2020-02-28 21:59:01 +04:00
|
|
|
-- source include/not_embedded.inc
|
|
|
|
|
|
|
|
--echo #
|
|
|
|
--echo # Start of 10.5 tests
|
|
|
|
--echo #
|
|
|
|
|
|
|
|
--echo #
|
|
|
|
--echo # MDEV-21743 Split up SUPER privilege to smaller privileges
|
|
|
|
--echo #
|
2022-09-16 17:55:42 +07:00
|
|
|
--disable_service_connection
|
2020-02-28 21:59:01 +04:00
|
|
|
|
2020-03-13 18:24:43 +01:00
|
|
|
--let $count_sessions=1
|
|
|
|
|
2020-02-28 21:59:01 +04:00
|
|
|
--echo #
|
MDEV-29668 SUPER should not allow actions that have fine-grained dedicated privileges
SUPER privilege used to allow various actions that were alternatively
allowed by one of BINLOG ADMIN, BINLOG MONITOR, BINLOG REPLAY,
CONNECTION ADMIN, FEDERATED ADMIN, REPL MASTER ADMIN, REPL SLAVE ADMIN,
SET USER, SLAVE MONITOR.
Now SUPER no longer does that, one has to grant one of the fine-grained
privileges above to be to perform corresponding actions.
On upgrade from MariaDB versions 10.11 and below all the privileges
above are granted automatically if the user has SUPER.
As a side-effect, such an upgrade will allow SUPER-user to run SHOW
BINLOG EVENTS, SHOW RELAYLOG EVENTS, SHOW SLAVE HOSTS, even if he wasn't
able to do it before the upgrade.
2022-12-10 12:08:31 +01:00
|
|
|
--echo # Test that KILL is not allowed without CONNECTION ADMIN
|
2020-02-28 21:59:01 +04:00
|
|
|
--echo #
|
|
|
|
|
|
|
|
CREATE USER foo@localhost;
|
|
|
|
GRANT SELECT ON *.* TO foo@localhost;
|
|
|
|
CREATE USER bar@localhost;
|
|
|
|
GRANT ALL PRIVILEGES ON *.* TO bar@localhost;
|
MDEV-29668 SUPER should not allow actions that have fine-grained dedicated privileges
SUPER privilege used to allow various actions that were alternatively
allowed by one of BINLOG ADMIN, BINLOG MONITOR, BINLOG REPLAY,
CONNECTION ADMIN, FEDERATED ADMIN, REPL MASTER ADMIN, REPL SLAVE ADMIN,
SET USER, SLAVE MONITOR.
Now SUPER no longer does that, one has to grant one of the fine-grained
privileges above to be to perform corresponding actions.
On upgrade from MariaDB versions 10.11 and below all the privileges
above are granted automatically if the user has SUPER.
As a side-effect, such an upgrade will allow SUPER-user to run SHOW
BINLOG EVENTS, SHOW RELAYLOG EVENTS, SHOW SLAVE HOSTS, even if he wasn't
able to do it before the upgrade.
2022-12-10 12:08:31 +01:00
|
|
|
REVOKE CONNECTION ADMIN ON *.* FROM bar@localhost;
|
2020-02-28 21:59:01 +04:00
|
|
|
--connect (foo,localhost,foo,,)
|
|
|
|
let $id=`(SELECT id FROM INFORMATION_SCHEMA.PROCESSLIST WHERE user='foo')`;
|
|
|
|
--connect (bar,localhost,bar,,)
|
|
|
|
SELECT user FROM information_schema.processlist ORDER BY user;
|
|
|
|
--replace_result $id ID
|
|
|
|
--error ER_KILL_DENIED_ERROR
|
|
|
|
--eval KILL $id
|
|
|
|
--disconnect foo
|
|
|
|
--disconnect bar
|
|
|
|
--connection default
|
2020-03-13 18:24:43 +01:00
|
|
|
--source include/wait_until_count_sessions.inc
|
2020-02-28 21:59:01 +04:00
|
|
|
DROP USER foo@localhost;
|
|
|
|
DROP USER bar@localhost;
|
|
|
|
|
|
|
|
--echo #
|
|
|
|
--echo # Test that KILL is allowed with CONNECTION ADMIN
|
|
|
|
--echo #
|
|
|
|
|
|
|
|
CREATE USER foo@localhost;
|
|
|
|
GRANT SELECT ON *.* TO foo@localhost;
|
|
|
|
CREATE USER bar@localhost;
|
|
|
|
GRANT PROCESS, CONNECTION ADMIN ON *.* TO bar@localhost;
|
|
|
|
--connect (foo,localhost,foo,,)
|
|
|
|
let $id=`(SELECT id FROM INFORMATION_SCHEMA.PROCESSLIST WHERE user='foo')`;
|
|
|
|
--connect (bar,localhost,bar,,)
|
|
|
|
SELECT user FROM information_schema.processlist ORDER BY user;
|
|
|
|
--replace_result $id ID
|
|
|
|
--eval KILL $id
|
|
|
|
--connection default
|
|
|
|
let $wait_condition=
|
|
|
|
select count(*) = 0 from information_schema.processlist
|
|
|
|
where user = "foo";
|
|
|
|
--source include/wait_condition.inc
|
|
|
|
--disconnect foo
|
|
|
|
--disconnect bar
|
2020-03-13 18:24:43 +01:00
|
|
|
--source include/wait_until_count_sessions.inc
|
2020-02-28 21:59:01 +04:00
|
|
|
DROP USER foo@localhost;
|
|
|
|
DROP USER bar@localhost;
|
|
|
|
|
2022-09-16 17:55:42 +07:00
|
|
|
--enable_service_connection
|
|
|
|
|
2020-02-28 21:59:01 +04:00
|
|
|
--echo #
|
|
|
|
--echo # End of 10.5 tests
|
|
|
|
--echo #
|