[MDEV-20947] Use GRANT ... TO PUBLIC for default test database privileges Created: 2019-11-01  Updated: 2023-08-07  Resolved: 2022-11-04

Status: Closed
Project: MariaDB Server
Component/s: Authentication and Privilege System, Scripts & Clients
Fix Version/s: 10.11.1

Type: Task Priority: Critical
Reporter: Geoff Montee (Inactive) Assignee: Oleksandr Byelkin
Resolution: Fixed Votes: 0
Labels: None

Issue Links:
Blocks
blocks MDEV-20259 mysql_secure_installation should use ... Open
is blocked by MDEV-5215 Granted to PUBLIC Closed
Relates
relates to MDEV-13486 Make mysql_install_db create a real '... Closed

 Description   

Currently, mysql_install_db provides default access to the test database by inserting some rows into the mysql.db table for the ''@'%' user account, but it does not insert any rows into the mysql.user table for that user account.

These rows are currently inserted by the scripts/mysql_test_db.sql script:

https://github.com/MariaDB/server/blob/mariadb-10.4.8/scripts/mysql_test_db.sql#L18

This method has some negative consequences. See MDEV-13486 for more information.

If we implement GRANT ... TO PUBLIC, then we should change mysql_install_db, so that mysql_install_db uses that instead.

i.e.:

GRANT ALL PRIVILEGES ON `test`.* TO PUBLIC;
GRANT ALL PRIVILEGES ON `test\_%`.* TO PUBLIC;

Note: this comes with a subtle change in behavior. Currently, the way MariaDB/MySQL privilege system works, if one is explicitly granted any privilege on test db, it'll mask anonymous privileges. In other words, some joe@host user has full access to test database by default. But after, for example,

GRANT SELECT ON test.* to joe@host

He'll have only SELECT privilege, losing everything else.

After this task is implemented and access to test will be granted to PUBLIC, the above behavior will go away, granting privileges will not cause existing privileges to disappear.

Also, SHOW GRANTS will show PUBLIC privileges on test, while it was not doing that before.


Generated at Thu Feb 08 09:03:26 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.