[MDEV-23820] access denied for GRANT PROXY for all privs user Created: 2020-09-25  Updated: 2020-09-30  Resolved: 2020-09-30

Status: Closed
Project: MariaDB Server
Component/s: Authentication and Privilege System
Affects Version/s: 10.2.34
Fix Version/s: N/A

Type: Bug Priority: Major
Reporter: Daniel Black Assignee: Unassigned
Resolution: Not a Bug Votes: 0
Labels: None

Attachments: File dump1.sql    

 Description   

10.2-c710c450e3a5654244fffaabcb4ba5af2dd24dd9

Server version: 10.2.34-MariaDB Source distribution
 
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
 
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
 
MariaDB [(none)]> show create user;
+-----------------------------------------------------------------------------------------------------------+
| CREATE USER for mariadb_test_restore@%                                                                    |
+-----------------------------------------------------------------------------------------------------------+
| CREATE USER 'mariadb_test_restore'@'%' IDENTIFIED BY PASSWORD '*31B0F6BDDC1774AE174CCB881C3E73B8404679DB' |
+-----------------------------------------------------------------------------------------------------------+
1 row in set (0.00 sec)
 
MariaDB [(none)]> show grants;
+------------------------------------------------------------------------------------------------------------------------------------------------+
| Grants for mariadb_test_restore@%                                                                                                              |
+------------------------------------------------------------------------------------------------------------------------------------------------+
| GRANT ALL PRIVILEGES ON *.* TO 'mariadb_test_restore'@'%' IDENTIFIED BY PASSWORD '*31B0F6BDDC1774AE174CCB881C3E73B8404679DB' WITH GRANT OPTION |
| GRANT ALL PRIVILEGES ON `mysql`.* TO 'mariadb_test_restore'@'%'                                                                                |
+------------------------------------------------------------------------------------------------------------------------------------------------+
2 rows in set (0.00 sec)
 
MariaDB [(none)]> show create user root@localhost;
+--------------------------------+
| CREATE USER for root@localhost |
+--------------------------------+
| CREATE USER 'root'@'localhost' |
+--------------------------------+
1 row in set (0.00 sec)
 
MariaDB [(none)]> show grants for root@localhost;
+---------------------------------------------------------------------+
| Grants for root@localhost                                           |
+---------------------------------------------------------------------+
| GRANT role_1 TO 'root'@'localhost' WITH ADMIN OPTION                |
| GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' WITH GRANT OPTION |
+---------------------------------------------------------------------+
2 rows in set (0.00 sec)
 
MariaDB [(none)]> Bye
[dan@linux build-mariadb-server-10.2]$ mc -u mariadb_test_restore -pgetitback <  /home/dan/repos/build-mariadb-server-10.2/mysql-test/var/tmp/dump1.sql
ERROR 1698 (28000) at line 24: Access denied for user 'mariadb_test_restore'@'localhost'

dump1.sql

-- MySQL dump 10.16  Distrib 10.2.34-MariaDB, for Linux (x86_64)
--
-- Host: localhost    Database: 
-- ------------------------------------------------------
-- Server version	10.2.34-MariaDB-log
 
/*!40101 SET @OLD_CHARACTER_SET_CLIENT=@@CHARACTER_SET_CLIENT */;
/*!40101 SET @OLD_CHARACTER_SET_RESULTS=@@CHARACTER_SET_RESULTS */;
/*!40101 SET @OLD_COLLATION_CONNECTION=@@COLLATION_CONNECTION */;
/*!40101 SET NAMES utf8 */;
/*!40103 SET @OLD_TIME_ZONE=@@TIME_ZONE */;
/*!40103 SET TIME_ZONE='+00:00' */;
/*!40014 SET @OLD_UNIQUE_CHECKS=@@UNIQUE_CHECKS, UNIQUE_CHECKS=0 */;
/*!40014 SET @OLD_FOREIGN_KEY_CHECKS=@@FOREIGN_KEY_CHECKS, FOREIGN_KEY_CHECKS=0 */;
/*!40101 SET @OLD_SQL_MODE=@@SQL_MODE, SQL_MODE='NO_AUTO_VALUE_ON_ZERO' */;
/*!40111 SET @OLD_SQL_NOTES=@@SQL_NOTES, SQL_NOTES=0 */;
CREATE /*M!100103 OR REPLACE */ USER 'root'@'localhost';
CREATE /*M!100103 OR REPLACE */ USER 'bob'@'%';
CREATE /*M!100103 OR REPLACE */ USER 'root'@'127.0.0.1';
CREATE /*M!100103 OR REPLACE */ USER 'root'@'::1';
/*M!100103 CREATE OR REPLACE ROLE 'role_1' WITH ADMIN 'root'@'localhost' */;
/*M!100103 CREATE OR REPLACE ROLE 'role_2' WITH ADMIN 'role_1' */;
GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' WITH GRANT OPTION;
GRANT PROXY ON ''@'%' TO 'root'@'localhost' WITH GRANT OPTION;



 Comments   
Comment by Elena Stepanova [ 2020-09-30 ]

PROXY is a separate option, not a part of "ALL". Like this:

MariaDB [test]> show grants;
+---------------------------------------------------------------------+
| Grants for root@localhost                                           |
+---------------------------------------------------------------------+
| GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' WITH GRANT OPTION |
| GRANT PROXY ON ''@'%' TO 'root'@'localhost' WITH GRANT OPTION       |
+---------------------------------------------------------------------+
2 rows in set (0.000 sec)

https://mariadb.com/kb/en/grant/#proxy-privileges

Comment by Daniel Black [ 2020-09-30 ]

Thanks elenst

Generated at Thu Feb 08 09:25:17 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.