Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-40278

Package type is wrongly DENIED when called by a low privilege invoker

    XMLWordPrintable

Details

    • Not for Release Notes
    • Q3/2026 Server Maintenance

    Description

      SET sql_mode=ORACLE;
      CREATE DATABASE secdb;
      CREATE DATABASE appdb;
      DELIMITER $$;
      CREATE PACKAGE secdb.vault AS
        TYPE creds IS RECORD(username VARCHAR(64), pw VARCHAR(128));
        FUNCTION f RETURN INT;
      END;
      $$
      CREATE PACKAGE BODY secdb.vault AS FUNCTION f RETURN INT AS BEGIN RETURN 42; END; END;
      $$
      CREATE DEFINER=root@localhost PROCEDURE appdb.pJ AS r secdb.vault.creds;
      BEGIN r.username:='admin'; SELECT r.username; END;
      $$
      CREATE DEFINER=root@localhost PROCEDURE appdb.pR AS x INT;
      BEGIN x:=secdb.vault.f(); SELECT x; END;
      $$
      DELIMITER ;$$
       
      CREATE USER low@localhost;
      GRANT ALL ON appdb.* TO low@localhost;   # NO privilege on secdb
       
       
      connect(lowconn, localhost, low,,appdb);
       
      SET sql_mode=ORACLE;
      CALL appdb.pR();          # Works fine -> 42 (definer's rights honored for package ROUTINE)
      CALL appdb.pJ();          # Shows denied error even with definer's rights : ERROR 1457 (HY000): Failed to load routine appdb.pJ (internal code -6). For more details, run SHOW WARNINGS
      

      Attachments

        Issue Links

          Activity

            People

              bar Alexander Barkov
              ramesh Ramesh Sivaraman
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Time Tracking

                  Estimated:
                  Original Estimate - 2.7h Original Estimate - 2.7h
                  2.7h
                  Remaining:
                  Remaining Estimate - 0d
                  0d
                  Logged:
                  Time Spent - 1d 7h
                  1d 7h

                  Git Integration

                    Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.