Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-40115

Single routine-level DENY EXECUTE causes all routine metadata in the database to become completely hidden

    XMLWordPrintable

Details

    • Not for Release Notes
    • Q3/2026 Server Maintenance

    Description

      MDEV-14443 CS 13.1.0 41d3dbb0311e8e45b1d23df535959017c7ba17f1 (Debug, Clang 18.1.3-11) Build 18/06/2026

      Session 1
      13.1.0-dbg>CREATE DATABASE d1;
      Query OK, 1 row affected (0.000 sec)
       
      13.1.0-dbg>DELIMITER $$
      13.1.0-dbg>CREATE DEFINER=root@localhost PROCEDURE d1.p1() BEGIN SELECT 1; END$$
      Query OK, 0 rows affected (0.002 sec)
       
      13.1.0-dbg>CREATE DEFINER=root@localhost PROCEDURE d1.p2() BEGIN SELECT 2; END$$
      Query OK, 0 rows affected (0.003 sec)
       
      13.1.0-dbg>DELIMITER ;
      13.1.0-dbg>CREATE USER u@localhost;
      Query OK, 0 rows affected (0.001 sec)
       
      13.1.0-dbg>GRANT EXECUTE ON d1.* TO u@localhost;
      Query OK, 0 rows affected (0.001 sec)
       
      13.1.0-dbg>DENY EXECUTE ON PROCEDURE d1.p1 TO u@localhost;
      Query OK, 0 rows affected (0.001 sec)
       
      13.1.0-dbg>FLUSH PRIVILEGES;
      Query OK, 0 rows affected (0.001 sec)
       
      13.1.0-dbg>
       
       
      Session 2
       
      MariaDB [d1]> CALL p2();
      +---+
      | 2 |
      +---+
      | 2 |
      +---+
      1 row in set (0.001 sec)
       
      Query OK, 0 rows affected (0.001 sec)
       
      MariaDB [d1]>
      MariaDB [d1]> SELECT COUNT(*) AS visible_routines
          ->   FROM information_schema.ROUTINES WHERE ROUTINE_SCHEMA='d1';
      +------------------+
      | visible_routines |
      +------------------+
      |                0 |
      +------------------+
      1 row in set (0.005 sec)
       
      MariaDB [d1]>
      

      MTR Test

      CREATE DATABASE d1;
      DELIMITER $$;
      CREATE DEFINER=root@localhost PROCEDURE d1.p1() BEGIN SELECT 1; END$$
      CREATE DEFINER=root@localhost PROCEDURE d1.p2() BEGIN SELECT 2; END$$
      DELIMITER ;$$
      CREATE USER u@localhost;
      GRANT EXECUTE ON d1.* TO u@localhost;
      DENY EXECUTE ON PROCEDURE d1.p1 TO u@localhost;
      FLUSH PRIVILEGES;
       
      connect (x, localhost, u,, d1);
      # user CAN execute the non-denied routine p2:
      CALL p2();
      # information_schema.ROUTINES shows 0 routines (expected >=1 for p2):
      SELECT COUNT(*) AS visible_routines FROM information_schema.ROUTINES WHERE ROUTINE_SCHEMA='d1';
      # SHOW PROCEDURE STATUS shows 0 rows:
      SHOW PROCEDURE STATUS WHERE Db='d1';
      connection default;
      disconnect x;
       
      DROP USER u@localhost;
      DROP DATABASE d1;
      

      Attachments

        Issue Links

          Activity

            People

              wlad Vladislav Vaintroub
              ramesh Ramesh Sivaraman
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Time Tracking

                  Estimated:
                  Original Estimate - 0d
                  0d
                  Remaining:
                  Remaining Estimate - 0d
                  0d
                  Logged:
                  Time Spent - 4.5h
                  4.5h

                  Git Integration

                    Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.