Skip to content

Commit b602584

Browse files
abarkovabarkov
committed
MDEV-21957 Bind BINLOG ADMIN to @@binlog_format, @@binlog_direct_.., @@sql_log_bin
1 parent c7ba923 commit b602584

14 files changed

+347
-19
lines changed

‎mysql-test/main/grant2.result

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -162,7 +162,7 @@ connection con10;
162162
set sql_log_off = 1;
163163
ERROR 42000: Access denied; you need (at least one of) the SUPER privilege(s) for this operation
164164
set sql_log_bin = 0;
165-
ERROR 42000: Access denied; you need (at least one of) the SUPER privilege(s) for this operation
165+
ERROR 42000: Access denied; you need (at least one of) the SUPER, BINLOG ADMIN privilege(s) for this operation
166166
disconnect con10;
167167
connection default;
168168
delete from mysql.user where user like 'mysqltest\_1';

‎mysql-test/suite/binlog/r/binlog_grant.result

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ set session sql_log_bin = 1;
1414
connection plain;
1515
[plain]
1616
set session sql_log_bin = 1;
17-
ERROR 42000: Access denied; you need (at least one of) the SUPER privilege(s) for this operation
17+
ERROR 42000: Access denied; you need (at least one of) the SUPER, BINLOG ADMIN privilege(s) for this operation
1818
**** Variable BINLOG_FORMAT ****
1919
connection root;
2020
[root]
@@ -23,9 +23,9 @@ set session binlog_format = row;
2323
connection plain;
2424
[plain]
2525
set global binlog_format = row;
26-
ERROR 42000: Access denied; you need (at least one of) the SUPER privilege(s) for this operation
26+
ERROR 42000: Access denied; you need (at least one of) the SUPER, BINLOG ADMIN privilege(s) for this operation
2727
set session binlog_format = row;
28-
ERROR 42000: Access denied; you need (at least one of) the SUPER privilege(s) for this operation
28+
ERROR 42000: Access denied; you need (at least one of) the SUPER, BINLOG ADMIN privilege(s) for this operation
2929
**** Clean up ****
3030
disconnect plain;
3131
disconnect root;

‎mysql-test/suite/rpl/r/rpl_temporary.result

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ SELECT @@session.sql_select_limit = @save_select_limit;
4545
@@session.sql_select_limit = @save_select_limit
4646
1
4747
SET @@session.sql_select_limit=10, @@session.sql_log_bin=0;
48-
ERROR 42000: Access denied; you need (at least one of) the SUPER privilege(s) for this operation
48+
ERROR 42000: Access denied; you need (at least one of) the SUPER, BINLOG ADMIN privilege(s) for this operation
4949
SELECT @@session.sql_select_limit = @save_select_limit;
5050
@@session.sql_select_limit = @save_select_limit
5151
1

‎mysql-test/suite/sys_vars/r/binlog_direct_non_transactional_updates_grant.result

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
SET @global= @@global.binlog_direct_non_transactional_updates;
2+
SET @session= @@global.binlog_direct_non_transactional_updates;
3+
#
4+
#
5+
#
6+
# Test that "SET binlog_direct_non_transactional_updates" is not allowed without BINLOG ADMIN or SUPER
7+
CREATE USER user1@localhost;
8+
GRANT ALL PRIVILEGES ON *.* TO user1@localhost;
9+
REVOKE BINLOG ADMIN, SUPER ON *.* FROM user1@localhost;
10+
connect user1,localhost,user1,,;
11+
connection user1;
12+
SET binlog_direct_non_transactional_updates=0;
13+
ERROR 42000: Access denied; you need (at least one of) the SUPER, BINLOG ADMIN privilege(s) for this operation
14+
SET GLOBAL binlog_direct_non_transactional_updates=0;
15+
ERROR 42000: Access denied; you need (at least one of) the SUPER, BINLOG ADMIN privilege(s) for this operation
16+
SET SESSION binlog_direct_non_transactional_updates=0;
17+
ERROR 42000: Access denied; you need (at least one of) the SUPER, BINLOG ADMIN privilege(s) for this operation
18+
disconnect user1;
19+
connection default;
20+
DROP USER user1@localhost;
21+
# Test that "SET binlog_direct_non_transactional_updates" is allowed with BINLOG ADMIN
22+
CREATE USER user1@localhost;
23+
GRANT BINLOG ADMIN ON *.* TO user1@localhost;
24+
connect user1,localhost,user1,,;
25+
connection user1;
26+
SET binlog_direct_non_transactional_updates=0;
27+
SET GLOBAL binlog_direct_non_transactional_updates=0;
28+
SET SESSION binlog_direct_non_transactional_updates=0;
29+
disconnect user1;
30+
connection default;
31+
DROP USER user1@localhost;
32+
# Test that "SET binlog_direct_non_transactional_updates" is allowed with SUPER
33+
CREATE USER user1@localhost;
34+
GRANT SUPER ON *.* TO user1@localhost;
35+
connect user1,localhost,user1,,;
36+
connection user1;
37+
SET binlog_direct_non_transactional_updates=0;
38+
SET GLOBAL binlog_direct_non_transactional_updates=0;
39+
SET SESSION binlog_direct_non_transactional_updates=0;
40+
disconnect user1;
41+
connection default;
42+
DROP USER user1@localhost;
43+
SET GLOBAL binlog_direct_non_transactional_updates=@global;
44+
SET SESSION binlog_direct_non_transactional_updates=@session;

‎mysql-test/suite/sys_vars/r/binlog_format_grant.result

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
#
2+
#
3+
#
4+
# Test that "SET binlog_format" is not allowed without BINLOG ADMIN or SUPER
5+
CREATE USER user1@localhost;
6+
GRANT ALL PRIVILEGES ON *.* TO user1@localhost;
7+
REVOKE BINLOG ADMIN, SUPER ON *.* FROM user1@localhost;
8+
connect user1,localhost,user1,,;
9+
connection user1;
10+
SET binlog_format=mixed;
11+
ERROR 42000: Access denied; you need (at least one of) the SUPER, BINLOG ADMIN privilege(s) for this operation
12+
SET GLOBAL binlog_format=mixed;
13+
ERROR 42000: Access denied; you need (at least one of) the SUPER, BINLOG ADMIN privilege(s) for this operation
14+
SET SESSION binlog_format=mixed;
15+
ERROR 42000: Access denied; you need (at least one of) the SUPER, BINLOG ADMIN privilege(s) for this operation
16+
disconnect user1;
17+
connection default;
18+
DROP USER user1@localhost;
19+
# Test that "SET binlog_format" is allowed with BINLOG ADMIN
20+
CREATE USER user1@localhost;
21+
GRANT BINLOG ADMIN ON *.* TO user1@localhost;
22+
connect user1,localhost,user1,,;
23+
connection user1;
24+
SET binlog_format=mixed;
25+
SET GLOBAL binlog_format=mixed;
26+
SET SESSION binlog_format=mixed;
27+
disconnect user1;
28+
connection default;
29+
DROP USER user1@localhost;
30+
# Test that "SET binlog_format" is allowed with SUPER
31+
CREATE USER user1@localhost;
32+
GRANT SUPER ON *.* TO user1@localhost;
33+
connect user1,localhost,user1,,;
34+
connection user1;
35+
SET binlog_format=mixed;
36+
SET GLOBAL binlog_format=mixed;
37+
SET SESSION binlog_format=mixed;
38+
disconnect user1;
39+
connection default;
40+
DROP USER user1@localhost;

‎mysql-test/suite/sys_vars/r/sql_log_bin_grant.result

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
#
2+
#
3+
#
4+
# Test that "SET sql_log_bin" is not allowed without BINLOG ADMIN or SUPER
5+
CREATE USER user1@localhost;
6+
GRANT ALL PRIVILEGES ON *.* TO user1@localhost;
7+
REVOKE BINLOG ADMIN, SUPER ON *.* FROM user1@localhost;
8+
connect user1,localhost,user1,,;
9+
connection user1;
10+
SET sql_log_bin=1;
11+
ERROR 42000: Access denied; you need (at least one of) the SUPER, BINLOG ADMIN privilege(s) for this operation
12+
SET GLOBAL sql_log_bin=1;
13+
ERROR 42000: Access denied; you need (at least one of) the SUPER, BINLOG ADMIN privilege(s) for this operation
14+
SET SESSION sql_log_bin=1;
15+
ERROR 42000: Access denied; you need (at least one of) the SUPER, BINLOG ADMIN privilege(s) for this operation
16+
disconnect user1;
17+
connection default;
18+
DROP USER user1@localhost;
19+
# Test that "SET sql_log_bin" is allowed with BINLOG ADMIN
20+
CREATE USER user1@localhost;
21+
GRANT BINLOG ADMIN ON *.* TO user1@localhost;
22+
connect user1,localhost,user1,,;
23+
connection user1;
24+
SET sql_log_bin=1;
25+
SET GLOBAL sql_log_bin=1;
26+
ERROR HY000: Variable 'sql_log_bin' is a SESSION variable
27+
SET SESSION sql_log_bin=1;
28+
disconnect user1;
29+
connection default;
30+
DROP USER user1@localhost;
31+
# Test that "SET sql_log_bin" is allowed with SUPER
32+
CREATE USER user1@localhost;
33+
GRANT SUPER ON *.* TO user1@localhost;
34+
connect user1,localhost,user1,,;
35+
connection user1;
36+
SET sql_log_bin=1;
37+
SET GLOBAL sql_log_bin=1;
38+
ERROR HY000: Variable 'sql_log_bin' is a SESSION variable
39+
SET SESSION sql_log_bin=1;
40+
disconnect user1;
41+
connection default;
42+
DROP USER user1@localhost;

‎mysql-test/suite/sys_vars/t/binlog_direct_non_transactional_updates_grant.test

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
source include/have_log_bin.inc;
2+
3+
SET @global= @@global.binlog_direct_non_transactional_updates;
4+
SET @session= @@global.binlog_direct_non_transactional_updates;
5+
6+
7+
--echo #
8+
--echo #
9+
--echo #
10+
11+
--echo # Test that "SET binlog_direct_non_transactional_updates" is not allowed without BINLOG ADMIN or SUPER
12+
13+
CREATE USER user1@localhost;
14+
GRANT ALL PRIVILEGES ON *.* TO user1@localhost;
15+
REVOKE BINLOG ADMIN, SUPER ON *.* FROM user1@localhost;
16+
--connect(user1,localhost,user1,,)
17+
--connection user1
18+
--error ER_SPECIFIC_ACCESS_DENIED_ERROR
19+
SET binlog_direct_non_transactional_updates=0;
20+
--error ER_SPECIFIC_ACCESS_DENIED_ERROR
21+
SET GLOBAL binlog_direct_non_transactional_updates=0;
22+
--error ER_SPECIFIC_ACCESS_DENIED_ERROR
23+
SET SESSION binlog_direct_non_transactional_updates=0;
24+
--disconnect user1
25+
--connection default
26+
DROP USER user1@localhost;
27+
28+
--echo # Test that "SET binlog_direct_non_transactional_updates" is allowed with BINLOG ADMIN
29+
30+
CREATE USER user1@localhost;
31+
GRANT BINLOG ADMIN ON *.* TO user1@localhost;
32+
--connect(user1,localhost,user1,,)
33+
--connection user1
34+
SET binlog_direct_non_transactional_updates=0;
35+
SET GLOBAL binlog_direct_non_transactional_updates=0;
36+
SET SESSION binlog_direct_non_transactional_updates=0;
37+
--disconnect user1
38+
--connection default
39+
DROP USER user1@localhost;
40+
41+
--echo # Test that "SET binlog_direct_non_transactional_updates" is allowed with SUPER
42+
43+
CREATE USER user1@localhost;
44+
GRANT SUPER ON *.* TO user1@localhost;
45+
--connect(user1,localhost,user1,,)
46+
--connection user1
47+
SET binlog_direct_non_transactional_updates=0;
48+
SET GLOBAL binlog_direct_non_transactional_updates=0;
49+
SET SESSION binlog_direct_non_transactional_updates=0;
50+
--disconnect user1
51+
--connection default
52+
DROP USER user1@localhost;
53+
54+
55+
SET GLOBAL binlog_direct_non_transactional_updates=@global;
56+
SET SESSION binlog_direct_non_transactional_updates=@session;

‎mysql-test/suite/sys_vars/t/binlog_format_grant.test

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
source include/have_log_bin.inc;
2+
3+
4+
--echo #
5+
--echo #
6+
--echo #
7+
8+
--echo # Test that "SET binlog_format" is not allowed without BINLOG ADMIN or SUPER
9+
10+
CREATE USER user1@localhost;
11+
GRANT ALL PRIVILEGES ON *.* TO user1@localhost;
12+
REVOKE BINLOG ADMIN, SUPER ON *.* FROM user1@localhost;
13+
--connect(user1,localhost,user1,,)
14+
--connection user1
15+
--error ER_SPECIFIC_ACCESS_DENIED_ERROR
16+
SET binlog_format=mixed;
17+
--error ER_SPECIFIC_ACCESS_DENIED_ERROR
18+
SET GLOBAL binlog_format=mixed;
19+
--error ER_SPECIFIC_ACCESS_DENIED_ERROR
20+
SET SESSION binlog_format=mixed;
21+
--disconnect user1
22+
--connection default
23+
DROP USER user1@localhost;
24+
25+
--echo # Test that "SET binlog_format" is allowed with BINLOG ADMIN
26+
27+
CREATE USER user1@localhost;
28+
GRANT BINLOG ADMIN ON *.* TO user1@localhost;
29+
--connect(user1,localhost,user1,,)
30+
--connection user1
31+
SET binlog_format=mixed;
32+
SET GLOBAL binlog_format=mixed;
33+
SET SESSION binlog_format=mixed;
34+
--disconnect user1
35+
--connection default
36+
DROP USER user1@localhost;
37+
38+
--echo # Test that "SET binlog_format" is allowed with SUPER
39+
40+
CREATE USER user1@localhost;
41+
GRANT SUPER ON *.* TO user1@localhost;
42+
--connect(user1,localhost,user1,,)
43+
--connection user1
44+
SET binlog_format=mixed;
45+
SET GLOBAL binlog_format=mixed;
46+
SET SESSION binlog_format=mixed;
47+
--disconnect user1
48+
--connection default
49+
DROP USER user1@localhost;

‎mysql-test/suite/sys_vars/t/sql_log_bin_grant.test

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
source include/have_log_bin.inc;
2+
3+
4+
--echo #
5+
--echo #
6+
--echo #
7+
8+
--echo # Test that "SET sql_log_bin" is not allowed without BINLOG ADMIN or SUPER
9+
10+
CREATE USER user1@localhost;
11+
GRANT ALL PRIVILEGES ON *.* TO user1@localhost;
12+
REVOKE BINLOG ADMIN, SUPER ON *.* FROM user1@localhost;
13+
--connect(user1,localhost,user1,,)
14+
--connection user1
15+
--error ER_SPECIFIC_ACCESS_DENIED_ERROR
16+
SET sql_log_bin=1;
17+
--error ER_SPECIFIC_ACCESS_DENIED_ERROR
18+
SET GLOBAL sql_log_bin=1;
19+
--error ER_SPECIFIC_ACCESS_DENIED_ERROR
20+
SET SESSION sql_log_bin=1;
21+
--disconnect user1
22+
--connection default
23+
DROP USER user1@localhost;
24+
25+
--echo # Test that "SET sql_log_bin" is allowed with BINLOG ADMIN
26+
27+
CREATE USER user1@localhost;
28+
GRANT BINLOG ADMIN ON *.* TO user1@localhost;
29+
--connect(user1,localhost,user1,,)
30+
--connection user1
31+
SET sql_log_bin=1;
32+
--error ER_INCORRECT_GLOBAL_LOCAL_VAR
33+
SET GLOBAL sql_log_bin=1;
34+
SET SESSION sql_log_bin=1;
35+
--disconnect user1
36+
--connection default
37+
DROP USER user1@localhost;
38+
39+
--echo # Test that "SET sql_log_bin" is allowed with SUPER
40+
41+
CREATE USER user1@localhost;
42+
GRANT SUPER ON *.* TO user1@localhost;
43+
--connect(user1,localhost,user1,,)
44+
--connection user1
45+
SET sql_log_bin=1;
46+
--error ER_INCORRECT_GLOBAL_LOCAL_VAR
47+
SET GLOBAL sql_log_bin=1;
48+
SET SESSION sql_log_bin=1;
49+
--disconnect user1
50+
--connection default
51+
DROP USER user1@localhost;

‎sql/privilege.h

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -315,6 +315,15 @@ constexpr privilege_t PRIV_DEBUG= SUPER_ACL;
315315
constexpr privilege_t PRIV_SET_GLOBAL_SYSTEM_VARIABLE= SUPER_ACL;
316316
constexpr privilege_t PRIV_SET_RESTRICTED_SESSION_SYSTEM_VARIABLE= SUPER_ACL;
317317

318+
/* The following variables respected only SUPER_ACL prior to 10.5.2 */
319+
constexpr privilege_t PRIV_SET_SYSTEM_VAR_BINLOG_FORMAT=
320+
SUPER_ACL | BINLOG_ADMIN_ACL;
321+
constexpr privilege_t PRIV_SET_SYSTEM_VAR_BINLOG_DIRECT_NON_TRANSACTIONAL_UPDATES=
322+
SUPER_ACL | BINLOG_ADMIN_ACL;
323+
constexpr privilege_t PRIV_SET_SYSTEM_VAR_SQL_LOG_BIN=
324+
SUPER_ACL | BINLOG_ADMIN_ACL;
325+
326+
318327
/* Privileges related to --read-only */
319328
constexpr privilege_t PRIV_IGNORE_READ_ONLY= READ_ONLY_ADMIN_ACL | SUPER_ACL;
320329

‎sql/set_var.cc

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -756,6 +756,11 @@ int sql_set_variables(THD *thd, List<set_var_base> *var_list, bool free)
756756
Functions to handle SET mysql_internal_variable=const_expr
757757
*****************************************************************************/
758758

759+
bool sys_var::on_check_access_global(THD *thd) const
760+
{
761+
return check_global_access(thd, PRIV_SET_GLOBAL_SYSTEM_VARIABLE);
762+
}
763+
759764
/**
760765
Verify that the supplied value is correct.
761766
@@ -780,8 +785,7 @@ int set_var::check(THD *thd)
780785
my_error(err, MYF(0), var->name.str);
781786
return -1;
782787
}
783-
if (type == OPT_GLOBAL &&
784-
check_global_access(thd, PRIV_SET_GLOBAL_SYSTEM_VARIABLE))
788+
if (type == OPT_GLOBAL && var->on_check_access_global(thd))
785789
return 1;
786790
/* value is a NULL pointer if we are using SET ... = DEFAULT */
787791
if (!value)
@@ -794,6 +798,16 @@ int set_var::check(THD *thd)
794798
my_error(ER_WRONG_TYPE_FOR_VAR, MYF(0), var->name.str);
795799
return -1;
796800
}
801+
switch (type) {
802+
case SHOW_OPT_DEFAULT:
803+
case SHOW_OPT_SESSION:
804+
DBUG_ASSERT(var->scope() != sys_var::GLOBAL);
805+
if (var->on_check_access_session(thd))
806+
return -1;
807+
break;
808+
case SHOW_OPT_GLOBAL: // Checked earlier
809+
break;
810+
}
797811
return var->check(thd, this) ? -1 : 0;
798812
}
799813

‎sql/set_var.h

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -214,6 +214,12 @@ class sys_var: protected Value_source // for double_from_string_with_check
214214
virtual uchar *default_value_ptr(THD *thd)
215215
{ return (uchar*)&option.def_value; }
216216

217+
virtual bool on_check_access_global(THD *thd) const;
218+
virtual bool on_check_access_session(THD *thd) const
219+
{
220+
return false;
221+
}
222+
217223
private:
218224
virtual bool do_check(THD *thd, set_var *var) = 0;
219225
/**

0 commit comments

Comments
 (0)