SELECT from the system database requires grant now

[vitlibar]

Changelog category:

• Improvement

Changelog entry:

Add option enabling that SELECT from the system database requires grant. Details:

1. Add options access_control_improvements.select_from_system_db_requires_grant to the main config.

<access_control_improvements>
        <select_from_system_db_requires_grant>false</select_from_system_db_requires_grant>
</access_control_improvements>

If it's set to false a SELECT from any table in the system database can be executed without any grants.

If it's set to true then such SELECTs require GRANT SELECT ON system.<table> just like for ordinary databases.
Exceptions: a few system tables (tables, columns, databases, and some constant tables like one, contributors) are still accessible for everyone; and if there is a SHOW privilege (e.g. SHOW USERS) granted the corresponding system table (i.e. system.users) will be accessible.

2. Add option access_control_improvements.select_from_information_schema_requires_grant to the main config.

<access_control_improvements>
        <select_from_information_schema_requires_grant>false</select_from_information_schema_requires_grant>
</access_control_improvements>

If it's set to false a SELECT from any table in the information_schema database can be executed without any grants.
If it's set to true then such SELECTs require GRANT SELECT ON information_schema.<table> just like for ordinary databases.

3. Add new table function viewIfPermitted:

viewIfPermitted(query ELSE null(structure))

works as view(query) if the current user has permission to execute query, otherwise it works as null(structure)

[serxa]

LGTM

[serxa]

maybe just false?

[serxa]

is this right? looks inconsistent, and the same couple lines below

[vitlibar]

Those two lines are not the same, here we return true if this is the global context and below we return true if access flags don't contain any flags (so nothing to check).

[vitlibar]

The issue with test test_backup_restore_on_cluster will be fixed in a separate PR.

[azat]

@vitlibar Maybe client should check server version/revision to see if function is supported, to make new client compatible with older servers?

[vitlibar]

I'll do that

[vitlibar]

#39413