mariadb/mysql-test/suite/funcs_1/t/is_user_privileges.test

# suite/funcs_1/t/is_user_privileges.test
#
# Check the layout of information_schema.user_privileges, permissions and
# the impact of CREATE/ALTER/DROP SCHEMA on it.
#
# Note:
#    This test is not intended
#    - to show information about the all time existing tables
#      within the databases information_schema and mysql
#    - for checking storage engine properties
#      Therefore please do not alter $engine_type and $other_engine_type.
#
# Author:
# 2008-01-23 mleich WL#4203 Reorganize and fix the data dictionary tests of
#                           testsuite funcs_1
#                   Create this script based on older scripts and new code.
#

# This test cannot be used for the embedded server because we check here
# privileges.
--source include/not_embedded.inc

let $engine_type       = MEMORY;
let $other_engine_type = MyISAM;

let $is_table = USER_PRIVILEGES;

# The table INFORMATION_SCHEMA.USER_PRIVILEGES must exist
eval SHOW TABLES FROM information_schema LIKE '$is_table';

--echo #######################################################################
--echo # Testcase 3.2.1.1: INFORMATION_SCHEMA tables can be queried via SELECT
--echo #######################################################################
# Ensure that every INFORMATION_SCHEMA table can be queried with a SELECT
# statement, just as if it were an ordinary user-defined table.
#
--source suite/funcs_1/datadict/is_table_query.inc


--echo #########################################################################
--echo # Testcase 3.2.16.1: INFORMATION_SCHEMA.USER_PRIVILEGES layout
--echo #########################################################################
# Ensure that the INFORMATION_SCHEMA.USER_PRIVILEGES table has the following columns,
# in the following order:
#
# GRANTEE (shows a user to whom a user privilege has been granted),
# TABLE_CATALOG (always shows NULL),
# PRIVILEGE_TYPE (shows the granted privilege),
# IS_GRANTABLE (shows whether the privilege was granted WITH GRANT OPTION).
#
--source suite/funcs_1/datadict/datadict_bug_12777.inc
eval DESCRIBE          information_schema.$is_table;
--source suite/funcs_1/datadict/datadict_bug_12777.inc
eval SHOW CREATE TABLE information_schema.$is_table;
--source suite/funcs_1/datadict/datadict_bug_12777.inc
eval SHOW COLUMNS FROM information_schema.$is_table;

# Note: Retrieval of information within information_schema.columns about
#       information_schema.user_privileges is in is_columns_is.test.

# Show that TABLE_CATALOG is always NULL.
SELECT grantee, table_catalog, privilege_type
FROM information_schema.user_privileges
WHERE table_catalog IS NOT NULL;


--echo ##########################################################################
--echo # Testcases 3.2.16.2+3.2.16.3+3.2.16.4: INFORMATION_SCHEMA.USER_PRIVILEGES
--echo #           accessible information
--echo ##########################################################################
# 3.2.16.2: Ensure that the table shows the relevant information on every user
#           privilege which has been granted to the current user or to PUBLIC,
#           or has been granted by the current user.
# 3.2.16.3: Ensure that the table does not show any information on any user
#           privileges which have been granted to users other than the current
#           user or  have been granted by any user other than the current user.
# 3.2.16.4: Ensure that the table does not show any information on any
#           privileges that are not user privileges for the current user.
#
--disable_warnings
DROP DATABASE IF EXISTS db_datadict;
--enable_warnings
CREATE DATABASE db_datadict;

--error 0,ER_CANNOT_USER
DROP   USER 'testuser1'@'localhost';
CREATE USER 'testuser1'@'localhost';
--error 0,ER_CANNOT_USER
DROP   USER 'testuser2'@'localhost';
CREATE USER 'testuser2'@'localhost';
--error 0,ER_CANNOT_USER
DROP   USER 'testuser3'@'localhost';
CREATE USER 'testuser3'@'localhost';

GRANT SELECT ON db_datadict.* TO 'testuser1'@'localhost';
GRANT SELECT ON mysql.user TO 'testuser1'@'localhost';

GRANT INSERT ON *.* TO 'testuser2'@'localhost';
GRANT UPDATE ON *.* TO 'testuser2'@'localhost';

let $my_select1= SELECT * FROM information_schema.user_privileges
WHERE grantee LIKE '''testuser%'''
ORDER BY grantee, table_catalog, privilege_type;
let $my_select2= SELECT * FROM mysql.user
WHERE user LIKE 'testuser%' ORDER BY host, user;
let $my_show= SHOW GRANTS;
eval $my_select1;
eval $my_select2;

--echo #
--echo # Add GRANT OPTION db_datadict.* to testuser1;
GRANT UPDATE ON db_datadict.* TO 'testuser1'@'localhost' WITH GRANT OPTION;
eval $my_select1;
eval $my_select2;

--echo # Establish connection testuser1 (user=testuser1)
--replace_result $MASTER_MYPORT MYSQL_PORT $MASTER_MYSOCK MYSQL_SOCK
connect (testuser1, localhost, testuser1, , db_datadict);
eval $my_select1;
eval $my_select2;
eval $my_show;

--echo
--echo # Now add SELECT on *.* to testuser1;

--echo # Switch to connection default
connection default;
GRANT SELECT ON *.* TO 'testuser1'@'localhost';
--echo #
--echo # Here <SELECT NO> is shown correctly for testuser1;
eval $my_select1;
eval $my_select2;

GRANT SELECT ON *.* TO 'testuser1'@'localhost' WITH GRANT OPTION;
--echo #
--echo # Here <SELECT YES> is shown correctly for testuser1;
eval $my_select1;
eval $my_select2;

--echo # Switch to connection testuser1
# check that this appears
connection testuser1;
eval $my_select1;
eval $my_select2;
eval $my_show;

--echo # Establish connection testuser2 (user=testuser2)
--replace_result $MASTER_MYPORT MYSQL_PORT $MASTER_MYSOCK MYSQL_SOCK
connect (testuser2, localhost, testuser2, , db_datadict);
eval $my_select1;
--error ER_TABLEACCESS_DENIED_ERROR
eval $my_select2;
eval $my_show;

--echo # Establish connection testuser3 (user=testuser3)
--replace_result $MASTER_MYPORT MYSQL_PORT $MASTER_MYSOCK MYSQL_SOCK
connect (testuser3, localhost, testuser3, , test);
eval $my_select1;
--error ER_TABLEACCESS_DENIED_ERROR
eval $my_select2;
eval $my_show;

--echo
--echo # Revoke privileges from testuser1;
--echo # Switch to connection default
connection default;
REVOKE ALL PRIVILEGES, GRANT OPTION FROM 'testuser1'@'localhost';
eval $my_select1;
eval $my_select2;

--echo # Switch to connection testuser1
# check for changes
connection testuser1;
eval $my_select1;
--error ER_TABLEACCESS_DENIED_ERROR
eval $my_select2;
eval $my_show;

# OK, testuser1 has no privs here
--error ER_TABLEACCESS_DENIED_ERROR
CREATE TABLE db_datadict.tb_55 ( c1 TEXT );
eval $my_select1;
--error ER_TABLEACCESS_DENIED_ERROR
eval $my_select2;
eval $my_show;
# OK, testuser1 has no privs here
--error ER_TABLEACCESS_DENIED_ERROR
CREATE TABLE db_datadict.tb_66 ( c1 TEXT );

--echo
--echo # Add ALL on db_datadict.* (and select on mysql.user) to testuser1;
--echo # Switch to connection default
connection default;
GRANT ALL ON db_datadict.* TO 'testuser1'@'localhost' WITH GRANT OPTION;
GRANT SELECT ON mysql.user TO 'testuser1'@'localhost';
eval $my_select1;
eval $my_select2;

--echo # Switch to connection testuser1
connection testuser1;
eval $my_select1;
eval $my_select2;
eval $my_show;

# OK, testuser1 has no privs here
--error ER_TABLEACCESS_DENIED_ERROR
CREATE TABLE db_datadict.tb_56 ( c1 TEXT );

# using 'USE' lets the server read the privileges new, so now the CREATE works
USE db_datadict;
eval $my_select1;
eval $my_select2;
eval $my_show;
--replace_result $other_engine_type <other_engine_type>
eval
CREATE TABLE tb_57 ( c1 TEXT )
ENGINE = $other_engine_type;

--echo
--echo # Revoke privileges from testuser1;
--echo # Switch to connection default
connection default;
REVOKE ALL PRIVILEGES, GRANT OPTION FROM 'testuser1'@'localhost';
eval $my_select1;
eval $my_select2;

--echo # Switch to connection testuser1
# check for changes
connection testuser1;
eval $my_select1;
--error ER_TABLEACCESS_DENIED_ERROR
eval $my_select2;
eval $my_show;
# WORKS, as the existing old privileges are used!
--replace_result $other_engine_type <other_engine_type>
eval
CREATE TABLE db_datadict.tb_58 ( c1 TEXT )
ENGINE = $other_engine_type;
# existing privileges are "read" new when USE is called, user has no privileges
--error ER_DBACCESS_DENIED_ERROR
USE db_datadict;
#FIXME 3.2.16: check that it is correct that this now 'works': --error ER_TABLEACCESS_DENIED_ERROR
--replace_result $other_engine_type <other_engine_type>
eval
CREATE TABLE db_datadict.tb_59 ( c1 TEXT )
ENGINE = $other_engine_type;

# Cleanup
--echo # Switch to connection default and close connections testuser1,testuser2,testuser3
connection default;
disconnect testuser1;
disconnect testuser2;
disconnect testuser3;
DROP USER 'testuser1'@'localhost';
DROP USER 'testuser2'@'localhost';
DROP USER 'testuser3'@'localhost';
DROP DATABASE IF EXISTS db_datadict;


--echo ########################################################################################
--echo # Testcases 3.2.1.13+3.2.1.14+3.2.1.15: INFORMATION_SCHEMA.USER_PRIVILEGES modifications
--echo ########################################################################################
# 3.2.1.13: Ensure that the creation of any new database object (e.g. table or
#           column) automatically inserts all relevant information on that
#           object into every appropriate INFORMATION_SCHEMA table.
# 3.2.1.14: Ensure that the alteration of any existing database object
#           automatically updates all relevant information on that object in
#           every appropriate INFORMATION_SCHEMA table.
# 3.2.1.15: Ensure that the dropping of any existing database object
#           automatically deletes all relevant information on that object from
#           every appropriate INFORMATION_SCHEMA table.
#
let $my_select = SELECT * FROM information_schema.user_privileges
WHERE grantee = '''testuser1''@''localhost''';
let $my_show = SHOW GRANTS FOR 'testuser1'@'localhost';
eval $my_select;
--error ER_NONEXISTING_GRANT
eval $my_show;
--error 0,ER_CANNOT_USER
DROP   USER 'testuser1'@'localhost';
CREATE USER 'testuser1'@'localhost';
eval $my_select;
eval $my_show;
GRANT SELECT, FILE ON *.* TO 'testuser1'@'localhost';
eval $my_select;
eval $my_show;
DROP USER   'testuser1'@'localhost';
eval $my_select;
--error ER_NONEXISTING_GRANT
eval $my_show;


--echo ########################################################################
--echo # Testcases 3.2.1.3-3.2.1.5 + 3.2.1.8-3.2.1.12: INSERT/UPDATE/DELETE and
--echo #           DDL on INFORMATION_SCHEMA tables are not supported
--echo ########################################################################
# 3.2.1.3:  Ensure that no user may execute an INSERT statement on any
#           INFORMATION_SCHEMA table.
# 3.2.1.4:  Ensure that no user may execute an UPDATE statement on any
#           INFORMATION_SCHEMA table.
# 3.2.1.5:  Ensure that no user may execute a DELETE statement on any
#           INFORMATION_SCHEMA table.
# 3.2.1.8:  Ensure that no user may create an index on an
#           INFORMATION_SCHEMA table.
# 3.2.1.9:  Ensure that no user may alter the definition of an
#           INFORMATION_SCHEMA table.
# 3.2.1.10: Ensure that no user may drop an INFORMATION_SCHEMA table.
# 3.2.1.11: Ensure that no user may move an INFORMATION_SCHEMA table to any
#           other database.
# 3.2.1.12: Ensure that no user may directly add to, alter, or delete any data
#           in an INFORMATION_SCHEMA table.
#
--error 0,ER_CANNOT_USER
DROP   USER   'testuser1'@'localhost';
CREATE USER 'testuser1'@'localhost';

--error ER_DBACCESS_DENIED_ERROR
INSERT INTO information_schema.user_privileges
SELECT * FROM information_schema.user_privileges;

--error ER_DBACCESS_DENIED_ERROR
UPDATE information_schema.user_privileges
SET PRIVILEGE_TYPE = 'gaming';

--error ER_DBACCESS_DENIED_ERROR
DELETE FROM information_schema.user_privileges
WHERE grantee = '''testuser1''@''localhost''';
--error ER_DBACCESS_DENIED_ERROR
TRUNCATE information_schema.user_privileges;

--error ER_DBACCESS_DENIED_ERROR
CREATE INDEX i1 ON information_schema.user_privileges(grantee);

--error ER_DBACCESS_DENIED_ERROR
ALTER TABLE information_schema.user_privileges ADD f1 INT;

--error ER_DBACCESS_DENIED_ERROR
DROP TABLE information_schema.user_privileges;

--error ER_DBACCESS_DENIED_ERROR
ALTER TABLE information_schema.user_privileges
RENAME db_datadict.user_privileges;
--error ER_DBACCESS_DENIED_ERROR
ALTER TABLE information_schema.user_privileges
RENAME information_schema.xuser_privileges;

# Cleanup
DROP USER   'testuser1'@'localhost';