Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-35522

MariaDB Audit does not detect all DCLs forms when masking password

Details

    Description

      Simply based on what I see I report this as bug since MariaDB Audit masks the password from CREATE USER but fails to recognize different forms of the same command.

      20241128 15:58:36,fedora,root,localhost,150,276260,QUERY,,'CREATE USER \'claudio\'@\'%\' IDENTIFIED BY *****',1396
      		 
      20241128 15:56:42,fedora,root,localhost,149,276256,QUERY,,'CREATE OR REPLACE USER \'monty\'@\'%\' IDENTIFIED BY \'123\'',0
      		 
      20241128 15:56:54,fedora,root,localhost,149,276257,QUERY,,'SET STATEMENT max_statement_time=10.000000 FOR CREATE USER \'sergio\'@\'%\' IDENTIFIED BY \'123\'',0
      		 
      https://jira.mariadb.org/browse/MDEV-7134

      So if it was decided to mask the password for the CREATE USER command imho it should be done so to detect the different forms of the same command.

      I did not test for other types of DCLs.

      Attachments

        Issue Links

          causes

          Bug - A problem which impairs or prevents the functions of the product. MDEV-35604 SIGSEGV in filter_query_type | log_statement_ex / auditing

          • Blocker - Blocks development and/or testing work, production could not run.
          • Closed

          Activity

            Ascending order - Click to sort in descending order
            claudio.nanni Claudio Nanni created issue -
            sanja Oleksandr Byelkin made changes -
            Field Original Value New Value
            Assignee Oleksandr Byelkin [ sanja ]
            sanja Oleksandr Byelkin made changes -
            Priority Major [ 3 ] Critical [ 2 ]
            sanja Oleksandr Byelkin made changes -
            Key MENT-2186 MDEV-35522
            Project MariaDB Enterprise [ 11500 ] MariaDB Server [ 10000 ]
            sanja Oleksandr Byelkin made changes -
            Priority Critical [ 2 ] Blocker [ 1 ]
            ralf.gebhardt Ralf Gebhardt made changes -
            Summary Enterprise Audit does not detect all DCLs forms when masking password MariaDB Audit does not detect all DCLs forms when masking password
            ralf.gebhardt Ralf Gebhardt made changes -
            Description I know it's a hot topic but I don't know which are the latest conclusions.

            Simply based on what I see I report this as bug since Enteprise Audit masks the password from CREATE USER but fails to recognize different forms of the same command.

            {noformat}
            20241128 15:58:36,fedora,root,localhost,150,276260,QUERY,,'CREATE USER \'claudio\'@\'%\' IDENTIFIED BY *****',1396
            20241128 15:56:42,fedora,root,localhost,149,276256,QUERY,,'CREATE OR REPLACE USER \'monty\'@\'%\' IDENTIFIED BY \'123\'',0
            20241128 15:56:54,fedora,root,localhost,149,276257,QUERY,,'SET STATEMENT max_statement_time=10.000000 FOR CREATE USER \'sergio\'@\'%\' IDENTIFIED BY \'123\'',0
            https://jira.mariadb.org/browse/MDEV-7134
            {noformat}

            So if it was decided to mask the password for the CREATE USER command imho it should be done so to detect the different forms of the same command.

            I did not test for other types of DCLs.



            Simply based on what I see I report this as bug since MariaDB Audit masks the password from CREATE USER but fails to recognize different forms of the same command.

            {noformat}
            20241128 15:58:36,fedora,root,localhost,150,276260,QUERY,,'CREATE USER \'claudio\'@\'%\' IDENTIFIED BY *****',1396
            20241128 15:56:42,fedora,root,localhost,149,276256,QUERY,,'CREATE OR REPLACE USER \'monty\'@\'%\' IDENTIFIED BY \'123\'',0
            20241128 15:56:54,fedora,root,localhost,149,276257,QUERY,,'SET STATEMENT max_statement_time=10.000000 FOR CREATE USER \'sergio\'@\'%\' IDENTIFIED BY \'123\'',0
            https://jira.mariadb.org/browse/MDEV-7134
            {noformat}

            So if it was decided to mask the password for the CREATE USER command imho it should be done so to detect the different forms of the same command.

            I did not test for other types of DCLs.


            sanja Oleksandr Byelkin made changes -
            Fix Version/s 10.5 [ 23123 ]
            sanja Oleksandr Byelkin made changes -
            Affects Version/s 10.5 [ 23123 ]
            sanja Oleksandr Byelkin made changes -
            Status Open [ 1 ] In Progress [ 3 ]
            sanja Oleksandr Byelkin made changes -
            Assignee Oleksandr Byelkin [ sanja ] Sergei Golubchik [ serg ]
            Status In Progress [ 3 ] In Review [ 10002 ]
            serg Sergei Golubchik added a comment -

            534dda1234b9 is ok to push, but see the email first

            serg Sergei Golubchik added a comment - 534dda1234b9 is ok to push, but see the email first
            serg Sergei Golubchik made changes -
            Assignee Sergei Golubchik [ serg ] Oleksandr Byelkin [ sanja ]
            Status In Review [ 10002 ] Stalled [ 10000 ]
            sanja Oleksandr Byelkin made changes -
            Component/s Plugin - Audit [ 10131 ]
            Fix Version/s 10.5.28 [ 29952 ]
            Fix Version/s 10.5 [ 23123 ]
            Resolution Fixed [ 1 ]
            Status Stalled [ 10000 ] Closed [ 6 ]
            JIraAutomate JiraAutomate made changes -
            Fix Version/s 10.6.21 [ 29953 ]
            Fix Version/s 10.11.11 [ 29954 ]
            Fix Version/s 11.4.5 [ 29956 ]
            Fix Version/s 11.7.2 [ 29914 ]
            ralf.gebhardt Ralf Gebhardt made changes -
            ralf.gebhardt Ralf Gebhardt made changes -
            ralf.gebhardt Ralf Gebhardt made changes -

            People

              sanja Oleksandr Byelkin
              claudio.nanni Claudio Nanni
              Votes:
              1 Vote for this issue
              Watchers:
              8 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.