mariadb/mysql-test/suite/sys_vars/t/connect_timeout_grant.test
Sergei Golubchik d6e3d89c80 MDEV-29668 SUPER should not allow actions that have fine-grained dedicated privileges
SUPER privilege used to allow various actions that were alternatively
allowed by one of BINLOG ADMIN, BINLOG MONITOR, BINLOG REPLAY,
CONNECTION ADMIN, FEDERATED ADMIN, REPL MASTER ADMIN, REPL SLAVE ADMIN,
SET USER, SLAVE MONITOR.

Now SUPER no longer does that, one has to grant one of the fine-grained
privileges above to be to perform corresponding actions.

On upgrade from MariaDB versions 10.11 and below all the privileges
above are granted automatically if the user has SUPER.

As a side-effect, such an upgrade will allow SUPER-user to run SHOW
BINLOG EVENTS, SHOW RELAYLOG EVENTS, SHOW SLAVE HOSTS, even if he wasn't
able to do it before the upgrade.
2023-02-06 14:31:48 +01:00

41 lines
1.1 KiB
Text

--source include/not_embedded.inc
SET @global=@@global.connect_timeout;
--echo #
--echo # MDEV-21961 Bind CONNECTION ADMIN to a number of global system variables
--echo #
--echo # Test that "SET connect_timeout" is not allowed without CONNECTION ADMIN
CREATE USER user1@localhost;
GRANT ALL PRIVILEGES ON *.* TO user1@localhost;
REVOKE CONNECTION ADMIN ON *.* FROM user1@localhost;
--connect(user1,localhost,user1,,)
--connection user1
--error ER_SPECIFIC_ACCESS_DENIED_ERROR
SET GLOBAL connect_timeout=10;
--error ER_GLOBAL_VARIABLE
SET connect_timeout=10;
--error ER_GLOBAL_VARIABLE
SET SESSION connect_timeout=10;
--disconnect user1
--connection default
DROP USER user1@localhost;
--echo # Test that "SET connect_timeout" is allowed with CONNECTION ADMIN
CREATE USER user1@localhost;
GRANT CONNECTION ADMIN ON *.* TO user1@localhost;
--connect(user1,localhost,user1,,)
--connection user1
SET GLOBAL connect_timeout=10;
--error ER_GLOBAL_VARIABLE
SET connect_timeout=10;
--error ER_GLOBAL_VARIABLE
SET SESSION connect_timeout=10;
--disconnect user1
--connection default
DROP USER user1@localhost;
SET @@global.connect_timeout=@global;