Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-37637

Add privilege that allows access to all schemas, running queries but not getting full access to data

    XMLWordPrintable

Details

    • New Feature
    • Status: Open (View Workflow)
    • Major
    • Resolution: Unresolved
    • 12.2
    • Server
    • None

    Description

      This feature would allow a DBA to optimize queries without having full access to date (even accidentally).

      This would be a special privilege that would allow a DBA access to all databases and schemas,
      but any select query would return 0 for numerical data and '*' for other data.
      EXPLAIN and SHOW commands would not be affected.
      -Maybe allow queries that only touches information_schema?

      One shortcoming of this solution is that a user with this privilege could deduce some information from the system by using queries with like, >= and <=.
      Because of this, all queries the users does should be logged to the general log to ensure that the user is not abusing his privilege.

      This feature could be very useful when a DBA is asked to login to a user database and do queries while the customer is watching (a common practice in these cases).
      It would ensure that the DBA does not accidentally see any data.

      The Implementation of this would be relatively easy by using a special 'Protocol' class that is used by users with this privilege when select queries are used.

      In theory a user can give

      Attachments

        Activity

          People

            Unassigned Unassigned
            monty Michael Widenius
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

            Dates

              Created:
              Updated:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.