Privilege propogation depends on the order in which the privileges were granted.
Here, I first grant the roles, and then grant privileges to the roles:
MariaDB [test]> create role r1, r2;
|
Query OK, 0 rows affected (0.00 sec)
|
|
MariaDB [test]> grant r1 to r2;
|
Query OK, 0 rows affected (0.00 sec)
|
|
MariaDB [test]> grant r2 to foo@localhost;
|
Query OK, 0 rows affected (0.00 sec)
|
|
MariaDB [test]> grant all on db1.* to r1;
|
Query OK, 0 rows affected (0.00 sec)
|
|
MariaDB [test]> grant all on db2.* to r2;
|
Query OK, 0 rows affected (0.00 sec)
|
As a result, the user with active role r2 has access to both db1 and db2:
MariaDB [test]> select current_user;
|
+---------------+
|
| current_user |
|
+---------------+
|
| foo@localhost |
|
+---------------+
|
1 row in set (0.00 sec)
|
|
MariaDB [test]> show tables in db1;
|
ERROR 1044 (42000): Access denied for user 'foo'@'localhost' to database 'db1'
|
|
MariaDB [test]> show tables in db2;
|
ERROR 1044 (42000): Access denied for user 'foo'@'localhost' to database 'db2'
|
|
MariaDB [test]> set role r2;
|
Query OK, 0 rows affected (0.00 sec)
|
|
MariaDB [test]> show tables in db1;
|
Empty set (0.00 sec)
|
|
MariaDB [test]> show tables in db2;
|
Empty set (0.00 sec)
|
|
MariaDB [test]> show grants;
|
+-----------------------------------------+
|
| Grants for foo@localhost |
|
+-----------------------------------------+
|
| GRANT r2 TO 'foo'@'localhost' |
|
| GRANT USAGE ON *.* TO 'foo'@'localhost' |
|
| GRANT r1 TO 'r2' |
|
| GRANT USAGE ON *.* TO 'r2' |
|
| GRANT ALL PRIVILEGES ON `db2`.* TO 'r2' |
|
| GRANT USAGE ON *.* TO 'r1' |
|
| GRANT ALL PRIVILEGES ON `db1`.* TO 'r1' |
|
+-----------------------------------------+
|
7 rows in set (0.00 sec)
|
|
Now, I first grant privileges to the roles, and then grant roles:
MariaDB [test]> create role r1, r2;
|
Query OK, 0 rows affected (0.00 sec)
|
|
MariaDB [test]> grant all on db1.* to r1;
|
Query OK, 0 rows affected (0.00 sec)
|
|
MariaDB [test]> grant all on db2.* to r2;
|
Query OK, 0 rows affected (0.00 sec)
|
|
MariaDB [test]> grant r1 to r2;
|
Query OK, 0 rows affected (0.00 sec)
|
|
MariaDB [test]> grant r2 to foo@localhost;
|
Query OK, 0 rows affected (0.00 sec)
|
As a result, the user with active role r2 only has access to db2, but not to db1:
MariaDB [test]> select current_user;
|
+---------------+
|
| current_user |
|
+---------------+
|
| foo@localhost |
|
+---------------+
|
1 row in set (0.00 sec)
|
|
MariaDB [test]> show tables in db1;
|
ERROR 1044 (42000): Access denied for user 'foo'@'localhost' to database 'db1'
|
MariaDB [test]> show tables in db2;
|
ERROR 1044 (42000): Access denied for user 'foo'@'localhost' to database 'db2'
|
MariaDB [test]> set role r2;
|
Query OK, 0 rows affected (0.00 sec)
|
|
MariaDB [test]> show tables in db1;
|
ERROR 1044 (42000): Access denied for user 'foo'@'localhost' to database 'db1'
|
|
MariaDB [test]> show tables in db2;
|
Empty set (0.00 sec)
|
|
MariaDB [test]> show grants;
|
+-----------------------------------------+
|
| Grants for foo@localhost |
|
+-----------------------------------------+
|
| GRANT r2 TO 'foo'@'localhost' |
|
| GRANT USAGE ON *.* TO 'foo'@'localhost' |
|
| GRANT r1 TO 'r2' |
|
| GRANT USAGE ON *.* TO 'r2' |
|
| GRANT ALL PRIVILEGES ON `db2`.* TO 'r2' |
|
| GRANT USAGE ON *.* TO 'r1' |
|
| GRANT ALL PRIVILEGES ON `db1`.* TO 'r1' |
|
+-----------------------------------------+
|
7 rows in set (0.01 sec)
|
{"report":{"fcp":1199.1000001430511,"ttfb":214.90000009536743,"pageVisibility":"visible","entityId":31619,"key":"jira.project.issue.view-issue","isInitial":true,"threshold":1000,"elementTimings":{},"userDeviceMemory":8,"userDeviceProcessors":64,"apdex":0.5,"journeyId":"ea0c75a6-de5e-464b-ab20-6fccdd408ec4","navigationType":0,"readyForUser":1366.1000001430511,"redirectCount":0,"resourceLoadedEnd":1410.9000000953674,"resourceLoadedStart":221.70000004768372,"resourceTiming":[{"duration":413.2000000476837,"initiatorType":"link","name":"https://jira.mariadb.org/s/2c21342762a6a02add1c328bed317ffd-CDN/lu2bu7/820016/12ta74/0a8bac35585be7fc6c9cc5a0464cd4cf/_/download/contextbatch/css/_super/batch.css","startTime":221.70000004768372,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":221.70000004768372,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":634.9000000953674,"responseStart":0,"secureConnectionStart":0},{"duration":413,"initiatorType":"link","name":"https://jira.mariadb.org/s/7ebd35e77e471bc30ff0eba799ebc151-CDN/lu2bu7/820016/12ta74/8679b4946efa1a0bb029a3a22206fb5d/_/download/contextbatch/css/jira.browse.project,project.issue.navigator,jira.view.issue,jira.general,jira.global,atl.general,-_super/batch.css?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&slack-enabled=true","startTime":221.90000009536743,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":221.90000009536743,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":634.9000000953674,"responseStart":0,"secureConnectionStart":0},{"duration":422.2999999523163,"initiatorType":"script","name":"https://jira.mariadb.org/s/fbf975c0cce4b1abf04784eeae9ba1f4-CDN/lu2bu7/820016/12ta74/0a8bac35585be7fc6c9cc5a0464cd4cf/_/download/contextbatch/js/_super/batch.js?locale=en","startTime":222.10000014305115,"connectEnd":222.10000014305115,"connectStart":222.10000014305115,"domainLookupEnd":222.10000014305115,"domainLookupStart":222.10000014305115,"fetchStart":222.10000014305115,"redirectEnd":0,"redirectStart":0,"requestStart":222.10000014305115,"responseEnd":644.4000000953674,"responseStart":644.4000000953674,"secureConnectionStart":222.10000014305115},{"duration":596.2000000476837,"initiatorType":"script","name":"https://jira.mariadb.org/s/099b33461394b8015fc36c0a4b96e19f-CDN/lu2bu7/820016/12ta74/8679b4946efa1a0bb029a3a22206fb5d/_/download/contextbatch/js/jira.browse.project,project.issue.navigator,jira.view.issue,jira.general,jira.global,atl.general,-_super/batch.js?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&locale=en&slack-enabled=true","startTime":222.20000004768372,"connectEnd":222.20000004768372,"connectStart":222.20000004768372,"domainLookupEnd":222.20000004768372,"domainLookupStart":222.20000004768372,"fetchStart":222.20000004768372,"redirectEnd":0,"redirectStart":0,"requestStart":222.20000004768372,"responseEnd":818.4000000953674,"responseStart":818.3000001907349,"secureConnectionStart":222.20000004768372},{"duration":600.0999999046326,"initiatorType":"script","name":"https://jira.mariadb.org/s/94c15bff32baef80f4096a08aceae8bc-CDN/lu2bu7/820016/12ta74/c92c0caa9a024ae85b0ebdbed7fb4bd7/_/download/contextbatch/js/atl.global,-_super/batch.js?locale=en","startTime":222.30000019073486,"connectEnd":222.30000019073486,"connectStart":222.30000019073486,"domainLookupEnd":222.30000019073486,"domainLookupStart":222.30000019073486,"fetchStart":222.30000019073486,"redirectEnd":0,"redirectStart":0,"requestStart":222.30000019073486,"responseEnd":822.4000000953674,"responseStart":822.4000000953674,"secureConnectionStart":222.30000019073486},{"duration":600.5,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2bu7/820016/12ta74/1.0/_/download/batch/jira.webresources:calendar-en/jira.webresources:calendar-en.js","startTime":222.40000009536743,"connectEnd":222.40000009536743,"connectStart":222.40000009536743,"domainLookupEnd":222.40000009536743,"domainLookupStart":222.40000009536743,"fetchStart":222.40000009536743,"redirectEnd":0,"redirectStart":0,"requestStart":222.40000009536743,"responseEnd":822.9000000953674,"responseStart":822.9000000953674,"secureConnectionStart":222.40000009536743},{"duration":600.8000001907349,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2bu7/820016/12ta74/1.0/_/download/batch/jira.webresources:calendar-localisation-moment/jira.webresources:calendar-localisation-moment.js","startTime":222.5,"connectEnd":222.5,"connectStart":222.5,"domainLookupEnd":222.5,"domainLookupStart":222.5,"fetchStart":222.5,"redirectEnd":0,"redirectStart":0,"requestStart":222.5,"responseEnd":823.3000001907349,"responseStart":823.3000001907349,"secureConnectionStart":222.5},{"duration":602.0999999046326,"initiatorType":"link","name":"https://jira.mariadb.org/s/b04b06a02d1959df322d9cded3aeecc1-CDN/lu2bu7/820016/12ta74/a2ff6aa845ffc9a1d22fe23d9ee791fc/_/download/contextbatch/css/jira.global.look-and-feel,-_super/batch.css","startTime":222.60000014305115,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":222.60000014305115,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":824.7000000476837,"responseStart":0,"secureConnectionStart":0},{"duration":602.6000001430511,"initiatorType":"script","name":"https://jira.mariadb.org/rest/api/1.0/shortcuts/820016/47140b6e0a9bc2e4913da06536125810/shortcuts.js?context=issuenavigation&context=issueaction","startTime":222.70000004768372,"connectEnd":222.70000004768372,"connectStart":222.70000004768372,"domainLookupEnd":222.70000004768372,"domainLookupStart":222.70000004768372,"fetchStart":222.70000004768372,"redirectEnd":0,"redirectStart":0,"requestStart":222.70000004768372,"responseEnd":825.3000001907349,"responseStart":824.7000000476837,"secureConnectionStart":222.70000004768372},{"duration":603.2000000476837,"initiatorType":"link","name":"https://jira.mariadb.org/s/3ac36323ba5e4eb0af2aa7ac7211b4bb-CDN/lu2bu7/820016/12ta74/d176f0986478cc64f24226b3d20c140d/_/download/contextbatch/css/com.atlassian.jira.projects.sidebar.init,-_super,-project.issue.navigator,-jira.view.issue/batch.css?jira.create.linked.issue=true","startTime":222.90000009536743,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":222.90000009536743,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":826.1000001430511,"responseStart":0,"secureConnectionStart":0},{"duration":603.0999999046326,"initiatorType":"script","name":"https://jira.mariadb.org/s/3339d87fa2538a859872f2df449bf8d0-CDN/lu2bu7/820016/12ta74/d176f0986478cc64f24226b3d20c140d/_/download/contextbatch/js/com.atlassian.jira.projects.sidebar.init,-_super,-project.issue.navigator,-jira.view.issue/batch.js?jira.create.linked.issue=true&locale=en","startTime":222.90000009536743,"connectEnd":222.90000009536743,"connectStart":222.90000009536743,"domainLookupEnd":222.90000009536743,"domainLookupStart":222.90000009536743,"fetchStart":222.90000009536743,"redirectEnd":0,"redirectStart":0,"requestStart":222.90000009536743,"responseEnd":826,"responseStart":826,"secureConnectionStart":222.90000009536743},{"duration":765.7999999523163,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2bu7/820016/12ta74/1.0/_/download/batch/jira.webresources:bigpipe-js/jira.webresources:bigpipe-js.js","startTime":223.80000019073486,"connectEnd":223.80000019073486,"connectStart":223.80000019073486,"domainLookupEnd":223.80000019073486,"domainLookupStart":223.80000019073486,"fetchStart":223.80000019073486,"redirectEnd":0,"redirectStart":0,"requestStart":223.80000019073486,"responseEnd":989.6000001430511,"responseStart":989.6000001430511,"secureConnectionStart":223.80000019073486},{"duration":990.5,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2bu7/820016/12ta74/1.0/_/download/batch/jira.webresources:bigpipe-init/jira.webresources:bigpipe-init.js","startTime":223.90000009536743,"connectEnd":223.90000009536743,"connectStart":223.90000009536743,"domainLookupEnd":223.90000009536743,"domainLookupStart":223.90000009536743,"fetchStart":223.90000009536743,"redirectEnd":0,"redirectStart":0,"requestStart":223.90000009536743,"responseEnd":1214.4000000953674,"responseStart":1214.4000000953674,"secureConnectionStart":223.90000009536743},{"duration":187.09999990463257,"initiatorType":"xmlhttprequest","name":"https://jira.mariadb.org/rest/webResources/1.0/resources","startTime":801.4000000953674,"connectEnd":801.4000000953674,"connectStart":801.4000000953674,"domainLookupEnd":801.4000000953674,"domainLookupStart":801.4000000953674,"fetchStart":801.4000000953674,"redirectEnd":0,"redirectStart":0,"requestStart":801.4000000953674,"responseEnd":988.5,"responseStart":988.5,"secureConnectionStart":801.4000000953674},{"duration":126.70000004768372,"initiatorType":"link","name":"https://jira.mariadb.org/s/d5715adaadd168a9002b108b2b039b50-CDN/lu2bu7/820016/12ta74/be4b45e9cec53099498fa61c8b7acba4/_/download/contextbatch/css/jira.project.sidebar,-_super,-project.issue.navigator,-jira.general,-jira.browse.project,-jira.view.issue,-jira.global,-atl.general,-com.atlassian.jira.projects.sidebar.init/batch.css?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&slack-enabled=true","startTime":1093.4000000953674,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":1093.4000000953674,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":1220.1000001430511,"responseStart":0,"secureConnectionStart":0},{"duration":312.2000000476837,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2bu7/820016/12ta74/e65b778d185daf5aee24936755b43da6/_/download/contextbatch/js/browser-metrics-plugin.contrib,-_super,-project.issue.navigator,-jira.view.issue,-atl.general/batch.js?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&slack-enabled=true","startTime":1094.2000000476837,"connectEnd":1094.2000000476837,"connectStart":1094.2000000476837,"domainLookupEnd":1094.2000000476837,"domainLookupStart":1094.2000000476837,"fetchStart":1094.2000000476837,"redirectEnd":0,"redirectStart":0,"requestStart":1094.2000000476837,"responseEnd":1406.4000000953674,"responseStart":1406.4000000953674,"secureConnectionStart":1094.2000000476837},{"duration":223.60000014305115,"initiatorType":"script","name":"https://www.google-analytics.com/analytics.js","startTime":1190,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":1190,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":1413.6000001430511,"responseStart":0,"secureConnectionStart":0},{"duration":316.2000000476837,"initiatorType":"script","name":"https://jira.mariadb.org/s/f51ef5507eea4c158f257c66c93b2a3f-CDN/lu2bu7/820016/12ta74/be4b45e9cec53099498fa61c8b7acba4/_/download/contextbatch/js/jira.project.sidebar,-_super,-project.issue.navigator,-jira.general,-jira.browse.project,-jira.view.issue,-jira.global,-atl.general,-com.atlassian.jira.projects.sidebar.init/batch.js?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&locale=en&slack-enabled=true","startTime":1094.7000000476837,"connectEnd":1094.7000000476837,"connectStart":1094.7000000476837,"domainLookupEnd":1094.7000000476837,"domainLookupStart":1094.7000000476837,"fetchStart":1094.7000000476837,"redirectEnd":0,"redirectStart":0,"requestStart":1094.7000000476837,"responseEnd":1410.9000000953674,"responseStart":1410.9000000953674,"secureConnectionStart":1094.7000000476837}],"fetchStart":0,"domainLookupStart":0,"domainLookupEnd":0,"connectStart":0,"connectEnd":0,"requestStart":70,"responseStart":215,"responseEnd":218,"domLoading":218,"domInteractive":1415,"domContentLoadedEventStart":1415,"domContentLoadedEventEnd":1469,"domComplete":2633,"loadEventStart":2633,"loadEventEnd":2635,"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","marks":[{"name":"bigPipe.sidebar-id.start","time":1385.3000001907349},{"name":"bigPipe.sidebar-id.end","time":1386.3000001907349},{"name":"bigPipe.activity-panel-pipe-id.start","time":1387.1000001430511},{"name":"bigPipe.activity-panel-pipe-id.end","time":1390.3000001907349},{"name":"activityTabFullyLoaded","time":1481.3000001907349}],"measures":[],"correlationId":"2f042599728a8c","effectiveType":"4g","downlink":9.9,"rtt":0,"serverDuration":74,"dbReadsTimeInMs":11,"dbConnsTimeInMs":17,"applicationHash":"9d11dbea5f4be3d4cc21f03a88dd11d8c8687422","experiments":[]}}