mariadb/mysql-test/suite/binlog/t/binlog_grant.test
Bill Qu cdb8e6ed38 Bug #15868071 USING SET GLOBAL SQL_LOG_BIN SHOULD NOT BE ALLOWED
Normally, SET SESSION SQL_LOG_BIN is used by DBAs to run a
non-conflicting command locally only, ensuring it does not
get replicated.
Setting GLOBAL SQL_LOG_BIN would not require all sessions to
disconnect. When SQL_LOG_BIN is changed globally, it does not
immediately take effect for any sessions. It takes effect by
becoming the session-level default inherited at the start of
each new session, and this setting is kept and cached for the
duration of that session. Setting it intentionally is unlikely
to have a useful effect under any circumstance; setting it
unintentionally, such as while intending to use SET [SESSION]
is potentially disastrous. Accidentally using SET GLOBAL
SQL_LOG_BIN will not show an immediate effect to the user,
instead not having the desired session-level effect, and thus
causing other potential problems with local-only maintenance
being binlogged and executed on slaves; And transactions from
new sessions (after SQL_LOG_BIN is changed globally) are not
binlogged and replicated, which would result in irrecoverable
or difficult data loss.
This is the regular GLOBAL variables way to work, but in
replication context it does not look right on a working server
(with connected sessions) 'set global sql_log_bin' and none of
that connections is affected. Unexperienced DBA after noticing
that the command did "nothing" will change the session var and
most probably won't unset the global var, causing new sessions
to not be binlog.
Setting GLOBAL SQL_LOG_BIN allows DBA to stop binlogging on all
new sessions, which can be used to make a server "replication
read-only" without restarting the server. But this has such big
requirements, stop all existing connections, that it is more
likely to make a mess, it is too risky to allow the GLOBAL variable.

The statement 'SET GLOBAL SQL_LOG_BIN=N' will produce an error
in 5.5, 5.6 and 5.7. Reading the GLOBAL SQL_LOG_BIN will produce
a deprecation warning in 5.7.
2014-09-24 09:44:48 +08:00

75 lines
1.7 KiB
Text

# Test grants for various objects (especially variables) related to
# the binary log
source include/have_log_bin.inc;
connection default;
--disable_warnings
reset master;
--enable_warnings
set @saved_binlog_format = @@global.binlog_format;
create user mysqltest_1@localhost;
show grants for mysqltest_1@localhost;
connect (plain,localhost,mysqltest_1,,test);
connect (root,localhost,root,,test);
# Testing setting session SQL_LOG_BIN variable both as
# root and as plain user.
--echo **** Variable SQL_LOG_BIN ****
connection root;
--echo [root]
set session sql_log_bin = 1;
connection plain;
--echo [plain]
--error ER_SPECIFIC_ACCESS_DENIED_ERROR
set session sql_log_bin = 1;
# Testing setting both session and global BINLOG_FORMAT variable both
# as root and as plain user.
--echo **** Variable BINLOG_FORMAT ****
connection root;
--echo [root]
set global binlog_format = row;
set session binlog_format = row;
connection plain;
--echo [plain]
--error ER_SPECIFIC_ACCESS_DENIED_ERROR
set global binlog_format = row;
--error ER_SPECIFIC_ACCESS_DENIED_ERROR
set session binlog_format = row;
--echo **** Clean up ****
disconnect plain;
disconnect root;
connection default;
set global binlog_format = @saved_binlog_format;
drop user mysqltest_1@localhost;
# Testing if REPLICATION CLIENT privilege is enough to execute
# SHOW MASTER LOGS and SHOW BINARY.
GRANT REPLICATION CLIENT ON *.* TO 'mysqltest_1'@'localhost';
--connect(rpl,localhost,mysqltest_1,,)
--connection rpl
# We are only interested if the following commands succeed and not on
# their output.
--disable_result_log
SHOW MASTER LOGS;
SHOW BINARY LOGS;
--enable_result_log
# clean up
--disconnect rpl
connection default;
DROP USER 'mysqltest_1'@'localhost';