mariadb/mysql-test/main/grant_server.result
Sergei Golubchik d6e3d89c80 MDEV-29668 SUPER should not allow actions that have fine-grained dedicated privileges
SUPER privilege used to allow various actions that were alternatively
allowed by one of BINLOG ADMIN, BINLOG MONITOR, BINLOG REPLAY,
CONNECTION ADMIN, FEDERATED ADMIN, REPL MASTER ADMIN, REPL SLAVE ADMIN,
SET USER, SLAVE MONITOR.

Now SUPER no longer does that, one has to grant one of the fine-grained
privileges above to be to perform corresponding actions.

On upgrade from MariaDB versions 10.11 and below all the privileges
above are granted automatically if the user has SUPER.

As a side-effect, such an upgrade will allow SUPER-user to run SHOW
BINLOG EVENTS, SHOW RELAYLOG EVENTS, SHOW SLAVE HOSTS, even if he wasn't
able to do it before the upgrade.
2023-02-06 14:31:48 +01:00

71 lines
2.5 KiB
Text

#
# Start of 10.5 tests
#
#
# Test that SERVER DDL statements are not allowed without FEDERATED ADMIN or SUPER
#
CREATE USER user1@localhost IDENTIFIED BY '';
GRANT ALL PRIVILEGES ON *.* TO user1@localhost;
REVOKE FEDERATED ADMIN, SUPER ON *.* FROM user1@localhost;
connect con1,localhost,user1,,;
connection con1;
CREATE SERVER IF NOT EXISTS server_1
FOREIGN DATA WRAPPER mysql
OPTIONS (USER 'mysqltest_1', HOST 'localhost', DATABASE 'test2');
ERROR 42000: Access denied; you need (at least one of) the FEDERATED ADMIN privilege(s) for this operation
ALTER SERVER server_1 OPTIONS(HOST 'Server.Example.Org');
ERROR 42000: Access denied; you need (at least one of) the FEDERATED ADMIN privilege(s) for this operation
DROP SERVER server_1;
ERROR 42000: Access denied; you need (at least one of) the FEDERATED ADMIN privilege(s) for this operation
disconnect con1;
connection default;
DROP USER user1@localhost;
#
# Test that SERVER DDL statements are allowed with FEDERATED ADMIN
#
CREATE USER user1@localhost IDENTIFIED BY '';
GRANT FEDERATED ADMIN ON *.* TO user1@localhost;
SHOW GRANTS FOR user1@localhost;
Grants for user1@localhost
GRANT FEDERATED ADMIN ON *.* TO `user1`@`localhost`
connect con1,localhost,user1,,;
connection con1;
CREATE SERVER IF NOT EXISTS server_1
FOREIGN DATA WRAPPER mysql
OPTIONS (USER 'mysqltest_1', HOST 'localhost', DATABASE 'test2');
ALTER SERVER server_1 OPTIONS(HOST 'Server.Example.Org');
DROP SERVER server_1;
disconnect con1;
connection default;
DROP USER user1@localhost;
#
# Test that SERVER DDL statements are not allowed with SUPER
# but only with FEDERATED ADMIN
#
CREATE USER user1@localhost IDENTIFIED BY '';
GRANT SUPER ON *.* TO user1@localhost;
SHOW GRANTS FOR user1@localhost;
Grants for user1@localhost
GRANT SUPER ON *.* TO `user1`@`localhost`
connect con1,localhost,user1,,;
connection con1;
CREATE SERVER IF NOT EXISTS server_1
FOREIGN DATA WRAPPER mysql
OPTIONS (USER 'mysqltest_1', HOST 'localhost', DATABASE 'test2');
ERROR 42000: Access denied; you need (at least one of) the FEDERATED ADMIN privilege(s) for this operation
disconnect con1;
connection default;
REVOKE SUPER ON *.* FROM user1@localhost;
GRANT FEDERATED ADMIN ON *.* TO user1@localhost;
connect con1,localhost,user1,,;
CREATE SERVER IF NOT EXISTS server_1
FOREIGN DATA WRAPPER mysql
OPTIONS (USER 'mysqltest_1', HOST 'localhost', DATABASE 'test2');
ALTER SERVER server_1 OPTIONS(HOST 'Server.Example.Org');
DROP SERVER server_1;
disconnect con1;
connection default;
DROP USER user1@localhost;
#
# End of 10.5 tests
#