mirror of
https://github.com/MariaDB/server.git
synced 2025-01-16 20:12:31 +01:00
8bbe3a3cd2
mariadb-install-db --auth-root-authentication-method=normal created 4
root accounts by default, but only two of these had PROXY privilege
granted.
mariadb-install-db (default option
--auth-root-authentication-method=socket) as non-root user also didn't
grant PROXY priv to the created nonroot@localhost user.
To fix this, in mysql_system_tables_data.sql, we re-use tmp_user_nopasswd
as this contains the list of all root users.
REPLACE INTO tmp_proxies_priv SELECT @current_hostname, IFNULL(@auth_root_socket, 'root')
creates the $user@$current_host but will not error if @auth_root_socket
is null. Note @current_hostname lines are filtered out with
--cross-bootstrap in mariadb-install-db so it was needed to include this
expression for consistency.
Like the existing mysql_system_tables.sql is used to create teh
$user@localhost proxies_priv.
Test cases roles.acl_statistics, perfschema,privilege_table_io depends on the number of proxy users.
After:
--auth-root-authentication-method=normal:
MariaDB [mysql]> select * from global_priv;
+-----------+-------------+--------------------------------------------------------------------------------------------------------------------------+
| Host | User | Priv |
+-----------+-------------+--------------------------------------------------------------------------------------------------------------------------+
| localhost | mariadb.sys | {"access":0,"plugin":"mysql_native_password","authentication_string":"","account_locked":true,"password_last_changed":0} |
| localhost | root | {"access":18446744073709551615} |
| bark | root | {"access":18446744073709551615} |
| 127.0.0.1 | root | {"access":18446744073709551615} |
| ::1 | root | {"access":18446744073709551615} |
| localhost | | {} |
| bark | | {} |
+-----------+-------------+--------------------------------------------------------------------------------------------------------------------------+
7 rows in set (0.001 sec)
MariaDB [mysql]> select * from proxies_priv;
+-----------+------+--------------+--------------+------------+---------+---------------------+
| Host | User | Proxied_host | Proxied_user | With_grant | Grantor | Timestamp |
+-----------+------+--------------+--------------+------------+---------+---------------------+
| localhost | root | | | 1 | | 2023-07-10 12:12:24 |
| 127.0.0.1 | root | | | 1 | | 2023-07-10 12:12:24 |
| ::1 | root | | | 1 | | 2023-07-10 12:12:24 |
| bark | root | | | 1 | | 2023-07-10 12:12:24 |
+-----------+------+--------------+--------------+------------+---------+---------------------+
--auth-root-authentication-method=socket:
MariaDB [mysql]> select * from proxies_priv;
+-----------+------+--------------+--------------+------------+---------+---------------------+
| Host | User | Proxied_host | Proxied_user | With_grant | Grantor | Timestamp |
+-----------+------+--------------+--------------+------------+---------+---------------------+
| localhost | root | | | 1 | | 2023-07-10 12:11:55 |
| localhost | dan | | | 1 | | 2023-07-10 12:11:55 |
| bark | dan | | | 1 | | 2023-07-10 12:11:55 |
+-----------+------+--------------+--------------+------------+---------+---------------------+
3 rows in set (0.017 sec)
MariaDB [mysql]> select * from global_priv;
+-----------+-------------+--------------------------------------------------------------------------------------------------------------------------------------------+
| Host | User | Priv |
+-----------+-------------+--------------------------------------------------------------------------------------------------------------------------------------------+
| localhost | mariadb.sys | {"access":0,"plugin":"mysql_native_password","authentication_string":"","account_locked":true,"password_last_changed":0} |
| localhost | root | {"access":18446744073709551615,"plugin":"mysql_native_password","authentication_string":"invalid","auth_or":[{},{"plugin":"unix_socket"}]} |
| localhost | dan | {"access":18446744073709551615,"plugin":"mysql_native_password","authentication_string":"invalid","auth_or":[{},{"plugin":"unix_socket"}]} |
| localhost | | {} |
| bark | | {} |
+-----------+-------------+--------------------------------------------------------------------------------------------------------------------------------------------+
5 rows in set (0.000 sec)
MariaDB [mysql]> show grants;
+----------------------------------------------------------------------------------------------------------------------------------------+
| Grants for dan@localhost |
+----------------------------------------------------------------------------------------------------------------------------------------+
| GRANT ALL PRIVILEGES ON *.* TO `dan`@`localhost` IDENTIFIED VIA mysql_native_password USING 'invalid' OR unix_socket WITH GRANT OPTION |
| GRANT PROXY ON ''@'%' TO 'dan'@'localhost' WITH GRANT OPTION |
+----------------------------------------------------------------------------------------------------------------------------------------+
|
||
|---|---|---|
| .. | ||
| acl_load_mutex-5170.result | ||
| acl_load_mutex-5170.test | ||
| acl_statistics.opt | ||
| acl_statistics.result | ||
| acl_statistics.test | ||
| admin.result | ||
| admin.test | ||
| create_and_drop_current.result | ||
| create_and_drop_current.test | ||
| create_and_drop_role.result | ||
| create_and_drop_role.test | ||
| create_and_drop_role_invalid_user_table.result | ||
| create_and_drop_role_invalid_user_table.test | ||
| create_and_grant_role.result | ||
| create_and_grant_role.test | ||
| current_role_view-12666.result | ||
| current_role_view-12666.test | ||
| default_create_user_not_role.result | ||
| default_create_user_not_role.test | ||
| definer.result | ||
| definer.test | ||
| drop_current_role.result | ||
| drop_current_role.test | ||
| drop_current_user-5176.result | ||
| drop_current_user-5176.test | ||
| drop_routines.result | ||
| drop_routines.test | ||
| flush_roles-12366.result | ||
| flush_roles-12366.test | ||
| flush_roles-17898.result | ||
| flush_roles-17898.test | ||
| grant-5771.result | ||
| grant-5771.test | ||
| grant_empty.result | ||
| grant_empty.test | ||
| grant_proxy-5526.result | ||
| grant_proxy-5526.test | ||
| grant_revoke_current.result | ||
| grant_revoke_current.test | ||
| grant_role_auto_create_user.result | ||
| grant_role_auto_create_user.test | ||
| i_s_applicable_roles_is_default.result | ||
| i_s_applicable_roles_is_default.test | ||
| ip-6401.result | ||
| ip-6401.test | ||
| none_public.result | ||
| none_public.test | ||
| password.result | ||
| password.test | ||
| prepare_stmt_with_role.result | ||
| prepare_stmt_with_role.test | ||
| ps.result | ||
| ps.test | ||
| rebuild_role_grants.result | ||
| rebuild_role_grants.test | ||
| recursive.inc | ||
| recursive.result | ||
| recursive.test | ||
| recursive_dbug.result | ||
| recursive_dbug.test | ||
| rename_user.result | ||
| rename_user.test | ||
| revoke_all.result | ||
| revoke_all.test | ||
| role_case_sensitive-10744.result | ||
| role_case_sensitive-10744.test | ||
| role_grant_propagate.result | ||
| role_grant_propagate.test | ||
| roles_tables_priv-29465.result | ||
| roles_tables_priv-29465.test | ||
| rpl_definer.result | ||
| rpl_definer.test | ||
| rpl_grant_revoke_current_role-8638.result | ||
| rpl_grant_revoke_current_role-8638.test | ||
| set_and_drop.result | ||
| set_and_drop.test | ||
| set_default_role_clear.result | ||
| set_default_role_clear.test | ||
| set_default_role_for.result | ||
| set_default_role_for.test | ||
| set_default_role_invalid.result | ||
| set_default_role_invalid.test | ||
| set_default_role_new_connection.result | ||
| set_default_role_new_connection.test | ||
| set_default_role_ps-6960.result | ||
| set_default_role_ps-6960.test | ||
| set_role-5232.result | ||
| set_role-5232.test | ||
| set_role-9614.result | ||
| set_role-9614.test | ||
| set_role-13655.result | ||
| set_role-13655.test | ||
| set_role-database-recursive.result | ||
| set_role-database-recursive.test | ||
| set_role-database-simple.result | ||
| set_role-database-simple.test | ||
| set_role-multiple-role.result | ||
| set_role-multiple-role.test | ||
| set_role-recursive.result | ||
| set_role-recursive.test | ||
| set_role-routine-simple.result | ||
| set_role-routine-simple.test | ||
| set_role-simple.result | ||
| set_role-simple.test | ||
| set_role-table-column-priv.result | ||
| set_role-table-column-priv.test | ||
| set_role-table-simple.result | ||
| set_role-table-simple.test | ||
| show_create_database-10463.result | ||
| show_create_database-10463.test | ||
| show_grants.result | ||
| show_grants.test | ||
| show_grants_replicated.result | ||
| show_grants_replicated.test | ||