Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-29596

Separate SUPER and READ ONLY ADMIN privileges

Details

    Description

      Remove READ ONLY ADMIN from the SUPER privilege

      The benefit of this is that one can remove the READ ONLY ADMIN privilege
      from all users and this way ensure that no one can do any changes on
      any non-temporary tables.

      This is good option to use on slaves when one wants to ensure that the
      slave is kept identical to the master.

      Attachments

        Issue Links

          causes

          Bug - A problem which impairs or prevents the functions of the product. MDEV-29632 SUPER users created before 10.11 should retain READ_ONLY ADMIN privilege upon upgrade

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-29641 Help topics say SUPER is required to bypass read_only

          • Major - Major loss of function.
          • Open
          is part of

          Task - A task that needs to be done. MDEV-29547 prepare 10.11.0 preview releases

          • Blocker - Blocks development and/or testing work, production could not run.
          • Closed
          relates to

          Task - A task that needs to be done. MDEV-9458 FR: Super read-only mode

          • Major - Major loss of function.
          • Closed

          Task - A task that needs to be done. MDEV-29668 SUPER should not allow actions that have fine-grained dedicated privileges

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed

          Activity

            Descending order - Click to sort in ascending order
            elenst Elena Stepanova added a comment - - edited

            I have no objections against pushing it as of bb-10.11-MDEV-29596 07581249 (that is, with the fix for MDEV-29632 in addition to the preview commit) into main 10.11 and releasing with 10.11.1.

            Documentation and help topics will need to be updated to reflect the change in SUPER capabilities, but as explained in MDEV-29641, it is usually done asynchronously with releases, so it cannot be a blocker for the feature.

            Note: In OM=>NS replication, if a user with SUPER privilege is created on the master, it will have READ_ONLY ADMIN privilege, while the replicated user on the replica will not. I don't consider it a bug and the scenario is probably of a low importance, I will leave it to the documentation team to decide whether it should be mentioned anywhere (FYI greenman).

            elenst Elena Stepanova added a comment - - edited I have no objections against pushing it as of bb-10.11-MDEV-29596 07581249 (that is, with the fix for MDEV-29632 in addition to the preview commit) into main 10.11 and releasing with 10.11.1. Documentation and help topics will need to be updated to reflect the change in SUPER capabilities, but as explained in MDEV-29641 , it is usually done asynchronously with releases, so it cannot be a blocker for the feature. Note: In OM=>NS replication, if a user with SUPER privilege is created on the master, it will have READ_ONLY ADMIN privilege, while the replicated user on the replica will not. I don't consider it a bug and the scenario is probably of a low importance, I will leave it to the documentation team to decide whether it should be mentioned anywhere (FYI greenman ).
            monty Michael Widenius added a comment -

            Pushed to bb-10.11-MDEV-29596

            monty Michael Widenius added a comment - Pushed to bb-10.11- MDEV-29596

            People

              serg Sergei Golubchik
              monty Michael Widenius
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.