ON mysql.* FROM foo;
ERROR 42000: There is no such grant defined for user 'foo' on host '%'
GRANT INSERT ON *.* TO bar;
[connection foo_master]
GRANT INSERT ON mysql.* TO bar;
ERROR 42000: Access denied for user 'foo'@'%' to database 'mysql'
REVOKE INSERT ON mysql.* FROM bar;
ERROR 42000: Access denied for user 'foo'@'%' to database 'mysql'
REVOKE INSERT ON *.* FROM bar;
ERROR HY000: Access denied for AuthId `foo`@`%` to database 'mysql'.
# Grantee will not get the restriction list from grantor because
# former already has higher priv than grantor
GRANT INSERT ON *.* TO bar;
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT INSERT ON *.* TO `bar`@`%`
include/sync_slave_sql_with_master.inc
[connection slave]
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT INSERT ON *.* TO `bar`@`%`
[connection foo_master]
DROP USER foo, bar;
#
# 3. Grantor has restriction list and grantee has DB level privileges
#
CREATE USER foo, bar;
GRANT INSERT, UPDATE, SELECT ON *.* TO foo WITH GRANT OPTION;
# Restrict INSERT and UPDATE on mysql DB from foo.
REVOKE INSERT,UPDATE ON mysql.* FROM foo;
SHOW GRANTS FOR foo;
Grants for foo@%
GRANT SELECT, INSERT, UPDATE ON *.* TO `foo`@`%` WITH GRANT OPTION
REVOKE INSERT, UPDATE ON `mysql`.* FROM `foo`@`%`
# Grant DB level INSERT priv on mysql DB to bar.
GRANT INSERT ON mysql.* TO bar;
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT USAGE ON *.* TO `bar`@`%`
GRANT INSERT ON `mysql`.* TO `bar`@`%`
[connection foo_master]
REVOKE INSERT ON mysql.* FROM bar;
ERROR 42000: Access denied for user 'foo'@'%' to database 'mysql'
REVOKE INSERT ON *.* FROM bar;
ERROR HY000: Access denied for AuthId `foo`@`%` to database 'mysql'.
GRANT INSERT ON mysql.* TO bar;
ERROR 42000: Access denied for user 'foo'@'%' to database 'mysql'
# There should not be any restriction list:
#    INSERT on mysql DB because bar already has access to this DB
#    UPDATE on mysql DB because global UPDATE priv is not being granted
GRANT INSERT ON *.* TO bar;
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT INSERT ON *.* TO `bar`@`%`
GRANT INSERT ON `mysql`.* TO `bar`@`%`
# Should be able to grant/revoke other DB level privileges without
# affecting existing partial revokes.
REVOKE ALL ON *.* FROM bar;
GRANT INSERT ON *.* TO bar;
GRANT INSERT ON `pr_db`.* TO bar;
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT INSERT ON *.* TO `bar`@`%`
GRANT INSERT ON `pr_db`.* TO `bar`@`%`
REVOKE INSERT ON `mysql`.* FROM `bar`@`%`
# Revoke the privilge. Partial revokes should remain intact
REVOKE INSERT ON `pr_db`.* FROM bar;
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT INSERT ON *.* TO `bar`@`%`
REVOKE INSERT ON `mysql`.* FROM `bar`@`%`
include/sync_slave_sql_with_master.inc
[connection slave]
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT INSERT ON *.* TO `bar`@`%`
REVOKE INSERT ON `mysql`.* FROM `bar`@`%`
[connection foo_master]
DROP USER foo, bar;
#
# 4. Grantor and grantee both have restriction list
#
# 4.1 Restrictions are aggregated
CREATE USER foo, bar;
GRANT INSERT, SELECT, UPDATE ON *.* TO foo WITH GRANT OPTION;
# Restrict INSERT, UPDATE on mysql DB from foo.
REVOKE INSERT, UPDATE ON mysql.* FROM foo;
SELECT user, user_attributes FROM mysql.user WHERE user LIKE 'foo';
user	user_attributes
foo	{"Restrictions": [{"Database": "mysql", "Privileges": ["INSERT", "UPDATE"]}]}
GRANT DELETE, DROP, UPDATE, SELECT ON *.* TO bar;
# Restrict UPDATE and DROP on mysql DB.
REVOKE UPDATE, DROP ON mysql.* FROM bar;
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT SELECT, UPDATE, DELETE, DROP ON *.* TO `bar`@`%`
REVOKE UPDATE, DROP ON `mysql`.* FROM `bar`@`%`
[connection foo_master]
# Restrictions from Grantor and Grantee must be aggregated
GRANT INSERT ON *.* TO bar;
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT SELECT, INSERT, UPDATE, DELETE, DROP ON *.* TO `bar`@`%`
REVOKE INSERT, UPDATE, DROP ON `mysql`.* FROM `bar`@`%`
include/sync_slave_sql_with_master.inc
[connection slave]
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT SELECT, INSERT, UPDATE, DELETE, DROP ON *.* TO `bar`@`%`
REVOKE INSERT, UPDATE, DROP ON `mysql`.* FROM `bar`@`%`
[connection foo_master]
REVOKE ALL ON *.* FROM foo, bar;
# 4.2 Restrictions are cleared
GRANT SELECT, CREATE, ALTER ON *.* TO foo WITH GRANT OPTION;
REVOKE SELECT ON mysql.* FROM foo;
GRANT SELECT, CREATE ON *.* TO bar;
REVOKE CREATE ON mysql.* FROM bar;
SHOW GRANTS FOR foo;
Grants for foo@%
GRANT SELECT, CREATE, ALTER ON *.* TO `foo`@`%` WITH GRANT OPTION
REVOKE SELECT ON `mysql`.* FROM `foo`@`%`
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT SELECT, CREATE ON *.* TO `bar`@`%`
REVOKE CREATE ON `mysql`.* FROM `bar`@`%`
[connection foo_master]
# Aggregated restrictions turns out to be empty
GRANT SELECT, CREATE,ALTER ON *.* TO bar;
include/sync_slave_sql_with_master.inc
[connection slave]
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT SELECT, CREATE, ALTER ON *.* TO `bar`@`%`
[connection foo_master]
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT SELECT, CREATE, ALTER ON *.* TO `bar`@`%`
DROP USER foo, bar;
#
# 5. Grantor has restriction list and grantee does not have any priv
#
CREATE USER foo, bar;
GRANT INSERT, SELECT ON *.* TO foo WITH GRANT OPTION;
[connection foo_master]
# Grantor should be able to add revoke on mysql DB on itself
REVOKE INSERT ON mysql.* FROM foo;
SHOW GRANTS FOR foo;
Grants for foo@%
GRANT SELECT, INSERT ON *.* TO `foo`@`%` WITH GRANT OPTION
REVOKE INSERT ON `mysql`.* FROM `foo`@`%`
[connection foo_master_reconn]
# Restrictions must remain intact if grantor reconnects and try to
# grant global privilege to self. In other words, it must be no-op.
GRANT INSERT ON *.* TO foo;
SHOW GRANTS FOR foo;
Grants for foo@%
GRANT SELECT, INSERT ON *.* TO `foo`@`%` WITH GRANT OPTION
REVOKE INSERT ON `mysql`.* FROM `foo`@`%`
# Grantee should get the restriction_list of grantor
GRANT INSERT, SELECT ON *.* TO bar;
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT SELECT, INSERT ON *.* TO `bar`@`%`
REVOKE INSERT ON `mysql`.* FROM `bar`@`%`
# Grantor should be able to add additional restrictions list
REVOKE INSERT,SELECT ON `pr_db`.* FROM bar;
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT SELECT, INSERT ON *.* TO `bar`@`%`
REVOKE INSERT ON `mysql`.* FROM `bar`@`%`
REVOKE SELECT, INSERT ON `pr_db`.* FROM `bar`@`%`
# Additional restrictions of Grantee should be removed.
GRANT INSERT, SELECT ON *.* TO bar;
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT SELECT, INSERT ON *.* TO `bar`@`%`
REVOKE INSERT ON `mysql`.* FROM `bar`@`%`
# Should remove, the  global privileges and restrictions both
REVOKE SELECT, INSERT ON *.* FROM bar;
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT USAGE ON *.* TO `bar`@`%`
# Grantee should get the restriction_list of grantor again
GRANT INSERT, SELECT ON *.* TO bar;
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT SELECT, INSERT ON *.* TO `bar`@`%`
REVOKE INSERT ON `mysql`.* FROM `bar`@`%`
# Remove only global privilege from grantee
REVOKE SELECT ON *.* FROM bar;
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT INSERT ON *.* TO `bar`@`%`
REVOKE INSERT ON `mysql`.* FROM `bar`@`%`
include/sync_slave_sql_with_master.inc
[connection slave]
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT INSERT ON *.* TO `bar`@`%`
REVOKE INSERT ON `mysql`.* FROM `bar`@`%`
[connection foo_master]
DROP USER foo, bar;
#
# 6. Revoke global privilege as well restriction list from grantee
#    when grantor does not have restriction list
#
CREATE USER foo, bar;
GRANT SELECT, INSERT ON *.* TO foo WITH GRANT OPTION;
# User already have DB level priv
GRANT INSERT ON mysql.* TO bar;
[connection foo_master]
# Grant global INSERT privilege to bar
GRANT INSERT ON *.* TO bar;
# Revoke INSERT on mysql DB from bar
REVOKE INSERT ON mysql.* FROM bar;
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT INSERT ON *.* TO `bar`@`%`
include/sync_slave_sql_with_master.inc
[connection slave]
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT INSERT ON *.* TO `bar`@`%`
[connection foo_master]
# Add partial revoke INSERT on mysql DB for bar.
REVOKE INSERT ON mysql.* FROM bar;
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT INSERT ON *.* TO `bar`@`%`
REVOKE INSERT ON `mysql`.* FROM `bar`@`%`
include/sync_slave_sql_with_master.inc
[connection slave]
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT INSERT ON *.* TO `bar`@`%`
REVOKE INSERT ON `mysql`.* FROM `bar`@`%`
[connection foo_master]
# Revoke Global privilege as well  as partial revoke.
REVOKE INSERT ON *.* FROM bar;
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT USAGE ON *.* TO `bar`@`%`
include/sync_slave_sql_with_master.inc
[connection slave]
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT USAGE ON *.* TO `bar`@`%`
[connection foo_master]
DROP USER foo,bar;
#
# 7. Granting a global privilege should not affect the restrictions
#    of different privileges on other databases.
#
CREATE USER foo;
CREATE DATABASE  secret;
CREATE DATABASE  meeting;
GRANT INSERT, SELECT, UPDATE ON *.* TO foo;
REVOKE SELECT,INSERT ON secret.* FROM foo;
REVOKE SELECT, UPDATE ON meeting.* FROM foo;
SHOW GRANTS FOR foo;
Grants for foo@%
GRANT SELECT, INSERT, UPDATE ON *.* TO `foo`@`%`
REVOKE SELECT, UPDATE ON `meeting`.* FROM `foo`@`%`
REVOKE SELECT, INSERT ON `secret`.* FROM `foo`@`%`
# Only SELECT restrictions should have removed from
# all databases in the restriction_list
GRANT SELECT ON *.* TO foo;
SHOW GRANTS FOR foo;
Grants for foo@%
GRANT SELECT, INSERT, UPDATE ON *.* TO `foo`@`%`
REVOKE UPDATE ON `meeting`.* FROM `foo`@`%`
REVOKE INSERT ON `secret`.* FROM `foo`@`%`
DROP USER foo;
DROP DATABASE secret;
DROP DATABASE meeting;
#
# 8. Granting a DB level privilege should not affect the restrictions
#    of different privileges on other databases.
#
CREATE USER foo;
CREATE DATABASE  secret;
CREATE DATABASE  meeting;
GRANT INSERT,DELETE, SELECT, UPDATE ON *.* TO foo;
GRANT SELECT,INSERT ON meeting.* TO foo;
GRANT DELETE,UPDATE ON secret.* TO foo;
REVOKE SELECT,INSERT ON secret.* FROM foo;
REVOKE DELETE, UPDATE ON meeting.* FROM foo;
# Grant sub-set from the set of already granted privileges
GRANT SELECT ON meeting.* TO foo WITH GRANT OPTION;
# The restrictions should not have modified.
SHOW GRANTS FOR foo;
Grants for foo@%
GRANT SELECT, INSERT, UPDATE, DELETE ON *.* TO `foo`@`%`
GRANT SELECT, INSERT ON `meeting`.* TO `foo`@`%` WITH GRANT OPTION
GRANT UPDATE, DELETE ON `secret`.* TO `foo`@`%`
REVOKE UPDATE, DELETE ON `meeting`.* FROM `foo`@`%`
REVOKE SELECT, INSERT ON `secret`.* FROM `foo`@`%`
# Grant all privileges from set of already granted privileges
GRANT SELECT,INSERT ON meeting.* TO foo WITH GRANT OPTION;
# The restrictions should not have modified.
SHOW GRANTS FOR foo;
Grants for foo@%
GRANT SELECT, INSERT, UPDATE, DELETE ON *.* TO `foo`@`%`
GRANT SELECT, INSERT ON `meeting`.* TO `foo`@`%` WITH GRANT OPTION
GRANT UPDATE, DELETE ON `secret`.* TO `foo`@`%`
REVOKE UPDATE, DELETE ON `meeting`.* FROM `foo`@`%`
REVOKE SELECT, INSERT ON `secret`.* FROM `foo`@`%`
# Grant sub-set from the set of already granted privileges
GRANT UPDATE ON secret.* TO foo;
# The restrictions should not have modified.
SHOW GRANTS FOR foo;
Grants for foo@%
GRANT SELECT, INSERT, UPDATE, DELETE ON *.* TO `foo`@`%`
GRANT SELECT, INSERT ON `meeting`.* TO `foo`@`%` WITH GRANT OPTION
GRANT UPDATE, DELETE ON `secret`.* TO `foo`@`%`
REVOKE UPDATE, DELETE ON `meeting`.* FROM `foo`@`%`
REVOKE SELECT, INSERT ON `secret`.* FROM `foo`@`%`
# Grant all privileges from set of already granted privileges
GRANT DELETE,UPDATE ON secret.* TO foo;
# The restrictions should not have modified.
SHOW GRANTS FOR foo;
Grants for foo@%
GRANT SELECT, INSERT, UPDATE, DELETE ON *.* TO `foo`@`%`
GRANT SELECT, INSERT ON `meeting`.* TO `foo`@`%` WITH GRANT OPTION
GRANT UPDATE, DELETE ON `secret`.* TO `foo`@`%`
REVOKE UPDATE, DELETE ON `meeting`.* FROM `foo`@`%`
REVOKE SELECT, INSERT ON `secret`.* FROM `foo`@`%`
# Remove the partial revokes
GRANT SELECT,INSERT ON secret.* TO foo;
GRANT DELETE,UPDATE ON meeting.* TO foo;
SHOW GRANTS FOR foo;
Grants for foo@%
GRANT SELECT, INSERT, UPDATE, DELETE ON *.* TO `foo`@`%`
GRANT SELECT, INSERT ON `meeting`.* TO `foo`@`%` WITH GRANT OPTION
GRANT UPDATE, DELETE ON `secret`.* TO `foo`@`%`
DROP USER foo;
DROP DATABASE secret;
DROP DATABASE meeting;
#
# 9. Revoke all privileges from user(s)
#
CREATE USER foo, bar, baz;
CREATE DATABASE secret_db;
#
# 9.1. Grantor has restriction list but grantee does not.
GRANT ALL ON *.* TO foo,baz;
GRANT ALL ON mysql.* TO foo,baz;
GRANT ALL ON mysql.* TO bar;
# All privileges must be cleared from all three users
REVOKE ALL ON *.* FROM foo;
REVOKE ALL ON mysql.* FROM baz;
REVOKE ALL ON mysql.* FROM bar;
SHOW GRANTS FOR foo;
Grants for foo@%
GRANT USAGE ON *.* TO `foo`@`%`
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT USAGE ON *.* TO `bar`@`%`
SHOW GRANTS FOR baz;
Grants for baz@%
GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, RELOAD, SHUTDOWN, PROCESS, FILE, REFERENCES, INDEX, ALTER, SHOW DATABASES, SUPER, CREATE TEMPORARY TABLES, LOCK TABLES, EXECUTE, REPLICATION SLAVE, REPLICATION CLIENT, CREATE VIEW, SHOW VIEW, CREATE ROUTINE, ALTER ROUTINE, CREATE USER, EVENT, TRIGGER, CREATE TABLESPACE, CREATE ROLE, DROP ROLE ON *.* TO `baz`@`%`
GRANT APPLICATION_PASSWORD_ADMIN,AUDIT_ADMIN,BACKUP_ADMIN,BINLOG_ADMIN,BINLOG_ENCRYPTION_ADMIN,CLONE_ADMIN,CONNECTION_ADMIN,ENCRYPTION_KEY_ADMIN,GROUP_REPLICATION_ADMIN,INNODB_REDO_LOG_ARCHIVE,PERSIST_RO_VARIABLES_ADMIN,REPLICATION_APPLIER,REPLICATION_SLAVE_ADMIN,RESOURCE_GROUP_ADMIN,RESOURCE_GROUP_USER,ROLE_ADMIN,SERVICE_CONNECTION_ADMIN,SESSION_VARIABLES_ADMIN,SET_USER_ID,SYSTEM_USER,SYSTEM_VARIABLES_ADMIN,TABLE_ENCRYPTION_ADMIN,XA_RECOVER_ADMIN ON *.* TO `baz`@`%`
DROP USER baz;
# Create partial_revokes for foo
GRANT ALL ON *.* TO foo WITH GRANT OPTION;
REVOKE SELECT ON mysql.* FROM foo;
# GRANT ALL should remove the partial revokes created above
GRANT ALL ON *.* TO foo WITH GRANT OPTION;
SHOW GRANTS FOR foo;
Grants for foo@%
GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, RELOAD, SHUTDOWN, PROCESS, FILE, REFERENCES, INDEX, ALTER, SHOW DATABASES, SUPER, CREATE TEMPORARY TABLES, LOCK TABLES, EXECUTE, REPLICATION SLAVE, REPLICATION CLIENT, CREATE VIEW, SHOW VIEW, CREATE ROUTINE, ALTER ROUTINE, CREATE USER, EVENT, TRIGGER, CREATE TABLESPACE, CREATE ROLE, DROP ROLE ON *.* TO `foo`@`%` WITH GRANT OPTION
GRANT APPLICATION_PASSWORD_ADMIN,AUDIT_ADMIN,BACKUP_ADMIN,BINLOG_ADMIN,BINLOG_ENCRYPTION_ADMIN,CLONE_ADMIN,CONNECTION_ADMIN,ENCRYPTION_KEY_ADMIN,GROUP_REPLICATION_ADMIN,INNODB_REDO_LOG_ARCHIVE,PERSIST_RO_VARIABLES_ADMIN,REPLICATION_APPLIER,REPLICATION_SLAVE_ADMIN,RESOURCE_GROUP_ADMIN,RESOURCE_GROUP_USER,ROLE_ADMIN,SERVICE_CONNECTION_ADMIN,SESSION_VARIABLES_ADMIN,SET_USER_ID,SYSTEM_USER,SYSTEM_VARIABLES_ADMIN,TABLE_ENCRYPTION_ADMIN,XA_RECOVER_ADMIN ON *.* TO `foo`@`%` WITH GRANT OPTION
# create partial revokes again
REVOKE SELECT ON mysql.* FROM foo;
SHOW GRANTS FOR foo;
Grants for foo@%
GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, RELOAD, SHUTDOWN, PROCESS, FILE, REFERENCES, INDEX, ALTER, SHOW DATABASES, SUPER, CREATE TEMPORARY TABLES, LOCK TABLES, EXECUTE, REPLICATION SLAVE, REPLICATION CLIENT, CREATE VIEW, SHOW VIEW, CREATE ROUTINE, ALTER ROUTINE, CREATE USER, EVENT, TRIGGER, CREATE TABLESPACE, CREATE ROLE, DROP ROLE ON *.* TO `foo`@`%` WITH GRANT OPTION
GRANT APPLICATION_PASSWORD_ADMIN,AUDIT_ADMIN,BACKUP_ADMIN,BINLOG_ADMIN,BINLOG_ENCRYPTION_ADMIN,CLONE_ADMIN,CONNECTION_ADMIN,ENCRYPTION_KEY_ADMIN,GROUP_REPLICATION_ADMIN,INNODB_REDO_LOG_ARCHIVE,PERSIST_RO_VARIABLES_ADMIN,REPLICATION_APPLIER,REPLICATION_SLAVE_ADMIN,RESOURCE_GROUP_ADMIN,RESOURCE_GROUP_USER,ROLE_ADMIN,SERVICE_CONNECTION_ADMIN,SESSION_VARIABLES_ADMIN,SET_USER_ID,SYSTEM_USER,SYSTEM_VARIABLES_ADMIN,TABLE_ENCRYPTION_ADMIN,XA_RECOVER_ADMIN ON *.* TO `foo`@`%` WITH GRANT OPTION
REVOKE SELECT ON `mysql`.* FROM `foo`@`%`
GRANT ALL ON mysql.* TO bar;
[connection foo_master]
REVOKE ALL ON *.* FROM bar;
ERROR HY000: Access denied for AuthId `foo`@`%` to database 'mysql'.
REVOKE ALL ON mysql.* FROM bar;
GRANT ALL ON *.* TO bar;
REVOKE SELECT ON mysql.* FROM bar;
# grantor and grantee both have exact same privileges and partial revokes
SHOW GRANTS FOR foo;
Grants for foo@%
GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, RELOAD, SHUTDOWN, PROCESS, FILE, REFERENCES, INDEX, ALTER, SHOW DATABASES, SUPER, CREATE TEMPORARY TABLES, LOCK TABLES, EXECUTE, REPLICATION SLAVE, REPLICATION CLIENT, CREATE VIEW, SHOW VIEW, CREATE ROUTINE, ALTER ROUTINE, CREATE USER, EVENT, TRIGGER, CREATE TABLESPACE, CREATE ROLE, DROP ROLE ON *.* TO `foo`@`%` WITH GRANT OPTION
GRANT APPLICATION_PASSWORD_ADMIN,AUDIT_ADMIN,BACKUP_ADMIN,BINLOG_ADMIN,BINLOG_ENCRYPTION_ADMIN,CLONE_ADMIN,CONNECTION_ADMIN,ENCRYPTION_KEY_ADMIN,GROUP_REPLICATION_ADMIN,INNODB_REDO_LOG_ARCHIVE,PERSIST_RO_VARIABLES_ADMIN,REPLICATION_APPLIER,REPLICATION_SLAVE_ADMIN,RESOURCE_GROUP_ADMIN,RESOURCE_GROUP_USER,ROLE_ADMIN,SERVICE_CONNECTION_ADMIN,SESSION_VARIABLES_ADMIN,SET_USER_ID,SYSTEM_USER,SYSTEM_VARIABLES_ADMIN,TABLE_ENCRYPTION_ADMIN,XA_RECOVER_ADMIN ON *.* TO `foo`@`%` WITH GRANT OPTION
REVOKE SELECT ON `mysql`.* FROM `foo`@`%`
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, RELOAD, SHUTDOWN, PROCESS, FILE, REFERENCES, INDEX, ALTER, SHOW DATABASES, SUPER, CREATE TEMPORARY TABLES, LOCK TABLES, EXECUTE, REPLICATION SLAVE, REPLICATION CLIENT, CREATE VIEW, SHOW VIEW, CREATE ROUTINE, ALTER ROUTINE, CREATE USER, EVENT, TRIGGER, CREATE TABLESPACE, CREATE ROLE, DROP ROLE ON *.* TO `bar`@`%`
GRANT APPLICATION_PASSWORD_ADMIN,AUDIT_ADMIN,BACKUP_ADMIN,BINLOG_ADMIN,BINLOG_ENCRYPTION_ADMIN,CLONE_ADMIN,CONNECTION_ADMIN,ENCRYPTION_KEY_ADMIN,GROUP_REPLICATION_ADMIN,INNODB_REDO_LOG_ARCHIVE,PERSIST_RO_VARIABLES_ADMIN,REPLICATION_APPLIER,REPLICATION_SLAVE_ADMIN,RESOURCE_GROUP_ADMIN,RESOURCE_GROUP_USER,ROLE_ADMIN,SERVICE_CONNECTION_ADMIN,SESSION_VARIABLES_ADMIN,SET_USER_ID,SYSTEM_USER,SYSTEM_VARIABLES_ADMIN,TABLE_ENCRYPTION_ADMIN,XA_RECOVER_ADMIN ON *.* TO `bar`@`%`
REVOKE SELECT ON `mysql`.* FROM `bar`@`%`
# grantor should be able to remove the privileges & partial revokes both
REVOKE ALL ON *.* FROM bar;
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT USAGE ON *.* TO `bar`@`%`
include/sync_slave_sql_with_master.inc
[connection slave]
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT USAGE ON *.* TO `bar`@`%`
[connection foo_master]
REVOKE ALL ON *.* FROM foo,bar;
#
# 9.2. REVOKE ALL followed by GLOBAL grants should create restrictions
GRANT ALL ON *.* TO foo WITH GRANT OPTION;
# Following should create restrictions for mysql db
REVOKE ALL ON mysql.* FROM foo;
SHOW GRANTS FOR foo;
Grants for foo@%
GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, RELOAD, SHUTDOWN, PROCESS, FILE, REFERENCES, INDEX, ALTER, SHOW DATABASES, SUPER, CREATE TEMPORARY TABLES, LOCK TABLES, EXECUTE, REPLICATION SLAVE, REPLICATION CLIENT, CREATE VIEW, SHOW VIEW, CREATE ROUTINE, ALTER ROUTINE, CREATE USER, EVENT, TRIGGER, CREATE TABLESPACE, CREATE ROLE, DROP ROLE ON *.* TO `foo`@`%` WITH GRANT OPTION
GRANT APPLICATION_PASSWORD_ADMIN,AUDIT_ADMIN,BACKUP_ADMIN,BINLOG_ADMIN,BINLOG_ENCRYPTION_ADMIN,CLONE_ADMIN,CONNECTION_ADMIN,ENCRYPTION_KEY_ADMIN,GROUP_REPLICATION_ADMIN,INNODB_REDO_LOG_ARCHIVE,PERSIST_RO_VARIABLES_ADMIN,REPLICATION_APPLIER,REPLICATION_SLAVE_ADMIN,RESOURCE_GROUP_ADMIN,RESOURCE_GROUP_USER,ROLE_ADMIN,SERVICE_CONNECTION_ADMIN,SESSION_VARIABLES_ADMIN,SET_USER_ID,SYSTEM_USER,SYSTEM_VARIABLES_ADMIN,TABLE_ENCRYPTION_ADMIN,XA_RECOVER_ADMIN ON *.* TO `foo`@`%` WITH GRANT OPTION
REVOKE SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, REFERENCES, INDEX, ALTER, CREATE TEMPORARY TABLES, LOCK TABLES, EXECUTE, CREATE VIEW, SHOW VIEW, CREATE ROUTINE, ALTER ROUTINE, EVENT, TRIGGER ON `mysql`.* FROM `foo`@`%`
# restrictions must pass to bar as well
GRANT ALL ON *.* TO bar;
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, RELOAD, SHUTDOWN, PROCESS, FILE, REFERENCES, INDEX, ALTER, SHOW DATABASES, SUPER, CREATE TEMPORARY TABLES, LOCK TABLES, EXECUTE, REPLICATION SLAVE, REPLICATION CLIENT, CREATE VIEW, SHOW VIEW, CREATE ROUTINE, ALTER ROUTINE, CREATE USER, EVENT, TRIGGER, CREATE TABLESPACE, CREATE ROLE, DROP ROLE ON *.* TO `bar`@`%`
GRANT APPLICATION_PASSWORD_ADMIN,AUDIT_ADMIN,BACKUP_ADMIN,BINLOG_ADMIN,BINLOG_ENCRYPTION_ADMIN,CLONE_ADMIN,CONNECTION_ADMIN,ENCRYPTION_KEY_ADMIN,GROUP_REPLICATION_ADMIN,INNODB_REDO_LOG_ARCHIVE,PERSIST_RO_VARIABLES_ADMIN,REPLICATION_APPLIER,REPLICATION_SLAVE_ADMIN,RESOURCE_GROUP_ADMIN,RESOURCE_GROUP_USER,ROLE_ADMIN,SERVICE_CONNECTION_ADMIN,SESSION_VARIABLES_ADMIN,SET_USER_ID,SYSTEM_USER,SYSTEM_VARIABLES_ADMIN,TABLE_ENCRYPTION_ADMIN,XA_RECOVER_ADMIN ON *.* TO `bar`@`%`
REVOKE SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, REFERENCES, INDEX, ALTER, CREATE TEMPORARY TABLES, LOCK TABLES, EXECUTE, CREATE VIEW, SHOW VIEW, CREATE ROUTINE, ALTER ROUTINE, EVENT, TRIGGER ON `mysql`.* FROM `bar`@`%`
include/sync_slave_sql_with_master.inc
[connection slave]
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, RELOAD, SHUTDOWN, PROCESS, FILE, REFERENCES, INDEX, ALTER, SHOW DATABASES, SUPER, CREATE TEMPORARY TABLES, LOCK TABLES, EXECUTE, REPLICATION SLAVE, REPLICATION CLIENT, CREATE VIEW, SHOW VIEW, CREATE ROUTINE, ALTER ROUTINE, CREATE USER, EVENT, TRIGGER, CREATE TABLESPACE, CREATE ROLE, DROP ROLE ON *.* TO `bar`@`%`
GRANT APPLICATION_PASSWORD_ADMIN,AUDIT_ADMIN,BACKUP_ADMIN,BINLOG_ADMIN,BINLOG_ENCRYPTION_ADMIN,CLONE_ADMIN,CONNECTION_ADMIN,ENCRYPTION_KEY_ADMIN,GROUP_REPLICATION_ADMIN,INNODB_REDO_LOG_ARCHIVE,PERSIST_RO_VARIABLES_ADMIN,REPLICATION_APPLIER,REPLICATION_SLAVE_ADMIN,RESOURCE_GROUP_ADMIN,RESOURCE_GROUP_USER,ROLE_ADMIN,SERVICE_CONNECTION_ADMIN,SESSION_VARIABLES_ADMIN,SET_USER_ID,SYSTEM_USER,SYSTEM_VARIABLES_ADMIN,TABLE_ENCRYPTION_ADMIN,XA_RECOVER_ADMIN ON *.* TO `bar`@`%`
REVOKE SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, REFERENCES, INDEX, ALTER, CREATE TEMPORARY TABLES, LOCK TABLES, EXECUTE, CREATE VIEW, SHOW VIEW, CREATE ROUTINE, ALTER ROUTINE, EVENT, TRIGGER ON `mysql`.* FROM `bar`@`%`
[connection foo_master]
REVOKE ALL ON *.* FROM foo,bar;
#
# 9.3. Grantee has restriction list but grantor does not.
GRANT CREATE USER ON *.* TO foo WITH GRANT OPTION;
GRANT INSERT,SELECT ON *.* TO foo, bar;
REVOKE SELECT,INSERT ON mysql.* FROM bar;
REVOKE INSERT ON secret_db.* FROM bar;
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT SELECT, INSERT ON *.* TO `bar`@`%`
REVOKE SELECT, INSERT ON `mysql`.* FROM `bar`@`%`
REVOKE INSERT ON `secret_db`.* FROM `bar`@`%`
[connection foo_master]
REVOKE ALL ON *.* FROM bar;
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT USAGE ON *.* TO `bar`@`%`
include/sync_slave_sql_with_master.inc
[connection slave]
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT USAGE ON *.* TO `bar`@`%`
[connection foo_master]
#
# 9.4. Grantor and grantee both have restriction_list
GRANT INSERT,SELECT ON *.* TO bar;
REVOKE SELECT ON mysql.* FROM bar;
REVOKE SELECT,INSERT ON secret_db.* FROM bar;
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT SELECT, INSERT ON *.* TO `bar`@`%`
REVOKE SELECT ON `mysql`.* FROM `bar`@`%`
REVOKE SELECT, INSERT ON `secret_db`.* FROM `bar`@`%`
GRANT UPDATE ON *.* TO foo;
REVOKE UPDATE,SELECT ON secret_db.* FROM foo;
SHOW GRANTS FOR foo;
Grants for foo@%
GRANT SELECT, INSERT, UPDATE, CREATE USER ON *.* TO `foo`@`%` WITH GRANT OPTION
REVOKE SELECT, UPDATE ON `secret_db`.* FROM `foo`@`%`
[connection foo_master]
# Should fail because foo cannot remove SELECT priv on bar
REVOKE ALL ON *.* FROM bar;
ERROR HY000: Access denied for AuthId `foo`@`%` to database 'secret_db'.
GRANT SELECT ON `secret_db`.* TO foo;
SHOW GRANTS FOR foo;
Grants for foo@%
GRANT SELECT, INSERT, UPDATE, CREATE USER ON *.* TO `foo`@`%` WITH GRANT OPTION
REVOKE UPDATE ON `secret_db`.* FROM `foo`@`%`
[connection foo_master]
# Should work because restriction on foo is different from bar
REVOKE ALL ON *.* FROM bar;
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT USAGE ON *.* TO `bar`@`%`
include/sync_slave_sql_with_master.inc
[connection slave]
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT USAGE ON *.* TO `bar`@`%`
[connection foo_master]
DROP USER  foo, bar;
DROP DATABASE secret_db;
#
# 10. Revoke a global privilege from grantee which is not present in the
#     grantor's restriction_list
#
CREATE USER foo, bar;
GRANT SELECT,INSERT ON *.* TO foo WITH GRANT OPTION;
REVOKE INSERT ON mysql.* FROM foo;
GRANT SELECT ON *.* TO bar;
SHOW GRANTS FOR foo;
Grants for foo@%
GRANT SELECT, INSERT ON *.* TO `foo`@`%` WITH GRANT OPTION
REVOKE INSERT ON `mysql`.* FROM `foo`@`%`
[connection foo_master]
# Should work because restriction on foo is different from bar
REVOKE SELECT ON *.* FROM bar;
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT USAGE ON *.* TO `bar`@`%`
include/sync_slave_sql_with_master.inc
[connection slave]
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT USAGE ON *.* TO `bar`@`%`
[connection foo_master]
DROP USER  foo, bar;
#
# 11. Partial revokes with anonymous user
#
INSERT INTO pr_db.t1 values (1,2), (3,4);
INSERT INTO normal_db.t1 values (1,2), (3,4);
#
# 11.1 Grantor is anonymous user
#
CREATE TEMPORARY TABLE mysql.db_copy AS SELECT * FROM mysql.db;
DELETE FROM mysql.db WHERE host='%';
FLUSH PRIVILEGES;
CREATE USER ''@'%', ''@'';
GRANT SELECT ON *.* TO ''@'%' WITH GRANT OPTION;
REVOKE SELECT ON pr_db.* FROM ''@'%';
[connection anonymous_con_1]
SHOW GRANTS;
Grants for @%
GRANT SELECT ON *.* TO ``@`%` WITH GRANT OPTION
REVOKE SELECT ON `pr_db`.* FROM ``@`%`
SELECT COUNT(*) FROM normal_db.t1;
COUNT(*)
4
SELECT COUNT(*) FROM pr_db.t1;
ERROR 42000: SELECT command denied to user ''@'localhost' for table 't1'
GRANT SELECT ON *.* TO ''@'';
SHOW GRANTS FOR ''@'';
Grants for @
GRANT SELECT ON *.* TO ``@``
REVOKE SELECT ON `pr_db`.* FROM ``@``
DROP USER ''@'%',''@'';
#
# 11.2 Grantee is anonymous user
#
CREATE USER foo@localhost,''@'%';
GRANT SELECT ON *.* TO foo@localhost,''@'%' WITH GRANT OPTION;
[connection foo_master]
# Create partial revoke for anonymous user from normal user
REVOKE SELECT ON pr_db.* FROM ''@'%';
SHOW GRANTS FOR ''@'%';
Grants for @%
GRANT SELECT ON *.* TO ``@`%` WITH GRANT OPTION
REVOKE SELECT ON `pr_db`.* FROM ``@`%`
# Anynmous user cannot access the restricted database
[connection anonymous_con_1]
SELECT COUNT(*) FROM normal_db.t1;
COUNT(*)
4
SELECT COUNT(*) FROM pr_db.t1;
ERROR 42000: SELECT command denied to user ''@'localhost' for table 't1'
DROP USER foo@localhost,''@'%';
DELETE FROM mysql.db;
INSERT INTO mysql.db SELECT * FROM mysql.db_copy;
FLUSH PRIVILEGES;
DROP TABLE mysql.db_copy;
#
# 12. Hybrid scenarios
#
CREATE USER foo, bar;
CREATE DATABASE robo;
GRANT UPDATE, INSERT ON *.* TO bar;
REVOKE UPDATE, INSERT ON robo.* FROM bar;
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT INSERT, UPDATE ON *.* TO `bar`@`%`
REVOKE INSERT, UPDATE ON `robo`.* FROM `bar`@`%`
# 12.1. Remove the applicable partial revokes(update and insert) as
#       well as grant applicable DB level privileges(select and delete)
GRANT INSERT, UPDATE, DELETE, SELECT ON robo.* TO bar;
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT INSERT, UPDATE ON *.* TO `bar`@`%`
GRANT SELECT, DELETE ON `robo`.* TO `bar`@`%`
# 12.2. Add the applicable partial revokes(update and insert) as well
#       as revoke applicable DB level privileges(select and delete)
REVOKE INSERT, UPDATE, DELETE, SELECT ON robo.* FROM bar;
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT INSERT, UPDATE ON *.* TO `bar`@`%`
REVOKE INSERT, UPDATE ON `robo`.* FROM `bar`@`%`
# 12.3 Grant global and DB level privilege then revoke the DB level
GRANT SELECT, DROP ON *.* TO foo;
GRANT DROP ON robo.* TO foo;
SHOW GRANTS FOR foo;
Grants for foo@%
GRANT SELECT, DROP ON *.* TO `foo`@`%`
GRANT DROP ON `robo`.* TO `foo`@`%`
REVOKE SELECT, DROP ON robo.* FROM foo;
SHOW GRANTS FOR foo;
Grants for foo@%
GRANT SELECT, DROP ON *.* TO `foo`@`%`
REVOKE SELECT ON `robo`.* FROM `foo`@`%`
DROP USER foo,bar;
DROP DATABASE robo;
#
# 13. Misc scenarios
#
# 13.1 Revoking DB level privilege multiple times should not
#      create/affect the restrictions
CREATE USER foo;
GRANT ALL ON mysql.* TO foo;
REVOKE SELECT ON mysql.* FROM foo;
REVOKE SELECT ON mysql.* FROM foo;
SHOW GRANTS FOR foo;
Grants for foo@%
GRANT USAGE ON *.* TO `foo`@`%`
GRANT INSERT, UPDATE, DELETE, CREATE, DROP, REFERENCES, INDEX, ALTER, CREATE TEMPORARY TABLES, LOCK TABLES, EXECUTE, CREATE VIEW, SHOW VIEW, CREATE ROUTINE, ALTER ROUTINE, EVENT, TRIGGER ON `mysql`.* TO `foo`@`%`
# 13.2 Granting DB level privilege multiple times should not
#      create/affect the restrictions
REVOKE ALL ON mysql.* FROM foo;
GRANT SELECT ON mysql.* TO foo;
GRANT SELECT ON mysql.* TO foo;
SHOW GRANTS FOR foo;
Grants for foo@%
GRANT USAGE ON *.* TO `foo`@`%`
GRANT SELECT ON `mysql`.* TO `foo`@`%`
DROP USER foo;
------------Tests related to Users end here -----------------------------
-------------------------------------------------------------------------
Tests related to Roles
-------------------------------------------------------------------------
#
# 1. Activate/Deactivate roles with partial revokes
#
CREATE USER foo, bar;
CREATE ROLE insert_role, select_role;
GRANT INSERT ON *.* TO insert_role WITH GRANT OPTION;
REVOKE INSERT ON pr_db.* FROM insert_role;
GRANT SELECT ON *.* TO select_role WITH GRANT OPTION;
REVOKE SELECT ON pr_db.* FROM select_role;
GRANT ROLE_ADMIN ON *.* TO foo;
GRANT select_role TO foo;
GRANT insert_role TO foo;
SHOW GRANTS FOR foo;
Grants for foo@%
GRANT USAGE ON *.* TO `foo`@`%`
GRANT ROLE_ADMIN ON *.* TO `foo`@`%`
GRANT `insert_role`@`%`,`select_role`@`%` TO `foo`@`%`
[connection foo_master]
# Must fail because foo does not have the SELECT privilege
SELECT COUNT(*) FROM mysql.user WHERE user = 'foo';
ERROR 42000: SELECT command denied to user 'foo'@'localhost' for table 'user'
# 1.1. Activate the select_role, now SELECT should work except on pr_db
SET ROLE select_role;
SHOW GRANTS;
Grants for foo@%
GRANT SELECT ON *.* TO `foo`@`%` WITH GRANT OPTION
GRANT ROLE_ADMIN ON *.* TO `foo`@`%`
REVOKE SELECT ON `pr_db`.* FROM `foo`@`%`
GRANT `insert_role`@`%`,`select_role`@`%` TO `foo`@`%`
SELECT COUNT(*) FROM normal_db.t1;
COUNT(*)
4
SELECT COUNT(*) FROM pr_db.t1;
ERROR 42000: SELECT command denied to user 'foo'@'localhost' for table 't1'
# Grant roles to another user 'bar'
GRANT select_role TO bar;
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT USAGE ON *.* TO `bar`@`%`
GRANT `select_role`@`%` TO `bar`@`%`
include/sync_slave_sql_with_master.inc
[connection slave]
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT USAGE ON *.* TO `bar`@`%`
GRANT `select_role`@`%` TO `bar`@`%`
[connection foo_master]
# 1.2. Activate the insert_role and deactivate the select_role
SET ROLE ALL EXCEPT select_role;
SHOW GRANTS;
Grants for foo@%
GRANT INSERT ON *.* TO `foo`@`%` WITH GRANT OPTION
GRANT ROLE_ADMIN ON *.* TO `foo`@`%`
REVOKE INSERT ON `pr_db`.* FROM `foo`@`%`
GRANT `insert_role`@`%`,`select_role`@`%` TO `foo`@`%`
# select must fail but insert should work
SELECT COUNT(*) FROM normal_db.t1;
ERROR 42000: SELECT command denied to user 'foo'@'localhost' for table 't1'
INSERT INTO normal_db.t1 values (5,6);
# Grant roles to another user 'bar'
GRANT insert_role TO bar;
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT USAGE ON *.* TO `bar`@`%`
GRANT `insert_role`@`%`,`select_role`@`%` TO `bar`@`%`
include/sync_slave_sql_with_master.inc
[connection slave]
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT USAGE ON *.* TO `bar`@`%`
GRANT `insert_role`@`%`,`select_role`@`%` TO `bar`@`%`
[connection foo_master]
# 1.3. Deactivate the select_role activated before
SET ROLE NONE;
SHOW GRANTS;
Grants for foo@%
GRANT USAGE ON *.* TO `foo`@`%`
GRANT ROLE_ADMIN ON *.* TO `foo`@`%`
GRANT `insert_role`@`%`,`select_role`@`%` TO `foo`@`%`
SELECT COUNT(*) FROM normal_db.t1;
ERROR 42000: SELECT command denied to user 'foo'@'localhost' for table 't1'
INSERT INTO normal_db.t1 values (5,6);
ERROR 42000: INSERT command denied to user 'foo'@'localhost' for table 't1'
# 1.4. Activate all roles
SET ROLE ALL;
SHOW GRANTS;
Grants for foo@%
GRANT SELECT, INSERT ON *.* TO `foo`@`%` WITH GRANT OPTION
GRANT ROLE_ADMIN ON *.* TO `foo`@`%`
REVOKE SELECT, INSERT ON `pr_db`.* FROM `foo`@`%`
GRANT `insert_role`@`%`,`select_role`@`%` TO `foo`@`%`
INSERT INTO normal_db.t1 values (7,8);
SELECT COUNT(*) FROM normal_db.t1;
COUNT(*)
6
SELECT COUNT(*) FROM pr_db.t1;
ERROR 42000: SELECT command denied to user 'foo'@'localhost' for table 't1'
INSERT INTO pr_db.t1 values (7,8);
ERROR 42000: INSERT command denied to user 'foo'@'localhost' for table 't1'
GRANT insert_role, select_role TO bar;
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT USAGE ON *.* TO `bar`@`%`
GRANT `insert_role`@`%`,`select_role`@`%` TO `bar`@`%`
include/sync_slave_sql_with_master.inc
[connection slave]
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT USAGE ON *.* TO `bar`@`%`
GRANT `insert_role`@`%`,`select_role`@`%` TO `bar`@`%`
[connection foo_master]
# Deactivate the select_role activated before
SET ROLE NONE;
#
# 2. Default roles with partial revokes
#
CREATE USER baz;
GRANT select_role to baz;
SHOW GRANTS FOR foo;
Grants for foo@%
GRANT USAGE ON *.* TO `foo`@`%`
GRANT ROLE_ADMIN ON *.* TO `foo`@`%`
GRANT `insert_role`@`%`,`select_role`@`%` TO `foo`@`%`
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT USAGE ON *.* TO `bar`@`%`
GRANT `insert_role`@`%`,`select_role`@`%` TO `bar`@`%`
SHOW GRANTS FOR baz;
Grants for baz@%
GRANT USAGE ON *.* TO `baz`@`%`
GRANT `select_role`@`%` TO `baz`@`%`
ALTER USER foo DEFAULT ROLE ALL;
SET DEFAULT ROLE select_role TO baz;
[connection foo_master]
SET ROLE DEFAULT;
SHOW GRANTS;
Grants for foo@%
GRANT SELECT, INSERT ON *.* TO `foo`@`%` WITH GRANT OPTION
GRANT ROLE_ADMIN ON *.* TO `foo`@`%`
REVOKE SELECT, INSERT ON `pr_db`.* FROM `foo`@`%`
GRANT `insert_role`@`%`,`select_role`@`%` TO `foo`@`%`
INSERT INTO normal_db.t1 values (9,10);
SELECT COUNT(*) FROM normal_db.t1;
COUNT(*)
7
SELECT COUNT(*) FROM pr_db.t1;
ERROR 42000: SELECT command denied to user 'foo'@'localhost' for table 't1'
INSERT INTO pr_db.t1 values (9,10);
ERROR 42000: INSERT command denied to user 'foo'@'localhost' for table 't1'
GRANT insert_role, select_role TO bar;
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT USAGE ON *.* TO `bar`@`%`
GRANT `insert_role`@`%`,`select_role`@`%` TO `bar`@`%`
include/sync_slave_sql_with_master.inc
[connection slave]
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT USAGE ON *.* TO `bar`@`%`
GRANT `insert_role`@`%`,`select_role`@`%` TO `bar`@`%`
[connection foo_master]
[connection baz_master]
SET ROLE DEFAULT;
SHOW GRANTS;
Grants for baz@%
GRANT SELECT ON *.* TO `baz`@`%` WITH GRANT OPTION
REVOKE SELECT ON `pr_db`.* FROM `baz`@`%`
GRANT `select_role`@`%` TO `baz`@`%`
SELECT COUNT(*) FROM normal_db.t1;
COUNT(*)
7
SELECT COUNT(*) FROM pr_db.t1;
ERROR 42000: SELECT command denied to user 'baz'@'localhost' for table 't1'
DROP USER baz;
# Reset the default roles granted to foo earlier
[connection foo_master]
SET ROLE NONE;
SET DEFAULT ROLE NONE TO foo;
#
# 3. Mandatory roles with partial revokes
#
CREATE ROLE delete_role;
GRANT DELETE ON *.* TO delete_role;
REVOKE DELETE ON pr_db.* FROM delete_role;
SET GLOBAL mandatory_roles='delete_role';
[connection foo_master]
SET ROLE delete_role;
SHOW GRANTS;
Grants for foo@%
GRANT DELETE ON *.* TO `foo`@`%`
GRANT ROLE_ADMIN ON *.* TO `foo`@`%`
REVOKE DELETE ON `pr_db`.* FROM `foo`@`%`
GRANT `delete_role`@`%`,`insert_role`@`%`,`select_role`@`%` TO `foo`@`%`
DELETE FROM normal_db.t1;
DELETE FROM pr_db.t1;
ERROR 42000: DELETE command denied to user 'foo'@'localhost' for table 't1'
SET GLOBAL mandatory_roles='';
DROP ROLE delete_role;
DROP USER foo, bar;
DROP ROLE insert_role, select_role;
#
# 4. Aggregation should not reduce privileges
#
[connection default]
CREATE USER bar;
CREATE ROLE r1;
GRANT SELECT ON *.* TO r1, bar;
REVOKE SELECT ON mysql.* FROM r1;
GRANT INSERT ON *.* TO r1;
GRANT r1 TO bar;
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT SELECT ON *.* TO `bar`@`%`
GRANT `r1`@`%` TO `bar`@`%`
SHOW GRANTS FOR bar USING 'r1';
Grants for bar@%
GRANT SELECT, INSERT ON *.* TO `bar`@`%`
GRANT `r1`@`%` TO `bar`@`%`
[connection bar_master]
SET ROLE ALL;
SELECT user FROM mysql.user WHERE user LIKE 'bar';
user
bar
SHOW GRANTS;
Grants for bar@%
GRANT SELECT, INSERT ON *.* TO `bar`@`%`
GRANT `r1`@`%` TO `bar`@`%`
[connection default]
REVOKE INSERT ON *.* FROM r1;
GRANT SELECT ON *.* TO r1, bar;
REVOKE SELECT ON mysql.* FROM bar;
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT SELECT ON *.* TO `bar`@`%`
REVOKE SELECT ON `mysql`.* FROM `bar`@`%`
GRANT `r1`@`%` TO `bar`@`%`
SHOW GRANTS FOR bar USING 'r1';
Grants for bar@%
GRANT SELECT ON *.* TO `bar`@`%`
GRANT `r1`@`%` TO `bar`@`%`
[connection bar_master]
SET ROLE ALL;
SELECT user FROM mysql.user WHERE user LIKE 'bar';
user
bar
[connection default]
DROP ROLE r1;
DROP USER bar;
#
# 5. Restriction list of roles should apply to grantee
#
[connection default]
CREATE USER foo, bar;
CREATE ROLE r1;
GRANT SELECT ON *.* TO r1 WITH GRANT OPTION;
REVOKE SELECT ON mysql.* FROM r1;
GRANT r1 TO foo;
[connection foo_master]
SET ROLE ALL;
SHOW GRANTS;
Grants for foo@%
GRANT SELECT ON *.* TO `foo`@`%` WITH GRANT OPTION
REVOKE SELECT ON `mysql`.* FROM `foo`@`%`
GRANT `r1`@`%` TO `foo`@`%`
GRANT SELECT ON *.* TO bar;
[connection default]
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT SELECT ON *.* TO `bar`@`%`
REVOKE SELECT ON `mysql`.* FROM `bar`@`%`
include/sync_slave_sql_with_master.inc
[connection slave]
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT SELECT ON *.* TO `bar`@`%`
REVOKE SELECT ON `mysql`.* FROM `bar`@`%`
[connection foo_master]
DROP ROLE r1;
DROP USER foo, bar;
#
# 6. Roles have restrictions but user has global privilege
#
CREATE USER bar;
CREATE ROLE r1;
GRANT SELECT ON *.* TO r1, bar;
REVOKE SELECT ON mysql.* FROM r1;
GRANT r1 TO bar;
[connection bar_master]
SET ROLE ALL;
# Restrictions of roles should not apply since user has higher privilege
SHOW GRANTS;
Grants for bar@%
GRANT SELECT ON *.* TO `bar`@`%`
GRANT `r1`@`%` TO `bar`@`%`
# User's actual privileges ( and restrictions) must be visible
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT SELECT ON *.* TO `bar`@`%`
GRANT `r1`@`%` TO `bar`@`%`
include/sync_slave_sql_with_master.inc
[connection slave]
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT SELECT ON *.* TO `bar`@`%`
GRANT `r1`@`%` TO `bar`@`%`
[connection bar_master]
DROP USER bar;
DROP ROLE r1;
#
# 7. Roles have global privilege but user has restrictions
#
CREATE USER bar;
CREATE ROLE r1;
GRANT SELECT ON *.* TO r1, bar;
REVOKE SELECT ON mysql.* FROM bar;
GRANT r1 TO bar;
[connection bar_master]
SET ROLE ALL;
# User's restrictions should be removed through grantor(role).
SHOW GRANTS;
Grants for bar@%
GRANT SELECT ON *.* TO `bar`@`%`
GRANT `r1`@`%` TO `bar`@`%`
# User's actual privileges ( and restrictions) must be visible
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT SELECT ON *.* TO `bar`@`%`
REVOKE SELECT ON `mysql`.* FROM `bar`@`%`
GRANT `r1`@`%` TO `bar`@`%`
include/sync_slave_sql_with_master.inc
[connection slave]
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT SELECT ON *.* TO `bar`@`%`
REVOKE SELECT ON `mysql`.* FROM `bar`@`%`
GRANT `r1`@`%` TO `bar`@`%`
[connection bar_master]
DROP USER bar;
DROP ROLE r1;
#
# 8. Roles negating each other's restrictions
#
# 8.1 Both roles have partial revokes
CREATE ROLE r1, r2;
CREATE USER bar;
GRANT SELECT,INSERT ON *.* TO r1, r2;
REVOKE SELECT ON mysql.* FROM r1;
REVOKE INSERT ON mysql.* FROM r2;
# Grant privileges and roles to user
GRANT DROP ON *.* TO bar;
GRANT UPDATE ON mysql.* TO bar;
GRANT r1, r2 TO bar;
# Roles privileges and restrictions should apply to user
SHOW GRANTS FOR bar USING r1;
Grants for bar@%
GRANT SELECT, INSERT, DROP ON *.* TO `bar`@`%`
GRANT UPDATE ON `mysql`.* TO `bar`@`%`
REVOKE SELECT ON `mysql`.* FROM `bar`@`%`
GRANT `r1`@`%`,`r2`@`%` TO `bar`@`%`
SHOW GRANTS FOR bar USING r2;
Grants for bar@%
GRANT SELECT, INSERT, DROP ON *.* TO `bar`@`%`
GRANT UPDATE ON `mysql`.* TO `bar`@`%`
REVOKE INSERT ON `mysql`.* FROM `bar`@`%`
GRANT `r1`@`%`,`r2`@`%` TO `bar`@`%`
# Roles global privileges should negate each others restrictions
SHOW GRANTS FOR bar USING r1, r2;
Grants for bar@%
GRANT SELECT, INSERT, DROP ON *.* TO `bar`@`%`
GRANT UPDATE ON `mysql`.* TO `bar`@`%`
GRANT `r1`@`%`,`r2`@`%` TO `bar`@`%`
[connection bar_master]
SET ROLE r1, r2;
SHOW GRANTS;
Grants for bar@%
GRANT SELECT, INSERT, DROP ON *.* TO `bar`@`%`
GRANT UPDATE ON `mysql`.* TO `bar`@`%`
GRANT `r1`@`%`,`r2`@`%` TO `bar`@`%`
include/sync_slave_sql_with_master.inc
[connection slave]
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT DROP ON *.* TO `bar`@`%`
GRANT UPDATE ON `mysql`.* TO `bar`@`%`
GRANT `r1`@`%`,`r2`@`%` TO `bar`@`%`
[connection bar_master]
DROP USER bar;
DROP ROLE r1, r2;
# 8.2 One role has partial revoke and another has DB level grant
CREATE USER bar;
CREATE ROLE r1, r2;
GRANT r1, r2 TO bar;
GRANT SELECT ON *.* TO r1;
REVOKE SELECT ON mysql.* FROM r1;
GRANT SELECT ON mysql.* TO r2;
SHOW GRANTS FOR bar USING r1;
Grants for bar@%
GRANT SELECT ON *.* TO `bar`@`%`
REVOKE SELECT ON `mysql`.* FROM `bar`@`%`
GRANT `r1`@`%`,`r2`@`%` TO `bar`@`%`
SHOW GRANTS FOR bar USING r2;
Grants for bar@%
GRANT USAGE ON *.* TO `bar`@`%`
GRANT SELECT ON `mysql`.* TO `bar`@`%`
GRANT `r1`@`%`,`r2`@`%` TO `bar`@`%`
# DB level privilege and partial revoke negate each other
SHOW GRANTS FOR bar USING r1, r2;
Grants for bar@%
GRANT SELECT ON *.* TO `bar`@`%`
GRANT `r1`@`%`,`r2`@`%` TO `bar`@`%`
[connection bar_master]
SET ROLE r1, r2;
SHOW GRANTS;
Grants for bar@%
GRANT SELECT ON *.* TO `bar`@`%`
GRANT `r1`@`%`,`r2`@`%` TO `bar`@`%`
SET ROLE r1;
SHOW GRANTS;
Grants for bar@%
GRANT SELECT ON *.* TO `bar`@`%`
REVOKE SELECT ON `mysql`.* FROM `bar`@`%`
GRANT `r1`@`%`,`r2`@`%` TO `bar`@`%`
SET ROLE r2;
SHOW GRANTS;
Grants for bar@%
GRANT USAGE ON *.* TO `bar`@`%`
GRANT SELECT ON `mysql`.* TO `bar`@`%`
GRANT `r1`@`%`,`r2`@`%` TO `bar`@`%`
SET ROLE r2, r1;
SHOW GRANTS;
Grants for bar@%
GRANT SELECT ON *.* TO `bar`@`%`
GRANT `r1`@`%`,`r2`@`%` TO `bar`@`%`
include/sync_slave_sql_with_master.inc
[connection slave]
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT USAGE ON *.* TO `bar`@`%`
GRANT `r1`@`%`,`r2`@`%` TO `bar`@`%`
[connection bar_master]
DROP USER bar;
DROP ROLE r1, r2;
# 8.3 One role has partial revoke & grants and another has DB grants
CREATE USER bar;
CREATE ROLE r1, r2;
GRANT r1, r2 TO bar;
GRANT SELECT, DROP ON *.* TO r1;
REVOKE SELECT ON mysql.* FROM r1;
GRANT UPDATE ON mysql.* TO r1;
GRANT SELECT, INSERT ON mysql.* TO r2;
SHOW GRANTS FOR bar USING r1;
Grants for bar@%
GRANT SELECT, DROP ON *.* TO `bar`@`%`
GRANT UPDATE ON `mysql`.* TO `bar`@`%`
REVOKE SELECT ON `mysql`.* FROM `bar`@`%`
GRANT `r1`@`%`,`r2`@`%` TO `bar`@`%`
SHOW GRANTS FOR bar USING r2;
Grants for bar@%
GRANT USAGE ON *.* TO `bar`@`%`
GRANT SELECT, INSERT ON `mysql`.* TO `bar`@`%`
GRANT `r1`@`%`,`r2`@`%` TO `bar`@`%`
# DB level privilege and partial revoke negate each other
SHOW GRANTS FOR bar USING r1, r2;
Grants for bar@%
GRANT SELECT, DROP ON *.* TO `bar`@`%`
GRANT INSERT, UPDATE ON `mysql`.* TO `bar`@`%`
GRANT `r1`@`%`,`r2`@`%` TO `bar`@`%`
[connection bar_master]
SET ROLE r1, r2;
SHOW GRANTS;
Grants for bar@%
GRANT SELECT, DROP ON *.* TO `bar`@`%`
GRANT INSERT, UPDATE ON `mysql`.* TO `bar`@`%`
GRANT `r1`@`%`,`r2`@`%` TO `bar`@`%`
include/sync_slave_sql_with_master.inc
[connection slave]
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT USAGE ON *.* TO `bar`@`%`
GRANT `r1`@`%`,`r2`@`%` TO `bar`@`%`
[connection bar_master]
DROP USER bar;
DROP ROLE r1,r2;
#
# 9. SET ROLE removes the restrictions from the user. Now, Global
#    grant/revoke should not carry restrictions to grantee
#
CREATE USER foo, bar;
CREATE ROLE r1;
GRANT SELECT, INSERT ON *.* TO bar WITH GRANT OPTION;
REVOKE INSERT ON mysql.* FROM bar;
GRANT INSERT ON *.* TO r1;
GRANT r1 TO bar;
[connection bar_master]
# User should not have restriction for now
SET ROLE ALL;
SHOW GRANTS;
Grants for bar@%
GRANT SELECT, INSERT ON *.* TO `bar`@`%` WITH GRANT OPTION
GRANT `r1`@`%` TO `bar`@`%`
# Grantee should not carry the actual restrictions of grantor
GRANT INSERT ON *.* TO foo;
SHOW GRANTS FOR foo;
Grants for foo@%
GRANT INSERT ON *.* TO `foo`@`%`
# Grantor should be able to remove the global privileges from grantee now
REVOKE INSERT ON *.* FROM foo;
SHOW GRANTS FOR foo;
Grants for foo@%
GRANT USAGE ON *.* TO `foo`@`%`
# Grantor should be able to grant global privilege to self
GRANT INSERT ON *.* TO bar;
SHOW GRANTS;
Grants for bar@%
GRANT SELECT, INSERT ON *.* TO `bar`@`%` WITH GRANT OPTION
GRANT `r1`@`%` TO `bar`@`%`
[connection default]
# Since, user granted himself global privilege therefore it's
# restrictions has gone permanently now.
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT SELECT, INSERT ON *.* TO `bar`@`%` WITH GRANT OPTION
GRANT `r1`@`%` TO `bar`@`%`
include/sync_slave_sql_with_master.inc
[connection slave]
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT SELECT, INSERT ON *.* TO `bar`@`%` WITH GRANT OPTION
GRANT `r1`@`%` TO `bar`@`%`
[connection bar_master]
DROP USER foo, bar;
DROP ROLE r1;
#
# 10. SET ROLE removes the restrictions from the user. Now, DB level
#     grant/revoke should work as intended.
#
CREATE USER foo, bar;
CREATE ROLE r1;
GRANT SELECT, INSERT ON *.* TO bar WITH GRANT OPTION;
REVOKE INSERT ON mysql.* FROM bar;
GRANT INSERT ON *.* TO r1;
GRANT r1 TO bar;
[connection bar_master]
# User should not have restriction for now
SET ROLE ALL;
SHOW GRANTS;
Grants for bar@%
GRANT SELECT, INSERT ON *.* TO `bar`@`%` WITH GRANT OPTION
GRANT `r1`@`%` TO `bar`@`%`
# Grantor should be able to grant DB level privilege to grantee
GRANT INSERT ON mysql.* TO foo;
SHOW GRANTS FOR foo;
Grants for foo@%
GRANT USAGE ON *.* TO `foo`@`%`
GRANT INSERT ON `mysql`.* TO `foo`@`%`
# Grantor should be able to revoke DB Level priviulege from grantee
REVOKE INSERT ON mysql.* FROM foo;
SHOW GRANTS FOR foo;
Grants for foo@%
GRANT USAGE ON *.* TO `foo`@`%`
# Should be able to grant DB level privilege to self
GRANT INSERT ON mysql.* TO bar;
SHOW GRANTS;
Grants for bar@%
GRANT SELECT, INSERT ON *.* TO `bar`@`%` WITH GRANT OPTION
GRANT `r1`@`%` TO `bar`@`%`
[connection default]
# Since, user granted himself DB level privilege therefore it's
# restrictions has gone permanently now.
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT SELECT, INSERT ON *.* TO `bar`@`%` WITH GRANT OPTION
GRANT `r1`@`%` TO `bar`@`%`
include/sync_slave_sql_with_master.inc
[connection slave]
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT SELECT, INSERT ON *.* TO `bar`@`%` WITH GRANT OPTION
GRANT `r1`@`%` TO `bar`@`%`
[connection bar_master]
DROP USER foo, bar;
DROP ROLE r1;
#
# 11. SET ROLE removes the restrictions from the user. Now, DB level
#     grant/revoke ALL should work as intended.
#
CREATE USER foo, bar;
CREATE ROLE r1;
GRANT SELECT, INSERT ON *.* TO bar WITH GRANT OPTION;
GRANT ALL ON mysql.* TO bar;
REVOKE INSERT ON mysql.* FROM bar;
REVOKE INSERT ON mysql.* FROM bar;
GRANT INSERT ON *.* TO r1;
GRANT r1 TO bar;
[connection bar_master]
# User should not have restriction for now
SET ROLE ALL;
SHOW GRANTS;
Grants for bar@%
GRANT SELECT, INSERT ON *.* TO `bar`@`%` WITH GRANT OPTION
GRANT SELECT, UPDATE, DELETE, CREATE, DROP, REFERENCES, INDEX, ALTER, CREATE TEMPORARY TABLES, LOCK TABLES, EXECUTE, CREATE VIEW, SHOW VIEW, CREATE ROUTINE, ALTER ROUTINE, EVENT, TRIGGER ON `mysql`.* TO `bar`@`%`
GRANT `r1`@`%` TO `bar`@`%`
# Grantor should be able to grant ALL DB level privilege to grantee
GRANT ALL ON mysql.* TO foo;
SHOW GRANTS FOR foo;
Grants for foo@%
GRANT USAGE ON *.* TO `foo`@`%`
GRANT ALL PRIVILEGES ON `mysql`.* TO `foo`@`%`
# Grantor should be able to revoke ALL DB Level privilege from grantee
REVOKE ALL ON mysql.* FROM foo;
SHOW GRANTS FOR foo;
Grants for foo@%
GRANT USAGE ON *.* TO `foo`@`%`
# Should be able to grant ALL DB level privileges to self
GRANT ALL ON mysql.* TO bar;
SHOW GRANTS;
Grants for bar@%
GRANT SELECT, INSERT ON *.* TO `bar`@`%` WITH GRANT OPTION
GRANT SELECT, UPDATE, DELETE, CREATE, DROP, REFERENCES, INDEX, ALTER, CREATE TEMPORARY TABLES, LOCK TABLES, EXECUTE, CREATE VIEW, SHOW VIEW, CREATE ROUTINE, ALTER ROUTINE, EVENT, TRIGGER ON `mysql`.* TO `bar`@`%`
GRANT `r1`@`%` TO `bar`@`%`
[connection default]
# Since, user granted himself all DB level privileges therefore it's
# restrictions has gone permanently now.
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT SELECT, INSERT ON *.* TO `bar`@`%` WITH GRANT OPTION
GRANT SELECT, UPDATE, DELETE, CREATE, DROP, REFERENCES, INDEX, ALTER, CREATE TEMPORARY TABLES, LOCK TABLES, EXECUTE, CREATE VIEW, SHOW VIEW, CREATE ROUTINE, ALTER ROUTINE, EVENT, TRIGGER ON `mysql`.* TO `bar`@`%`
GRANT `r1`@`%` TO `bar`@`%`
include/sync_slave_sql_with_master.inc
[connection slave]
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT SELECT, INSERT ON *.* TO `bar`@`%` WITH GRANT OPTION
GRANT SELECT, UPDATE, DELETE, CREATE, DROP, REFERENCES, INDEX, ALTER, CREATE TEMPORARY TABLES, LOCK TABLES, EXECUTE, CREATE VIEW, SHOW VIEW, CREATE ROUTINE, ALTER ROUTINE, EVENT, TRIGGER ON `mysql`.* TO `bar`@`%`
GRANT `r1`@`%` TO `bar`@`%`
[connection bar_master]
DROP USER foo, bar;
DROP ROLE r1;
#
# 12. SET ROLE removes the restrictions from the user. Now, global
#     grant/revoke ALL should work as intended.
#
CREATE USER foo, bar;
CREATE ROLE r1;
GRANT ALL ON *.* TO bar WITH GRANT OPTION;
REVOKE INSERT ON mysql.* FROM bar;
GRANT INSERT ON *.* TO r1;
GRANT r1 TO bar;
[connection bar_master]
# User should not have restriction for now
SET ROLE ALL;
SHOW GRANTS;
Grants for bar@%
GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, RELOAD, SHUTDOWN, PROCESS, FILE, REFERENCES, INDEX, ALTER, SHOW DATABASES, SUPER, CREATE TEMPORARY TABLES, LOCK TABLES, EXECUTE, REPLICATION SLAVE, REPLICATION CLIENT, CREATE VIEW, SHOW VIEW, CREATE ROUTINE, ALTER ROUTINE, CREATE USER, EVENT, TRIGGER, CREATE TABLESPACE, CREATE ROLE, DROP ROLE ON *.* TO `bar`@`%` WITH GRANT OPTION
GRANT APPLICATION_PASSWORD_ADMIN,AUDIT_ADMIN,BACKUP_ADMIN,BINLOG_ADMIN,BINLOG_ENCRYPTION_ADMIN,CLONE_ADMIN,CONNECTION_ADMIN,ENCRYPTION_KEY_ADMIN,GROUP_REPLICATION_ADMIN,INNODB_REDO_LOG_ARCHIVE,PERSIST_RO_VARIABLES_ADMIN,REPLICATION_APPLIER,REPLICATION_SLAVE_ADMIN,RESOURCE_GROUP_ADMIN,RESOURCE_GROUP_USER,ROLE_ADMIN,SERVICE_CONNECTION_ADMIN,SESSION_VARIABLES_ADMIN,SET_USER_ID,SYSTEM_USER,SYSTEM_VARIABLES_ADMIN,TABLE_ENCRYPTION_ADMIN,XA_RECOVER_ADMIN ON *.* TO `bar`@`%` WITH GRANT OPTION
GRANT `r1`@`%` TO `bar`@`%`
# Grantor should be able to grant ALL global level privilege to grantee
GRANT ALL ON *.* TO foo;
SHOW GRANTS FOR foo;
Grants for foo@%
GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, RELOAD, SHUTDOWN, PROCESS, FILE, REFERENCES, INDEX, ALTER, SHOW DATABASES, SUPER, CREATE TEMPORARY TABLES, LOCK TABLES, EXECUTE, REPLICATION SLAVE, REPLICATION CLIENT, CREATE VIEW, SHOW VIEW, CREATE ROUTINE, ALTER ROUTINE, CREATE USER, EVENT, TRIGGER, CREATE TABLESPACE, CREATE ROLE, DROP ROLE ON *.* TO `foo`@`%`
GRANT APPLICATION_PASSWORD_ADMIN,AUDIT_ADMIN,BACKUP_ADMIN,BINLOG_ADMIN,BINLOG_ENCRYPTION_ADMIN,CLONE_ADMIN,CONNECTION_ADMIN,ENCRYPTION_KEY_ADMIN,GROUP_REPLICATION_ADMIN,INNODB_REDO_LOG_ARCHIVE,PERSIST_RO_VARIABLES_ADMIN,REPLICATION_APPLIER,REPLICATION_SLAVE_ADMIN,RESOURCE_GROUP_ADMIN,RESOURCE_GROUP_USER,ROLE_ADMIN,SERVICE_CONNECTION_ADMIN,SESSION_VARIABLES_ADMIN,SET_USER_ID,SYSTEM_USER,SYSTEM_VARIABLES_ADMIN,TABLE_ENCRYPTION_ADMIN,XA_RECOVER_ADMIN ON *.* TO `foo`@`%`
# Grantor should be able to revoke ALL global level privilege from
# grantee
REVOKE ALL ON *.* FROM foo;
SHOW GRANTS FOR foo;
Grants for foo@%
GRANT USAGE ON *.* TO `foo`@`%`
# Should be able to grant ALL DB level privileges to self
GRANT ALL ON *.* TO bar;
SHOW GRANTS;
Grants for bar@%
GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, RELOAD, SHUTDOWN, PROCESS, FILE, REFERENCES, INDEX, ALTER, SHOW DATABASES, SUPER, CREATE TEMPORARY TABLES, LOCK TABLES, EXECUTE, REPLICATION SLAVE, REPLICATION CLIENT, CREATE VIEW, SHOW VIEW, CREATE ROUTINE, ALTER ROUTINE, CREATE USER, EVENT, TRIGGER, CREATE TABLESPACE, CREATE ROLE, DROP ROLE ON *.* TO `bar`@`%` WITH GRANT OPTION
GRANT APPLICATION_PASSWORD_ADMIN,AUDIT_ADMIN,BACKUP_ADMIN,BINLOG_ADMIN,BINLOG_ENCRYPTION_ADMIN,CLONE_ADMIN,CONNECTION_ADMIN,ENCRYPTION_KEY_ADMIN,GROUP_REPLICATION_ADMIN,INNODB_REDO_LOG_ARCHIVE,PERSIST_RO_VARIABLES_ADMIN,REPLICATION_APPLIER,REPLICATION_SLAVE_ADMIN,RESOURCE_GROUP_ADMIN,RESOURCE_GROUP_USER,ROLE_ADMIN,SERVICE_CONNECTION_ADMIN,SESSION_VARIABLES_ADMIN,SET_USER_ID,SYSTEM_USER,SYSTEM_VARIABLES_ADMIN,TABLE_ENCRYPTION_ADMIN,XA_RECOVER_ADMIN ON *.* TO `bar`@`%` WITH GRANT OPTION
GRANT `r1`@`%` TO `bar`@`%`
[connection default]
# Since, user granted himself all DB level privileges therefore it's
# restrictions has gone permanently now.
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, RELOAD, SHUTDOWN, PROCESS, FILE, REFERENCES, INDEX, ALTER, SHOW DATABASES, SUPER, CREATE TEMPORARY TABLES, LOCK TABLES, EXECUTE, REPLICATION SLAVE, REPLICATION CLIENT, CREATE VIEW, SHOW VIEW, CREATE ROUTINE, ALTER ROUTINE, CREATE USER, EVENT, TRIGGER, CREATE TABLESPACE, CREATE ROLE, DROP ROLE ON *.* TO `bar`@`%` WITH GRANT OPTION
GRANT APPLICATION_PASSWORD_ADMIN,AUDIT_ADMIN,BACKUP_ADMIN,BINLOG_ADMIN,BINLOG_ENCRYPTION_ADMIN,CLONE_ADMIN,CONNECTION_ADMIN,ENCRYPTION_KEY_ADMIN,GROUP_REPLICATION_ADMIN,INNODB_REDO_LOG_ARCHIVE,PERSIST_RO_VARIABLES_ADMIN,REPLICATION_APPLIER,REPLICATION_SLAVE_ADMIN,RESOURCE_GROUP_ADMIN,RESOURCE_GROUP_USER,ROLE_ADMIN,SERVICE_CONNECTION_ADMIN,SESSION_VARIABLES_ADMIN,SET_USER_ID,SYSTEM_USER,SYSTEM_VARIABLES_ADMIN,TABLE_ENCRYPTION_ADMIN,XA_RECOVER_ADMIN ON *.* TO `bar`@`%` WITH GRANT OPTION
GRANT `r1`@`%` TO `bar`@`%`
include/sync_slave_sql_with_master.inc
[connection slave]
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, RELOAD, SHUTDOWN, PROCESS, FILE, REFERENCES, INDEX, ALTER, SHOW DATABASES, SUPER, CREATE TEMPORARY TABLES, LOCK TABLES, EXECUTE, REPLICATION SLAVE, REPLICATION CLIENT, CREATE VIEW, SHOW VIEW, CREATE ROUTINE, ALTER ROUTINE, CREATE USER, EVENT, TRIGGER, CREATE TABLESPACE, CREATE ROLE, DROP ROLE ON *.* TO `bar`@`%` WITH GRANT OPTION
GRANT APPLICATION_PASSWORD_ADMIN,AUDIT_ADMIN,BACKUP_ADMIN,BINLOG_ADMIN,BINLOG_ENCRYPTION_ADMIN,CLONE_ADMIN,CONNECTION_ADMIN,ENCRYPTION_KEY_ADMIN,GROUP_REPLICATION_ADMIN,INNODB_REDO_LOG_ARCHIVE,PERSIST_RO_VARIABLES_ADMIN,REPLICATION_APPLIER,REPLICATION_SLAVE_ADMIN,RESOURCE_GROUP_ADMIN,RESOURCE_GROUP_USER,ROLE_ADMIN,SERVICE_CONNECTION_ADMIN,SESSION_VARIABLES_ADMIN,SET_USER_ID,SYSTEM_USER,SYSTEM_VARIABLES_ADMIN,TABLE_ENCRYPTION_ADMIN,XA_RECOVER_ADMIN ON *.* TO `bar`@`%` WITH GRANT OPTION
GRANT `r1`@`%` TO `bar`@`%`
[connection bar_master]
DROP USER foo, bar;
DROP ROLE r1;
---------------------Tests related to roles end here---------------------
-------------------------------------------------------------------------
Invalid restrictions and privilege combinations
-------------------------------------------------------------------------
CREATE USER foo, bar;
#
# 1. Add INSERT partial revoke on mysql DB for user bar
#
GRANT SELECT, INSERT ON *.* TO bar;
REVOKE SELECT, INSERT ON mysql.* FROM bar;
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT SELECT, INSERT ON *.* TO `bar`@`%`
REVOKE SELECT, INSERT ON `mysql`.* FROM `bar`@`%`
INSERT INTO mysql.db(user,host, db, Insert_priv) VALUES('bar', '%', 'mysql', 'Y');
FLUSH PRIVILEGES;
SHOW GRANTS FOR bar;
Grants for bar@%
GRANT SELECT, INSERT ON *.* TO `bar`@`%`
GRANT INSERT ON `mysql`.* TO `bar`@`%`
REVOKE SELECT, INSERT ON `mysql`.* FROM `bar`@`%`
GRANT INSERT ON *.* TO bar;
ERROR HY000: 'INSERT' privilege for database 'mysql' exists both as partial revoke and mysql.db simultaneously. It could mean that the 'mysql' schema is corrupted.
REVOKE INSERT ON *.* FROM bar;
ERROR HY000: 'INSERT' privilege for database 'mysql' exists both as partial revoke and mysql.db simultaneously. It could mean that the 'mysql' schema is corrupted.
GRANT INSERT ON mysql.* TO bar;
ERROR HY000: 'INSERT' privilege for database 'mysql' exists both as partial revoke and mysql.db simultaneously. It could mean that the 'mysql' schema is corrupted.
REVOKE INSERT ON mysql.* FROM bar;
ERROR HY000: 'INSERT' privilege for database 'mysql' exists both as partial revoke and mysql.db simultaneously. It could mean that the 'mysql' schema is corrupted.
# We should not even able to grant/revoke fresh privileges.
GRANT UPDATE ON mysql.* TO bar;
ERROR HY000: 'INSERT' privilege for database 'mysql' exists both as partial revoke and mysql.db simultaneously. It could mean that the 'mysql' schema is corrupted.
REVOKE UPDATE ON mysql.* FROM bar;
ERROR HY000: 'INSERT' privilege for database 'mysql' exists both as partial revoke and mysql.db simultaneously. It could mean that the 'mysql' schema is corrupted.
GRANT UPDATE ON *.* TO bar;
ERROR HY000: 'INSERT' privilege for database 'mysql' exists both as partial revoke and mysql.db simultaneously. It could mean that the 'mysql' schema is corrupted.
REVOKE UPDATE ON *.* FROM bar;
ERROR HY000: 'INSERT' privilege for database 'mysql' exists both as partial revoke and mysql.db simultaneously. It could mean that the 'mysql' schema is corrupted.
SELECT CURRENT_USER();
CURRENT_USER()
bar@%
SELECT COUNT(*) FROM pr_db.t1;
COUNT(*)
4
DROP USER foo,bar;
#
# 2. Add privilege other than DB_ACLs in user attributes column.
#
CREATE USER u1;
CREATE DATABASE db1;
GRANT SELECT, INSERT ON *.* TO u1;
REVOKE SELECT, INSERT ON db1.* FROM u1;
UPDATE mysql.user SET user_attributes='{"Restrictions": [{"Database": "db1", "Privileges": ["SELECT", "INSERT", "SUPER", "DELETE"]}]}' WHERE user = 'u1';
# Search for : ignored restrictions for privilege(s) 'SUPER' for database 'db1' as these are not valid database privileges
Pattern "ignored restrictions for privilege(s) 'SUPER' for database 'db1' as these are not valid database privileges" not found
# Search completed.
# Search for : ignored restrictions for privilege(s) 'DELETE' for database 'db1' as corresponding global privilege(s) are not granted
Pattern "ignored restrictions for privilege(s) 'DELETE' for database 'db1' as corresponding global privilege(s) are not granted" not found
# Search completed.
DROP DATABASE db1;
DROP USER u1;
-Tests related to invalid restrictions & privilege combinations end here-

-------------------------------------------------------------------------
Partial revokes do not treat wildcard grants specially.
-------------------------------------------------------------------------
CREATE USER foo;
CREATE DATABASE `db_1`;
CREATE DATABASE `db%1`;
GRANT SELECT ON *.* TO foo;
# Create restriction - We dont use '\' to escape '_' or '%'
REVOKE SELECT ON `db_1`.* FROM foo;
REVOKE SELECT ON `db%1`.* FROM foo;
# Should show 2 restrictions
SHOW GRANTS FOR foo;
Grants for foo@%
GRANT SELECT ON *.* TO `foo`@`%`
REVOKE SELECT ON `db%1`.* FROM `foo`@`%`
REVOKE SELECT ON `db_1`.* FROM `foo`@`%`
# Should not remove restrictions on db_1 or db%1,
# instead both grants should be added on db(s) as it is.
GRANT SELECT ON `db\_1`.* TO foo;
GRANT SELECT ON `db\%1`.* TO foo;
SHOW GRANTS FOR foo;
Grants for foo@%
GRANT SELECT ON *.* TO `foo`@`%`
GRANT SELECT ON `db\%1`.* TO `foo`@`%`
GRANT SELECT ON `db\_1`.* TO `foo`@`%`
REVOKE SELECT ON `db%1`.* FROM `foo`@`%`
REVOKE SELECT ON `db_1`.* FROM `foo`@`%`
# Should remove two grants added above
REVOKE SELECT ON `db\_1`.* FROM foo;
REVOKE SELECT ON `db\%1`.* FROM foo;
# Should show 2 restrictions
SHOW GRANTS FOR foo;
Grants for foo@%
GRANT SELECT ON *.* TO `foo`@`%`
REVOKE SELECT ON `db%1`.* FROM `foo`@`%`
REVOKE SELECT ON `db_1`.* FROM `foo`@`%`
REVOKE SELECT ON *.* FROM foo;
DROP USER foo;
DROP DATABASE `db_1`;
DROP DATABASE `db%1`;
-------------------------------------------------------------------------
Test related to wildcard grants end here.
-------------------------------------------------------------------------
DROP DATABASE pr_db;
DROP DATABASE normal_db;
call mtr.add_suppression(".*Nothing to revoke. Global privilege.*");
include/rpl_end.inc