DENY granted exclusively to ROLEs not reloaded after FLUSH PRIVILEGES

worker[01] Using MTR_BUILD_THREAD 300, with reserved ports 19000..19029

CREATE DATABASE d1;

CREATE TABLE d1.t1 (a INT);

INSERT INTO d1.t1 VALUES (1);

CREATE ROLE r;

GRANT SELECT ON d1.* TO r;

DENY SELECT ON d1.t1 TO r;

CREATE USER u@localhost;

GRANT r TO u@localhost;

SET DEFAULT ROLE r FOR u@localhost;

# BEFORE reload: role DENY correctly enforced

connect  p, localhost, u,, d1;

SELECT * FROM d1.t1;

ERROR 42000: SELECT command denied to user 'u'@'localhost' for table `d1`.`t1`

connection default;

disconnect p;

# reload privileges

FLUSH PRIVILEGES;

# AFTER reload: BUG -- role DENY dropped, t1 readable (bypass). The SELECT must still be ER_TABLEACCESS_DENIED_ERROR.

connect  p, localhost, u,, d1;

SELECT * FROM d1.t1;

a

1

connection default;

disconnect p;

DROP USER u@localhost;

DROP ROLE r;

DROP DATABASE d1;

main.mytest                              [ pass ]     20

CREATE DATABASE d1;

CREATE TABLE d1.t1 (a INT);

INSERT INTO d1.t1 VALUES (1);

CREATE ROLE r;

GRANT SELECT ON d1.* TO r;

DENY SELECT ON d1.t1 TO r;

CREATE USER u@localhost;

GRANT r TO u@localhost;

SET DEFAULT ROLE r FOR u@localhost;

--echo # BEFORE reload: role DENY correctly enforced

connect (p, localhost, u,, d1);

--error ER_TABLEACCESS_DENIED_ERROR

SELECT * FROM d1.t1;

connection default;

disconnect p;

--echo # reload privileges 

FLUSH PRIVILEGES;

--echo # AFTER reload: BUG -- role DENY dropped, t1 readable (bypass). The SELECT must still be ER_TABLEACCESS_DENIED_ERROR.

connect (p, localhost, u,, d1);

SELECT * FROM d1.t1;

connection default;

disconnect p;

DROP USER u@localhost;

DROP ROLE r;

DROP DATABASE d1;