[MDEV-30484] user@ip can query tables where user@'%' can access to. Created: 2023-01-27  Updated: 2023-02-10  Resolved: 2023-01-27

Status: Closed
Project: MariaDB Server
Component/s: Authentication and Privilege System
Affects Version/s: 10.3, 10.4, 10.5, 10.6
Fix Version/s: N/A

Type: Bug Priority: Major
Reporter: Richard Stracke Assignee: Sergei Golubchik
Resolution: Not a Bug Votes: 0
Labels: None


 Description   

create database sbtest;
 
use sbtest;
 
create table sbtest1 (id int);
insert into sbtest1 (id) values(1);
 
create table sbtest4 (id int);
insert into sbtest4 (id) values(1)

CREATE USER mtest@'%' IDENTIFIED BY 'Mtest1234!' ;
GRANT SELECT on sbtest.sbtest1 TO mtest@'%' ;
 
CREATE USER mtest@'x.x.x.x' IDENTIFIED BY 'Mtest5678!' ;
GRANT SELECT on sbtest.sbtest4 TO mtest@'x.x.x.x' ;

So user mtest@'x.x.x.x' can access to table sbtest.sbtest1 where
he have no permissiom.

MariaDB [mysql]> select * from tables_priv;
+------------+--------+-------------+-------------+-----------------+---------------------+---------------+-------------+
| Host       | Db     | User        | Table_name  | Grantor         | Timestamp           | Table_priv    | Column_priv |
+------------+--------+-------------+-------------+-----------------+---------------------+---------------+-------------+
| localhost  | mysql  | mariadb.sys | global_priv | root@localhost  | 0000-00-00 00:00:00 | Select,Delete |             |
| %          | sbtest | mtest       | sbtest1     | root@172.17.0.1 | 0000-00-00 00:00:00 | Select        |             |
| 172.17.0.1 | sbtest | mtest       | sbtest4     | root@172.17.0.1 | 0000-00-00 00:00:00 | Select        |             |
+------------+--------+-------------+-------------+-----------------+---------------------+---------------+-------------+
3 rows in set (0,001 sec)
 
MariaDB [(none)]> select user(), current_user() ;
+------------------+------------------+
| user()           | current_user()   |
+------------------+------------------+
| mtest@172.17.0.1 | mtest@172.17.0.1 |
+------------------+------------------+
1 row in set (0,000 sec)
 
MariaDB [(none)]> select * from sbtest.sbtest1;
+------+
| id   |
+------+
|    1 |
+------+
1 row in set (0,000 sec)



 Comments   
Comment by Sergei Golubchik [ 2023-01-27 ]

This works as designed, it's not a bug.

It's a bit counterintuitive nowadays, but it's how it always worked for the last 30 years and such behavior is very difficult to change.

When you access the table, the server searches tables_priv table. It find a matching row with table_name="sbtest1" and user="sbtest" and host="%" (which matches any host). Thus, the access is granted.

Generated at Thu Feb 08 10:16:35 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.