Details
-
Bug
-
Status: Closed (View Workflow)
-
Major
-
Resolution: Not a Bug
-
10.8.2, 10.6.12, 10.6.13
-
None
-
Ubuntu 22.04 with Mariadb packages from the Ubuntu repository (10.6.12 at the moment of writing)
Description
I recently upgraded a system from Ubuntu 20.04 to 22.04 and through this upgraded the local mariadb server from 10.3.x to 10.6.x (through the packages from the ubuntu repository). In my setup I am using https://github.com/prometheus/mysqld_exporter to export metrics to prometheus and with the upgrade this is now failing with the following error message:
caller=exporter.go:174 level=error msg="Error from scraper" scraper=slave_status err="Error 1227: Access denied; you need (at least one of) the SUPER, SLAVE MONITOR privilege(s) for this operation"
|
And while I am able to grant the "super" permission, whenever I try to grant "slave monitor" the permissions are actually not applied.
This can easily reproduced with the below docker-compose.yml. As long as the database was initialised with 10.3 the slave monitor permissions cannot be granted, but when the database is initialised with 10.6 it is no problem to grant the permission.
Steps to reproduce:
- take the below compose file and make sure it uses the 10.3 image
- run "docker-compose up", wait until the database is started then stop the container
- modify the compose file to start with 10.6 instead and then run the following sql file:
CREATE USER IF NOT EXISTS 'prometheus'@'localhost' IDENTIFIED VIA unix_socket WITH MAX_USER_CONNECTIONS 3;
|
GRANT PROCESS, REPLICATION CLIENT, SLAVE MONITOR, SELECT ON *.* TO 'prometheus'@'localhost';
|
FLUSH PRIVILEGES;
|
- after importing the sql file the resulting user is missing the slave monitor permission:
# mysql -e "show grants for prometheus@localhost";
|
+---------------------------------------------------------------------------------------------------------------------------------+
|
| Grants for prometheus@localhost |
|
+---------------------------------------------------------------------------------------------------------------------------------+
|
| GRANT SELECT, PROCESS, BINLOG MONITOR ON *.* TO `prometheus`@`localhost` IDENTIFIED VIA unix_socket WITH MAX_USER_CONNECTIONS 3 |
|
+---------------------------------------------------------------------------------------------------------------------------------+
|
docker-compose.yml for testing:
version: '3.3'
|
services:
|
mariadb:
|
volumes:
|
- db:/var/lib/mysql
|
environment:
|
- MARIADB_ALLOW_EMPTY_ROOT_PASSWORD=true
|
container_name: mariadbtest
|
#image: 'mariadb:10.8-focal'
|
#image: 'mariadb:10.6-focal'
|
image: 'mariadb:10.3-focal'
|
 |
volumes:
|
db:
|