Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

privilege: fix user with % hostname can not show grants(#15825,#15524) #16168

Merged
merged 5 commits into from
Apr 8, 2020
Merged

privilege: fix user with % hostname can not show grants(#15825,#15524) #16168

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
662f08b
privilege: fix show grants privilege check (#15524)
Mar 23, 2020
4a21dc1
privilege: fix user with `%` hostname can not show grants. (#15825)
Mar 30, 2020
332b677
Merge branch 'release-3.0' into fixShowGrants2_30
sre-bot Apr 8, 2020
5a9179c
Merge branch 'release-3.0' into fixShowGrants2_30
zz-jason Apr 8, 2020
16b280d
Merge branch 'release-3.0' into fixShowGrants2_30
sre-bot Apr 8, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions executor/builder.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -626,6 +626,8 @@ func (b *executorBuilder) buildShow(v *plannercore.Show) Executor {
// The former determine privileges with roles, while the later doesn't.
vars := e.ctx.GetSessionVars()
e.User = vars.User
e.User.Hostname = vars.User.AuthHostname
e.User.Username = vars.User.AuthUsername
e.Roles = vars.ActiveRoles
}
if e.Tp == ast.ShowMasterStatus {
Expand Down
13 changes: 13 additions & 0 deletions executor/show.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1079,6 +1079,19 @@ func (e *ShowExec) fetchShowGrants() error {
if checker == nil {
return errors.New("miss privilege checker")
}
sessVars := e.ctx.GetSessionVars()
if !e.User.CurrentUser {
userName := sessVars.User.AuthUsername
hostName := sessVars.User.AuthHostname
// Show grant user requires the SELECT privilege on mysql schema.
// Ref https://dev.mysql.com/doc/refman/8.0/en/show-grants.html
if userName != e.User.Username || hostName != e.User.Hostname {
activeRoles := sessVars.ActiveRoles
if !checker.RequestVerification(activeRoles, mysql.SystemDB, "", "", mysql.SelectPriv) {
return ErrDBaccessDenied.GenWithStackByArgs(userName, hostName, mysql.SystemDB)
}
}
}
for _, r := range e.Roles {
if r.Hostname == "" {
r.Hostname = "%"
Expand Down
22 changes: 21 additions & 1 deletion executor/show_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -139,6 +139,26 @@ func (s *testSuite2) TestShowErrors(c *C) {
tk.MustQuery("show errors").Check(testutil.RowsWithSep("|", "Error|1050|Table 'test.show_errors' already exists"))
}

func (s *testSuite2) TestShowGrantsPrivilege(c *C) {
tk := testkit.NewTestKit(c, s.store)
tk.MustExec("create user show_grants")
tk.MustExec("show grants for show_grants")
tk1 := testkit.NewTestKit(c, s.store)
se, err := session.CreateSession4Test(s.store)
c.Assert(err, IsNil)
c.Assert(se.Auth(&auth.UserIdentity{Username: "show_grants", Hostname: "%"}, nil, nil), IsTrue)
tk1.Se = se
err = tk1.QueryToErr("show grants for root")
c.Assert(err.Error(), Equals, executor.ErrDBaccessDenied.GenWithStackByArgs("show_grants", "%", mysql.SystemDB).Error())
// Test show grants for user with auth host name `%`.
tk2 := testkit.NewTestKit(c, s.store)
se2, err := session.CreateSession4Test(s.store)
c.Assert(err, IsNil)
c.Assert(se2.Auth(&auth.UserIdentity{Username: "show_grants", Hostname: "127.0.0.1", AuthUsername: "show_grants", AuthHostname: "%"}, nil, nil), IsTrue)
tk2.Se = se2
tk2.MustQuery("show grants")
}

func (s *testSuite2) TestIssue3641(c *C) {
tk := testkit.NewTestKit(c, s.store)
_, err := tk.Exec("show tables;")
Expand All @@ -156,7 +176,7 @@ func (s *testSuite2) TestIssue10549(c *C) {
tk.MustExec("GRANT 'app_developer' TO 'dev';")
tk.MustExec("SET DEFAULT ROLE app_developer TO 'dev';")

c.Assert(tk.Se.Auth(&auth.UserIdentity{Username: "dev", Hostname: "localhost", AuthUsername: "dev", AuthHostname: "localhost"}, nil, nil), IsTrue)
c.Assert(tk.Se.Auth(&auth.UserIdentity{Username: "dev", Hostname: "%", AuthUsername: "dev", AuthHostname: "%"}, nil, nil), IsTrue)
tk.MustQuery("SHOW DATABASES;").Check(testkit.Rows("INFORMATION_SCHEMA", "newdb"))
tk.MustQuery("SHOW GRANTS;").Check(testkit.Rows("GRANT USAGE ON *.* TO 'dev'@'%'", "GRANT ALL PRIVILEGES ON newdb.* TO 'dev'@'%'", "GRANT 'app_developer'@'%' TO 'dev'@'%'"))
tk.MustQuery("SHOW GRANTS FOR CURRENT_USER").Check(testkit.Rows("GRANT USAGE ON *.* TO 'dev'@'%'", "GRANT 'app_developer'@'%' TO 'dev'@'%'"))
Expand Down