[MDEV-24815] Add 'allow-suspicious-udfs' and 'skip-grant-tables' to system variables Created: 2021-02-09  Updated: 2022-05-26  Resolved: 2022-05-26

Status: Closed
Project: MariaDB Server
Component/s: Configuration, Information Schema
Affects Version/s: 10.5.8
Fix Version/s: 10.10.0

Type: Bug Priority: Minor
Reporter: Hartmut Holzgraefe Assignee: Daniel Black
Resolution: Fixed Votes: 1
Labels: beginner-friendly

Issue Links:
Relates
relates to MDEV-28672 Several server options / settings sti... Open

 Description   

E.g. the actual used values of allow-suspicious-udfs and skip-grant-tables can't be seen in SHOW GLOBAL VARIABLES output, and are not listed in INFORMATION_SCHEMA.SYSTEM_VARIABLES either.

As both of these settings have security implications it should be possible to see their current value from the SQL level though, for audit / secure configuration check purposes.

Especially with the now added GLOBAL_VALUE_ORIGIN and GLOBAL_VALUE_PATH information in I_S SYSTEM_VARIABLES, every setting that can be done via command line or my.cnf should actually be visible in SYSTEM_VARIABLES ...?



 Comments   
Comment by Ankita Mahavir Vaid [ 2021-02-09 ]

Hii, I have used MariaDB . Can I work on this issue? I am interested in doing it.

Comment by Sergei Golubchik [ 2021-02-10 ]

Sure! Thanks!

Comment by Tingyao Nian [ 2022-05-13 ]

Seems there has been no progress for a year, I will take a stab at this.

Comment by Tingyao Nian [ 2022-05-19 ]

Pull request created for this Jira: https://github.com/MariaDB/server/pull/2122

Comment by Hartmut Holzgraefe [ 2022-05-22 ]

List of command line options in 10.8 --help --verbose output for which no corresponding variable exists in SHOW VARIABLES output. Some of these are obviously false positives, like the --binlog... ones that are covered in SHOW SLAVE STATUS instead, or --plugin-node, to name just a few, but there are obviously also valid entries like --allow-suspicious-udfs and --aria-log-dir-path:

--allow-suspicious-udfs
--aria-log-dir-path
--binlog-do-db
--binlog-ignore-db
--binlog-row-event-max-size
--bootstrap
--character-set-client-handshake
--console
--debug-abort-slave-event-count
--debug-disconnect-slave-event-count
--debug-gdb
--debug-max-binlog-dump-events
--debug-no-sync
--debug-sporadic-binlog-dump-fail
--default-time-zone
--des-key-file
--external-locking
--feedback
--feedback-http-proxy
--feedback-send-retry-wait
--feedback-send-timeout
--feedback-url
--feedback-user-info
--flashback
--gdb
--getopt-prefix-matching
--init-rpl-role
--innodb
--innodb-buffer-page
--innodb-buffer-page-lru
--innodb-buffer-pool-stats
--innodb-cmp
--innodb-cmp-per-index
--innodb-cmp-per-index-reset
--innodb-cmp-reset
--innodb-cmpmem
--innodb-cmpmem-reset
--innodb-ft-being-deleted
--innodb-ft-config
--innodb-ft-default-stopword
--innodb-ft-deleted
--innodb-ft-index-cache
--innodb-ft-index-table
--innodb-lock-waits
--innodb-locks
--innodb-metrics
--innodb-status-file
--innodb-sys-columns
--innodb-sys-fields
--innodb-sys-foreign
--innodb-sys-foreign-cols
--innodb-sys-indexes
--innodb-sys-tables
--innodb-sys-tablespaces
--innodb-sys-tablestats
--innodb-sys-virtual
--innodb-tablespaces-encryption
--innodb-trx
--log-basename
--log-ddl-recovery
--log-isam
--log-short-format
--log-tc
--master-info-file
--master-retry-count
--memlock
--old-style-user-limits
--partition
--performance-schema-consumer-events-stages-current
--performance-schema-consumer-events-stages-history
--performance-schema-consumer-events-stages-history-long
--performance-schema-consumer-events-statements-current
--performance-schema-consumer-events-statements-history
--performance-schema-consumer-events-statements-history-long
--performance-schema-consumer-events-transactions-current
--performance-schema-consumer-events-transactions-history
--performance-schema-consumer-events-transactions-history-long
--performance-schema-consumer-events-waits-current
--performance-schema-consumer-events-waits-history
--performance-schema-consumer-events-waits-history-long
--performance-schema-consumer-global-instrumentation
--performance-schema-consumer-statements-digest
--performance-schema-consumer-thread-instrumentation
--performance-schema-instrument
--plugin-load
--plugin-load-add
--port-open-timeout
--replicate-rewrite-db
--replicate-same-server-id
--safe-mode
--safe-user-create
--sequence
--show-slave-auth-info
--silent-startup
--skip-grant-tables
--skip-host-cache
--skip-slave-start
--ssl
--stack-trace
--sysdate-is-now
--table-cache
--tc-heuristic-recover
--temp-pool
--thread-pool-groups
--thread-pool-queues
--thread-pool-stats
--thread-pool-waits
--transaction-isolation
--transaction-read-only
--unix-socket
--user-variables
--wsrep-new-cluster

Quick&dirty shell code used to produce the output above:

( for a in $(mysqld --help --verbose 2>&1 | egrep -o "^  --[a-zA-Z0-9_-]+" | sed -e "s/  --//g" -e "s/-/_/g"); do echo -n "$a---"; mysql -e "show variables like '$a';" | grep -i "$a" ; echo; done  ) | egrep "^[a-zA-Z0-9_-]+$" | sed -e 's/---$//g' -e's/^/--/g' -e's/_/-/g'

Comment by Daniel Black [ 2022-05-25 ]

hholzgra I'm inclined to accept the PR as is and then clone this for the remaining options. Do you think you could apply some grouping/prioritization to the remaining entries?

Comment by Hartmut Holzgraefe [ 2022-05-25 ]

The following enable/disable builtin plugins, effects can be seen in SHOW PLUGINS output, so no extra variables needed for these:

plugin-load
plugin-load-add
--
feedback
innodb
innodb-buffer-page
innodb-buffer-page-lru
innodb-buffer-pool-stats
innodb-cmp
innodb-cmp-per-index
innodb-cmp-per-index-reset
innodb-cmp-reset
innodb-cmpmem
innodb-cmpmem-reset
innodb-ft-being-deleted
innodb-ft-config
innodb-ft-default-stopword
innodb-ft-deleted
innodb-ft-index-cache
innodb-ft-index-table
innodb-lock-waits
innodb-locks
innodb-metrics
innodb-sys-columns
innodb-sys-fields
innodb-sys-foreign
innodb-sys-foreign-cols
innodb-sys-indexes
innodb-sys-tables
innodb-sys-tablespaces
innodb-sys-tablestats
innodb-sys-virtual
innodb-tablespaces-encryption
innodb-trx
partition
sequence
thread-pool-groups
thread-pool-queues
thread-pool-stats
thread-pool-waits
unix-socket
user-variables

to be continued ...

Comment by Hartmut Holzgraefe [ 2022-05-25 ]

The following are either aliases for other options, or meta-options that set several other option values at once:

default-time-zone,,maps to time_zone variable
external-locking,,is actually skip-internal-locking in SHOW VARIABLES
flashback,,"meta-option, sets multiple other options"
gdb,,deprecated alias for debug-gdb
log-basename,,"meta-option, sets multiple other options"
table-cache,,alias for table-open-cache

Comment by Hartmut Holzgraefe [ 2022-05-25 ]

The following are always present as command line options, but only in SHOW VARIABLES when the feedback plugin is actually activated:

feedback-http-proxy
feedback-send-retry-wait
feedback-send-timeout
feedback-url
feedback-user-info

No real action needed on these

Comment by Hartmut Holzgraefe [ 2022-05-25 ]

Performance schema settings can probably be ignored:

performance-schema-consumer-events-stages-current,,
performance-schema-consumer-events-stages-history,,
performance-schema-consumer-events-stages-history-long,,
performance-schema-consumer-events-statements-current,,
performance-schema-consumer-events-statements-history,,
performance-schema-consumer-events-statements-history-long,,
performance-schema-consumer-events-transactions-current,,
performance-schema-consumer-events-transactions-history,,
performance-schema-consumer-events-transactions-history-long,,
performance-schema-consumer-events-waits-current,,
performance-schema-consumer-events-waits-history,,
performance-schema-consumer-events-waits-history-long,,
performance-schema-consumer-global-instrumentation,,
performance-schema-consumer-statements-digest,,
performance-schema-consumer-thread-instrumentation,,
performance-schema-instrument,,

Comment by Hartmut Holzgraefe [ 2022-05-25 ]

debug / testing options:

debug-abort-slave-event-count
debug-disconnect-slave-event-count
debug-gdb
debug-max-binlog-dump-events
debug-no-sync
debug-sporadic-binlog-dump-fail
safe-mode

Comment by Hartmut Holzgraefe [ 2022-05-25 ]

Replication related options

binlog-do-db
binlog-ignore-db
binlog-row-event-max-size
master-info-file
master-retry-count
replicate-rewrite-db
replicate-same-server-id
show-slave-auth-info
skip-slave-start

Comment by Hartmut Holzgraefe [ 2022-05-25 ]

Bootstrap options, at least "bootstrap" and "skip-grant-tables" might be of interest, esp. the later one, as a server should not be running for log with that one enabled. That one should definitely be testable from SQL level. wsrep_new_cluster and getopt-prefix-matching do not affect server behavior after startup, and so are of no real interest at SQL level.

bootstrap
console
getopt-prefix-matching
wsrep-new-cluster
skip-grant-tables

Comment by Hartmut Holzgraefe [ 2022-05-25 ]

Unclear and deprecated cases:

character-set-client-handshake -- only documented on MySQL side: https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_character-set-client-handshake
init-rpl-role -- unused?, was removed upstream long ago: https://bugs.mysql.com/bug.php?id=54649
log-short-format -- not sure yet, seems to be missing from KB page on server options, and Enterprise docs only have the usual useless stub
port-open-timeout -- not sure yet, seems to be missing from KB page on server options, and Enterprise docs only have the usual useless stub
temp-pool -- deprecated, so probably not worth handling

Comment by Hartmut Holzgraefe [ 2022-05-25 ]

Remaining cases that seem to be valid, and do not fit into other categories above:

allow-suspicious-udfs
aria-log-dir-path
des-key-file
innodb-status-file
log-ddl-recovery
log-isam
log-tc
memlock
old-style-user-limits,,
safe-user-create
silent-startup
skip-host-cache
ssl
stack-trace
sysdate-is-now
tc-heuristic-recover
transaction-isolation
transaction-read-only

Comment by Daniel Black [ 2022-05-26 ]

Thanks Tingynia for the contribution for the first part.

Thanks hholzgra for clarifying the rest that I've hopefully paraphrased correctly in MDEV-28672.

Generated at Thu Feb 08 09:32:52 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.