Details
-
Bug
-
Status: Approved (View Workflow)
-
Major
-
Resolution: Unresolved
-
12.1.1
-
None
Description
The CHECK TABLE command can be executed by users who only have the table-level CREATE or GRANT OPTION privilege.
Steps to reproduce:
1. Login as the root user:
-- Create a database and a table
|
CREATE DATABASE test; |
CREATE TABLE test.xxx (yyy INT); |
|
|
-- Create two new users and grant the GRANT OPTION privilege
|
-- One for table-level (to reproduce the issue) and one for global-level (for comparison)
|
CREATE USER table_level_priv; |
CREATE USER global_level_priv; |
GRANT CREATE, GRANT OPTION ON *.* TO global_level_priv; |
GRANT GRANT OPTION ON test.xxx TO table_level_priv; |
2. Login as the global_level_priv user. This user has the global CREATE and GRANT OPTION privilege, but cannot run the CHECK TABLE command:
SHOW GRANTS;
|
/*+-----------------------------------------------------------------+
|
| Grants for global_level_priv@% |
|
+-----------------------------------------------------------------+
|
| GRANT CREATE ON *.* TO `global_level_priv`@`%` WITH GRANT OPTION |
|
+-----------------------------------------------------------------+*/
|
|
|
CHECK TABLE test.xxx; |
-- ERROR 1142 (42000): SELECT command denied to user 'global_level_priv'@'localhost' for table 'xxx' |
3. Login as the table_level_priv user (the result seems inconsistent with the global-level user)
SHOW GRANTS;
|
/*+-------------------------------------------------------------------------+
|
| Grants for table_level_priv@% |
|
+-------------------------------------------------------------------------+
|
| GRANT USAGE ON *.* TO `table_level_priv`@`%` |
|
| GRANT USAGE ON `test`.`xxx` TO `table_level_priv`@`%` WITH GRANT OPTION |
|
+-------------------------------------------------------------------------+*/
|
CHECK TABLE test.xxx; |
/*+----------+-------+----------+----------+
|
| Table | Op | Msg_type | Msg_text |
|
+----------+-------+----------+----------+
|
| test.xxx | check | status | OK |
|
+----------+-------+----------+----------+*/ |