Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-34053

privilege REPLICA MONITOR issue

Details

    Description

      Mariabackup is used for galera as an SST method.

      According to documentation, sufficient privileges for mariabackup should be:

      GRANT RELOAD, PROCESS, LOCK TABLES, BINLOG MONITOR ON *.* TO 'mariabackup'@'localhost';

      However, on every SST process, the donor node logs:

      [00] 2024-04-30 22:46:04 Connecting to MariaDB server host: localhost, user: mariabackup, password: set, port: not set, socket: /var/run/mysqld/mysqld.sock
      		 
      [00] 2024-04-30 22:46:04 Using server version 10.11.7-MariaDB-log
      		 
      [00] 2024-04-30 22:46:04 Warning: missing required privilege REPLICA MONITOR on *.*

      So we granted following privileges:

      MariaDB [(none)]> show grants for 'mariabackup'@'localhost';
      		 
      Grants for mariabackup@localhost
      		 
      GRANT RELOAD, PROCESS, LOCK TABLES, BINLOG MONITOR ON *.* TO `mariabackup`@`localhost`
      		 
      1 row in set (0.000 sec)
      		 
       
      		 
      MariaDB [(none)]> GRANT RELOAD, PROCESS, LOCK TABLES, BINLOG MONITOR, REPLICA MONITOR, REPLICATION CLIENT ON *.* TO 'mariabackup'@'localhost';
      		 
      Query OK, 0 rows affected (0.034 sec)
      		 
       
      		 
      MariaDB [(none)]> show grants for 'mariabackup'@'localhost';
      		 
      Grants for mariabackup@localhost
      		 
      GRANT RELOAD, PROCESS, LOCK TABLES, BINLOG MONITOR, SLAVE MONITOR ON *.* TO `mariabackup`@`localhost`
      		 
      1 row in set (0.000 sec)

      and on next SST we got the very same error about missing REPLICA MONITOR privilege.

      The issues here are:
      a) REPLICA MONITOR result in SLAVE MONITOR
      b) mariabackup complains that REPLICA MONITOR is missing while, SLAVE MONITOR is present (so it requires the new privilege name while grants turn into assigning old name!)
      c) Official documentations doesn't mention either SLAVE MONITOR or REPLICA MONITOR for mariadb 10.5 and newer while mariabackup requires them in fact.

      Attachments

        Issue Links

          relates to

          Bug - A problem which impairs or prevents the functions of the product. MDEV-33006 Missing required privilege CONNECTION ADMIN

          • Major - Major loss of function.
          • Closed

          Activity

            Ascending order - Click to sort in descending order
            euglorg Eugene created issue -
            danblack Daniel Black made changes -
            Field Original Value New Value
            danblack Daniel Black made changes -
            Assignee Daniel Black [ danblack ]
            danblack Daniel Black added a comment -

            documentation updated.

            danblack Daniel Black added a comment - documentation updated.
            danblack Daniel Black made changes -
            Fix Version/s 10.5 [ 23123 ]
            Fix Version/s 10.11 [ 27614 ]
            danblack Daniel Black made changes -
            Status Open [ 1 ] In Progress [ 3 ]
            danblack Daniel Black added a comment -

            Thanks for the bug report euglorg, especially with the recommended fixes.

            The results of SHOW GRANTS hasn't been changes in fear of breaking some compatibility.

            I've updated the mariadb-backup implementation to test for SLAVE MONITOR and the test suite to ensure there's now warnings of required privileges when the backup is successful.

            danblack Daniel Black added a comment - Thanks for the bug report euglorg , especially with the recommended fixes. The results of SHOW GRANTS hasn't been changes in fear of breaking some compatibility. I've updated the mariadb-backup implementation to test for SLAVE MONITOR and the test suite to ensure there's now warnings of required privileges when the backup is successful.
            danblack Daniel Black made changes -
            Assignee Daniel Black [ danblack ] Andrew Hutchings [ JIRAUSER52179 ]
            Status In Progress [ 3 ] In Review [ 10002 ]
            danblack Daniel Black added a comment -

            updated https://mariadb.com/kb/en/mariabackup-sst-method/ and https://mariadb.com/kb/en/mariabackup-overview/

            danblack Daniel Black added a comment - updated https://mariadb.com/kb/en/mariabackup-sst-method/ and https://mariadb.com/kb/en/mariabackup-overview/
            TheLinuxJedi Andrew Hutchings (Inactive) added a comment -

            Approved, but has merge conflicts in the tests.

            TheLinuxJedi Andrew Hutchings (Inactive) added a comment - Approved, but has merge conflicts in the tests.
            TheLinuxJedi Andrew Hutchings (Inactive) made changes -
            Assignee Andrew Hutchings [ JIRAUSER52179 ] Daniel Black [ danblack ]
            Status In Review [ 10002 ] Stalled [ 10000 ]
            danblack Daniel Black added a comment -

            merged now. Sorry it just missed the up coming release but will be there the release afterwards.

            danblack Daniel Black added a comment - merged now. Sorry it just missed the up coming release but will be there the release afterwards.
            danblack Daniel Black made changes -
            Fix Version/s 10.5.26 [ 29832 ]
            Fix Version/s 10.5 [ 23123 ]
            Fix Version/s 10.11 [ 27614 ]
            Resolution Fixed [ 1 ]
            Status Stalled [ 10000 ] Closed [ 6 ]
            JIraAutomate JiraAutomate made changes -
            Fix Version/s 10.6.19 [ 29833 ]
            Fix Version/s 10.11.9 [ 29834 ]
            Fix Version/s 11.1.6 [ 29835 ]
            Fix Version/s 11.2.5 [ 29836 ]
            Fix Version/s 11.4.3 [ 29837 ]
            ralf.gebhardt Ralf Gebhardt made changes -
            Component/s Documentation [ 10903 ]

            People

              danblack Daniel Black
              euglorg Eugene
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.