Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-18328

Make DISKS plugin check some privilege to access information_schema.DISKS table

Details

    Description

      The documentation for the information_schema.DISKS table says the following:

      This plugin does not check user privileges. When it is enabled, any user can query the INFORMATION_SCHEMA.DISKS table and see all the information it provides.

      https://mariadb.com/kb/en/library/information-schema-disks-table/

      It seems like this table should be protected by some privilege. Maybe FILE and/or SUPER privileges would be appropriate?

      Attachments

        Issue Links

          relates to

          Task - A task that needs to be done. MDEV-14533 Provide information_schema tables using which hardware information can be obtained.

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed

          Activity

            Ascending order - Click to sort in descending order
            danblack Daniel Black added a comment -

            I think a global "read only" privilege like 'PROCESS' or 'SHOW DATABASES' as reading this table is of lower level sensitivity.

            danblack Daniel Black added a comment - I think a global "read only" privilege like 'PROCESS' or 'SHOW DATABASES' as reading this table is of lower level sensitivity.
            GeoffMontee Geoff Montee (Inactive) added a comment -

            Good point. Maybe FILE or SUPER would be overkill for this table.

            GeoffMontee Geoff Montee (Inactive) added a comment - Good point. Maybe FILE or SUPER would be overkill for this table.
            sanja Oleksandr Byelkin added a comment -

            I made it with FILE

            sanja Oleksandr Byelkin added a comment - I made it with FILE
            serg Sergei Golubchik added a comment -

            It must be an empty table, not an error (you can do a warning or a note, perhaps, I'm not sure about it). SQL Standard is very clear that any user can always select from information_schema tables, they all have

            GRANT SELECT ON INFORMATION_SCHEMA.* TO PUBLIC

            For example, if a user selects from I_S.TABLES, he doesn't get an error when there's a table he has no privileges on — he simply doesn't see that table in the output. This is the standard I_S behavior, anyone can select, but users don't see information about objects they have no privileges on.

            serg Sergei Golubchik added a comment - It must be an empty table, not an error (you can do a warning or a note, perhaps, I'm not sure about it). SQL Standard is very clear that any user can always select from information_schema tables, they all have GRANT SELECT ON INFORMATION_SCHEMA.* TO PUBLIC For example, if a user selects from I_S.TABLES, he doesn't get an error when there's a table he has no privileges on — he simply doesn't see that table in the output. This is the standard I_S behavior, anyone can select, but users don't see information about objects they have no privileges on.
            sanja Oleksandr Byelkin added a comment -

            fixed

            sanja Oleksandr Byelkin added a comment - fixed
            serg Sergei Golubchik added a comment -

            ok to push

            serg Sergei Golubchik added a comment - ok to push

            People

              sanja Oleksandr Byelkin
              GeoffMontee Geoff Montee (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.