Details
-
Bug
-
Status: Closed (View Workflow)
-
Major
-
Resolution: Fixed
-
10.11.7
-
None
-
Linux 6.8.8-gentoo, AMD EPYC 7451, galera-26.4.18
Description
Mariabackup is used for galera as an SST method.
According to documentation, sufficient privileges for mariabackup should be:
GRANT RELOAD, PROCESS, LOCK TABLES, BINLOG MONITOR ON *.* TO 'mariabackup'@'localhost'; |
However, on every SST process, the donor node logs:
[00] 2024-04-30 22:46:04 Connecting to MariaDB server host: localhost, user: mariabackup, password: set, port: not set, socket: /var/run/mysqld/mysqld.sock |
[00] 2024-04-30 22:46:04 Using server version 10.11.7-MariaDB-log |
[00] 2024-04-30 22:46:04 Warning: missing required privilege REPLICA MONITOR on *.* |
So we granted following privileges:
MariaDB [(none)]> show grants for 'mariabackup'@'localhost'; |
Grants for mariabackup@localhost |
GRANT RELOAD, PROCESS, LOCK TABLES, BINLOG MONITOR ON *.* TO `mariabackup`@`localhost`
|
1 row in set (0.000 sec) |
|
|
MariaDB [(none)]> GRANT RELOAD, PROCESS, LOCK TABLES, BINLOG MONITOR, REPLICA MONITOR, REPLICATION CLIENT ON *.* TO 'mariabackup'@'localhost'; |
Query OK, 0 rows affected (0.034 sec) |
|
|
MariaDB [(none)]> show grants for 'mariabackup'@'localhost'; |
Grants for mariabackup@localhost |
GRANT RELOAD, PROCESS, LOCK TABLES, BINLOG MONITOR, SLAVE MONITOR ON *.* TO `mariabackup`@`localhost`
|
1 row in set (0.000 sec) |
and on next SST we got the very same error about missing REPLICA MONITOR privilege.
The issues here are:
a) REPLICA MONITOR result in SLAVE MONITOR
b) mariabackup complains that REPLICA MONITOR is missing while, SLAVE MONITOR is present (so it requires the new privilege name while grants turn into assigning old name!)
c) Official documentations doesn't mention either SLAVE MONITOR or REPLICA MONITOR for mariadb 10.5 and newer while mariabackup requires them in fact.
Attachments
Issue Links
- relates to
-
-
- Closed
-
Activity
Thanks for the bug report euglorg, especially with the recommended fixes.
The results of SHOW GRANTS hasn't been changes in fear of breaking some compatibility.
I've updated the mariadb-backup implementation to test for SLAVE MONITOR and the test suite to ensure there's now warnings of required privileges when the backup is successful.
updated https://mariadb.com/kb/en/mariabackup-sst-method/ and https://mariadb.com/kb/en/mariabackup-overview/
merged now. Sorry it just missed the up coming release but will be there the release afterwards.
documentation updated.