List:Commits« Previous MessageNext Message »
From:Konstantin Osipov Date:March 22 2009 11:49am
Subject:Re: bzr commit into mysql-6.0 branch (alik:2745) Bug#38347
View as plain text  
Hello,

* Alexander Nozdrin <alik@stripped> [09/03/13 11:11]:
>  2745 Alexander Nozdrin	2009-03-13
>       Patch for Bug#38347: ALTER ROUTINE privilege allows SHOW CREATE TABLE.

I appreciate the fact that you added a pretty extensive test
coverage. Thank you.
> +# -- 
> +# -- Check that SUPER allows SHOW CREATE TABLE.
> +# -- 
> +# -- Grant EVENT just to be able to connect to the server. As it was
> +# -- checked above, EVENT itself does not allow SHOW CREATE TABLE.
> +# -- 
> +
> +GRANT SUPER ON *.* TO mysqltest_u1@localhost;
> +GRANT EVENT ON mysqltest_db1.* TO mysqltest_u1@localhost;

The manual says that SUPER is sufficient to connect to the
database.
What am I missing? 

> +REVOKE ALL PRIVILEGES, GRANT OPTION FROM mysqltest_u1@localhost;
> +SHOW GRANTS FOR mysqltest_u1@localhost;
> +Grants for mysqltest_u1@localhost
> +GRANT USAGE ON *.* TO 'mysqltest_u1'@'localhost'

You could use DROP USER instead of REVOKE, that would
also remove the entry from user table, so there wouldn't be even
USAGE privilege. I, however, have no opinion wihch is better :)

> === modified file 'sql/sql_parse.cc'
> --- a/sql/sql_parse.cc	2009-03-06 22:17:00 +0000
> +++ b/sql/sql_parse.cc	2009-03-13 07:53:19 +0000
> @@ -2898,18 +2898,31 @@ ddl_blocker_err:
>        else
>        {
>          ulong save_priv;
> -        if (check_access(thd, SELECT_ACL, first_table->db,
> +        ulong table_privs= SELECT_ACL | INSERT_ACL | UPDATE_ACL | DELETE_ACL |
> +                           CREATE_ACL | DROP_ACL | ALTER_ACL | INDEX_ACL |
> +                           TRIGGER_ACL | REFERENCES_ACL;
> +
> +        if (check_access(thd, table_privs, first_table->db,
>                           &save_priv, FALSE, FALSE,
>                           test(first_table->schema_table)))


Did you discuss with PeterG why other elements of TABLE_ACLS
(GRANT, TRIGGER) should not be allowed? 

This branch is also used for views. Does it mean you introduced
a regression that SHOW VIEW ACL no longer allows to do SHOW CREATE
TABLE view_v1?

Privilege checks are done before we open a table. Views and tables
share the same namespace. I wonder if we can at all implement such
behaviour that SHOW CREATE VIEW doesn't allow SHOW CREATE TABLE --
some hacks will be necessary.

In any case, please move the list of privileges above to a define
- SHOW_TABLE_ACLS.

-- 
Thread
bzr commit into mysql-6.0 branch (alik:2745) Bug#38347Alexander Nozdrin13 Mar
  • Re: bzr commit into mysql-6.0 branch (alik:2745) Bug#38347Konstantin Osipov22 Mar