Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-29465

Inherited columns privs for roles wrongly set mysql.tables_priv column

Details

    Description

      The following test case shows that mysql.tables_priv is wrongly populated

      create user foo;
      		 
      create database some_db;
      		 
      create table some_db.t1 (a int, b int, secret int);
      		 
      create role r_select_column;
      		 
      create role r_active_column;
      		 
      grant r_select_column to r_active_column;
      		 
      grant r_active_column to foo;
      		 
      grant select(a) on some_db.t1 to r_select_column;
      		 
      select * from mysql.tables_priv order by user;
      		 
      Host	Db	User	Table_name	Grantor	Timestamp	Table_priv	Column_priv
      		 
      	some_db	r_select_column	t1	root@localhost	0000-00-00 00:00:00		Select
      		 
      grant insert(a) on some_db.t1 to r_active_column;
      		 
      select * from mysql.tables_priv order by user;
      		 
      Host	Db	User	Table_name	Grantor	Timestamp	Table_priv	Column_priv
      		 
      	some_db	r_active_column	t1	root@localhost	0000-00-00 00:00:00		Select, Insert
      		 
      	some_db	r_select_column	t1	root@localhost	0000-00-00 00:00:00		Select
      		 
      -- There shouldn't be `Select` priv stored in Column_priv for r_active_column!

      The cause of this bug is the mixing of GRANT_TABLE::cols and GRANT_TABLE::init_cols within the mysql_table_grant function.

      There is a similar bug for GRANT_COLUMN::rights and GRANT_COLUMN::init_rights.

      Attachments

        Issue Links

          blocks

          New Feature - A new feature of the product, which has yet to be developed. MDEV-14443 DENY clause for access control a.k.a. "negative grants"

          • Critical - Crashes, loss of data, severe memory leak.
          • Stalled
          causes

          Bug - A problem which impairs or prevents the functions of the product. MDEV-30023 Revoking Privilege on the Column Yields the Error

          • Blocker - Blocks development and/or testing work, production could not run.
          • Closed

          Activity

            Ascending order - Click to sort in descending order
            cvicentiu Vicențiu Ciorbaru created issue -
            cvicentiu Vicențiu Ciorbaru made changes -
            Field Original Value New Value
            Assignee Vicențiu Ciorbaru [ cvicentiu ]
            cvicentiu Vicențiu Ciorbaru made changes -
            Description The following test case shows that mysql.tables_priv is wrongly populated
            {code:sql}
            create user foo;
            create database some_db;
            create table some_db.t1 (a int, b int, secret int);
            create role r_select_column;
            create role r_active_column;
            grant r_select_column to r_active_column;
            grant r_active_column to foo;
            grant select(a) on some_db.t1 to r_select_column;
            select * from mysql.tables_priv order by user;
            Host Db User Table_name Grantor Timestamp Table_priv Column_priv
            some_db r_select_column t1 root@localhost 0000-00-00 00:00:00 Select
            grant insert(a) on some_db.t1 to r_active_column;
            select * from mysql.tables_priv order by user;
            Host Db User Table_name Grantor Timestamp Table_priv Column_priv
            some_db r_active_column t1 root@localhost 0000-00-00 00:00:00 Insert
            some_db r_select_column t1 root@localhost 0000-00-00 00:00:00 Select, Insert
            -- There shouldn't be `Select` priv stored in Column_priv!
            {code}

            The cause of this bug is the mixing of {{GRANT_TABLE::cols}} and {{GRANT_TABLE::init_cols}} within the {{mysql_table_grant}} function.

            There is a similar bug for {{GRANT_COLUMN::rights}} and {{GRANT_COLUMN::init_rights}}.
            cvicentiu Vicențiu Ciorbaru made changes -
            Fix Version/s 10.3 [ 22126 ]
            cvicentiu Vicențiu Ciorbaru made changes -
            Description The following test case shows that mysql.tables_priv is wrongly populated
            {code:sql}
            create user foo;
            create database some_db;
            create table some_db.t1 (a int, b int, secret int);
            create role r_select_column;
            create role r_active_column;
            grant r_select_column to r_active_column;
            grant r_active_column to foo;
            grant select(a) on some_db.t1 to r_select_column;
            select * from mysql.tables_priv order by user;
            Host Db User Table_name Grantor Timestamp Table_priv Column_priv
            some_db r_select_column t1 root@localhost 0000-00-00 00:00:00 Select
            grant insert(a) on some_db.t1 to r_active_column;
            select * from mysql.tables_priv order by user;
            Host Db User Table_name Grantor Timestamp Table_priv Column_priv
            some_db r_active_column t1 root@localhost 0000-00-00 00:00:00 Insert
            some_db r_select_column t1 root@localhost 0000-00-00 00:00:00 Select, Insert
            -- There shouldn't be `Select` priv stored in Column_priv!
            {code}

            The cause of this bug is the mixing of {{GRANT_TABLE::cols}} and {{GRANT_TABLE::init_cols}} within the {{mysql_table_grant}} function.

            There is a similar bug for {{GRANT_COLUMN::rights}} and {{GRANT_COLUMN::init_rights}}.             		The following test case shows that mysql.tables_priv is wrongly populated
            {code:sql}
            create user foo;
            create database some_db;
            create table some_db.t1 (a int, b int, secret int);
            create role r_select_column;
            create role r_active_column;
            grant r_select_column to r_active_column;
            grant r_active_column to foo;
            grant select(a) on some_db.t1 to r_select_column;
            select * from mysql.tables_priv order by user;
            Host Db User Table_name Grantor Timestamp Table_priv Column_priv
            some_db r_select_column t1 root@localhost 0000-00-00 00:00:00 Select
            grant insert(a) on some_db.t1 to r_active_column;
            select * from mysql.tables_priv order by user;
            Host Db User Table_name Grantor Timestamp Table_priv Column_priv
            some_db r_active_column t1 root@localhost 0000-00-00 00:00:00 Select, Insert
            some_db r_select_column t1 root@localhost 0000-00-00 00:00:00 Select
            -- There shouldn't be `Select` priv stored in Column_priv for r_active_column!
            {code}

            The cause of this bug is the mixing of {{GRANT_TABLE::cols}} and {{GRANT_TABLE::init_cols}} within the {{mysql_table_grant}} function.

            There is a similar bug for {{GRANT_COLUMN::rights}} and {{GRANT_COLUMN::init_rights}}.
            cvicentiu Vicențiu Ciorbaru made changes -
            Status Open [ 1 ] In Progress [ 3 ]
            cvicentiu Vicențiu Ciorbaru made changes -
            Assignee Vicențiu Ciorbaru [ cvicentiu ] Sergei Golubchik [ serg ]
            Status In Progress [ 3 ] In Review [ 10002 ]
            cvicentiu Vicențiu Ciorbaru made changes -
            julien.fritsch Julien Fritsch made changes -
            Priority Major [ 3 ] Critical [ 2 ]
            cvicentiu Vicențiu Ciorbaru made changes -
            Fix Version/s 10.4 [ 22408 ]
            Fix Version/s 10.5 [ 23123 ]
            Fix Version/s 10.6 [ 24028 ]
            Fix Version/s 10.7 [ 24805 ]
            Fix Version/s 10.8 [ 26121 ]
            Fix Version/s 10.9 [ 26905 ]
            serg Sergei Golubchik made changes -
            Assignee Sergei Golubchik [ serg ] Vicențiu Ciorbaru [ cvicentiu ]
            Status In Review [ 10002 ] Stalled [ 10000 ]
            cvicentiu Vicențiu Ciorbaru made changes -
            Fix Version/s 10.3.37 [ 28404 ]
            Fix Version/s 10.4.27 [ 28405 ]
            Fix Version/s 10.5.18 [ 28421 ]
            Fix Version/s 10.6.10 [ 28407 ]
            Fix Version/s 10.7.6 [ 28408 ]
            Fix Version/s 10.8.5 [ 28308 ]
            Fix Version/s 10.9.3 [ 28409 ]
            Fix Version/s 10.3 [ 22126 ]
            Fix Version/s 10.4 [ 22408 ]
            Fix Version/s 10.5 [ 23123 ]
            Fix Version/s 10.6 [ 24028 ]
            Fix Version/s 10.7 [ 24805 ]
            Fix Version/s 10.8 [ 26121 ]
            Fix Version/s 10.9 [ 26905 ]
            Resolution Fixed [ 1 ]
            Status Stalled [ 10000 ] Closed [ 6 ]
            serg Sergei Golubchik made changes -
            Fix Version/s 10.6.11 [ 28441 ]
            Fix Version/s 10.7.7 [ 28442 ]
            Fix Version/s 10.8.6 [ 28443 ]
            Fix Version/s 10.9.4 [ 28444 ]
            Fix Version/s 10.8.5 [ 28308 ]
            Fix Version/s 10.6.10 [ 28407 ]
            Fix Version/s 10.7.6 [ 28408 ]
            Fix Version/s 10.9.3 [ 28409 ]
            alice Alice Sherepa made changes -

            People

              cvicentiu Vicențiu Ciorbaru
              cvicentiu Vicențiu Ciorbaru
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.