diff options
| author | Sergei Golubchik <serg@mariadb.org> | 2022-12-10 12:08:31 +0100 |
|---|---|---|
| committer | Sergei Golubchik <serg@mariadb.org> | 2023-02-06 14:31:48 +0100 |
| commit | d6e3d89c805725a9940952964157bfdcba0973a3 (patch) | |
| tree | afde2b8b51e11d27ed3d87ae20e36b79acff9f3d /mysql-test/main/grant_slave_admin.result | |
| parent | 0ac5132505513a7eaf9a33d4494e9110061cf24b (diff) | |
| download | mariadb-git-d6e3d89c805725a9940952964157bfdcba0973a3.tar.gz | |
MDEV-29668 SUPER should not allow actions that have fine-grained dedicated privileges
SUPER privilege used to allow various actions that were alternatively
allowed by one of BINLOG ADMIN, BINLOG MONITOR, BINLOG REPLAY,
CONNECTION ADMIN, FEDERATED ADMIN, REPL MASTER ADMIN, REPL SLAVE ADMIN,
SET USER, SLAVE MONITOR.
Now SUPER no longer does that, one has to grant one of the fine-grained
privileges above to be to perform corresponding actions.
On upgrade from MariaDB versions 10.11 and below all the privileges
above are granted automatically if the user has SUPER.
As a side-effect, such an upgrade will allow SUPER-user to run SHOW
BINLOG EVENTS, SHOW RELAYLOG EVENTS, SHOW SLAVE HOSTS, even if he wasn't
able to do it before the upgrade.
Diffstat (limited to 'mysql-test/main/grant_slave_admin.result')
| -rw-r--r-- | mysql-test/main/grant_slave_admin.result | 29 |
1 files changed, 5 insertions, 24 deletions
diff --git a/mysql-test/main/grant_slave_admin.result b/mysql-test/main/grant_slave_admin.result index 0f1f2c9985f..66fc02e98b8 100644 --- a/mysql-test/main/grant_slave_admin.result +++ b/mysql-test/main/grant_slave_admin.result @@ -5,19 +5,19 @@ # MDEV-21743 Split up SUPER privilege to smaller privileges # # -# Test that slave admin statements are not allowed without REPLICATION SLAVE ADMIN or SUPER +# Test that slave admin statements are not allowed without REPLICATION SLAVE ADMIN # CREATE USER user1@localhost IDENTIFIED BY ''; GRANT ALL PRIVILEGES ON *.* TO user1@localhost; -REVOKE REPLICATION SLAVE ADMIN, SUPER ON *.* FROM user1@localhost; +REVOKE REPLICATION SLAVE ADMIN ON *.* FROM user1@localhost; connect con1,localhost,user1,,; connection con1; START SLAVE; -ERROR 42000: Access denied; you need (at least one of) the SUPER, REPLICATION SLAVE ADMIN privilege(s) for this operation +ERROR 42000: Access denied; you need (at least one of) the REPLICATION SLAVE ADMIN privilege(s) for this operation CHANGE MASTER TO MASTER_HOST='127.0.0.1'; -ERROR 42000: Access denied; you need (at least one of) the SUPER, REPLICATION SLAVE ADMIN privilege(s) for this operation +ERROR 42000: Access denied; you need (at least one of) the REPLICATION SLAVE ADMIN privilege(s) for this operation STOP SLAVE; -ERROR 42000: Access denied; you need (at least one of) the SUPER, REPLICATION SLAVE ADMIN privilege(s) for this operation +ERROR 42000: Access denied; you need (at least one of) the REPLICATION SLAVE ADMIN privilege(s) for this operation disconnect con1; connection default; DROP USER user1@localhost; @@ -41,24 +41,5 @@ disconnect con1; connection default; DROP USER user1@localhost; # -# Test that slave admin statements are allowed with SUPER -# -CREATE USER user1@localhost IDENTIFIED BY ''; -GRANT SUPER ON *.* TO user1@localhost; -SHOW GRANTS FOR user1@localhost; -Grants for user1@localhost -GRANT SUPER ON *.* TO `user1`@`localhost` -connect con1,localhost,user1,,; -connection con1; -START SLAVE; -ERROR HY000: Misconfigured slave: MASTER_HOST was not set; Fix in config file or with CHANGE MASTER TO -CHANGE MASTER TO MASTER_USER='root'; -STOP SLAVE; -Warnings: -Note 1255 Slave already has been stopped -disconnect con1; -connection default; -DROP USER user1@localhost; -# # End of 10.5 tests # |