[MDEV-19276] If login fails when selecting a database, no warning is printed to the log with log_warnings=2 Created: 2019-04-17 Updated: 2020-08-25 Resolved: 2019-04-28 |
|
| Status: | Closed |
| Project: | MariaDB Server |
| Component/s: | Authentication and Privilege System |
| Affects Version/s: | 10.1.38, 10.2.23, 10.3.14 |
| Fix Version/s: | 10.2.24, 10.1.39, 10.3.15, 10.4.5 |
| Type: | Bug | Priority: | Major |
| Reporter: | Geoff Montee (Inactive) | Assignee: | Vladislav Vaintroub |
| Resolution: | Fixed | Votes: | 0 |
| Labels: | None | ||
| Issue Links: |
|
||||||||||||
| Description |
|
When log_warnings is set to 2 or greater, most login failures are logged to the error log. One exception currently seems to be the case where, if a database is selected during the login and if the user can't actually select that database, then their login will fail, but no warning will be printed to the log. To reproduce, simply create a user account with no privileges:
And ensure that log_warnings is set to 2 or above:
Then try to login as this user while selecting a database that they can't use:
No warning will be printed to the log. The root cause seems to be that if this section of code encounters an error: https://github.com/MariaDB/server/blob/mariadb-10.1.38/sql/sql_acl.cc#L12687 Then it does not call the login_failed_error function: https://github.com/MariaDB/server/blob/mariadb-10.1.38/sql/sql_acl.cc#L11272 This case actually has its own error code:
https://mariadb.com/kb/en/library/mariadb-error-codes/ We might need to update the login_failed_error and access_denied_error_code functions to support this error code as well. https://github.com/MariaDB/server/blob/mariadb-10.1.38/sql/sql_acl.h#L190 The only way to currently see a warning in the error log in this case is to set log_warnings=4. At that point, you'll see a warning like this:
But I think it should actually log a warning like this when log_warnings=2 is set instead:
|
| Comments |
| Comment by Vladislav Vaintroub [ 2019-04-24 ] | ||||||||||||||||||||||
|
There can be several reasons why selecting database may fail (non-existing database name for example). I think only ER_DBACCESS_DENIED_ERROR would fit into "access denied" category, and thus should be handled as other access-denieds | ||||||||||||||||||||||
| Comment by Geoff Montee (Inactive) [ 2019-04-24 ] | ||||||||||||||||||||||
|
Good point. Currently, MariaDB does raise ER_DBACCESS_DENIED_ERROR if the named database doesn't exist. Would you consider that a bug too? For example:
| ||||||||||||||||||||||
| Comment by Vladislav Vaintroub [ 2019-04-24 ] | ||||||||||||||||||||||
|
I only read code, I did not try it |