From 64b27c734eed91e2b79701c9c53283d9411f702f Mon Sep 17 00:00:00 2001 From: Vicentiu Ciorbaru <cvicentiu@gmail.com> Date: Sun, 13 Jul 2014 23:57:10 +0000 Subject: [PATCH] Added default role implementation --- mysql-test/r/ps.result | 6 +- ...te_and_drop_role_invalid_user_table.result | 4 + ...eate_and_drop_role_invalid_user_table.test | 7 +- .../suite/roles/set_default_role_clear.result | 35 +++ .../suite/roles/set_default_role_clear.test | 52 ++++ .../suite/roles/set_default_role_for.result | 65 +++++ .../suite/roles/set_default_role_for.test | 84 ++++++ .../roles/set_default_role_invalid.result | 40 +++ .../suite/roles/set_default_role_invalid.test | 62 +++++ .../set_default_role_new_connection.result | 48 ++++ .../set_default_role_new_connection.test | 47 ++++ .../suite/roles/set_role-recursive.result | 8 +- mysql-test/suite/roles/set_role-simple.result | 4 +- sql/set_var.cc | 24 ++ sql/set_var.h | 12 + sql/share/errmsg-utf8.txt | 10 +- sql/sql_acl.cc | 252 ++++++++++++++++-- sql/sql_acl.h | 3 + sql/sql_yacc.yy | 30 +++ 19 files changed, 751 insertions(+), 42 deletions(-) create mode 100644 mysql-test/suite/roles/set_default_role_clear.result create mode 100644 mysql-test/suite/roles/set_default_role_clear.test create mode 100644 mysql-test/suite/roles/set_default_role_for.result create mode 100644 mysql-test/suite/roles/set_default_role_for.test create mode 100644 mysql-test/suite/roles/set_default_role_invalid.result create mode 100644 mysql-test/suite/roles/set_default_role_invalid.test create mode 100644 mysql-test/suite/roles/set_default_role_new_connection.result create mode 100644 mysql-test/suite/roles/set_default_role_new_connection.test diff --git a/mysql-test/r/ps.result b/mysql-test/r/ps.result index 3217a10ed6..7db51eadbe 100644 --- a/mysql-test/r/ps.result +++ b/mysql-test/r/ps.result @@ -1202,13 +1202,13 @@ SET @aux= "SELECT COUNT(*) prepare my_stmt from @aux; execute my_stmt; COUNT(*) -44 +45 execute my_stmt; COUNT(*) -44 +45 execute my_stmt; COUNT(*) -44 +45 deallocate prepare my_stmt; drop procedure if exists p1| drop table if exists t1| diff --git a/mysql-test/suite/roles/create_and_drop_role_invalid_user_table.result b/mysql-test/suite/roles/create_and_drop_role_invalid_user_table.result index 2d5891f996..e7765c3766 100644 --- a/mysql-test/suite/roles/create_and_drop_role_invalid_user_table.result +++ b/mysql-test/suite/roles/create_and_drop_role_invalid_user_table.result @@ -1,5 +1,6 @@ use mysql; alter table user drop column is_role; +alter table user drop column default_role; flush privileges; create role test_role; ERROR HY000: Column count of mysql.user is wrong. Expected 44, found 43. Created with MariaDB MYSQL_VERSION_ID, now running MYSQL_VERSION_ID. Please use mysql_upgrade to fix this error. @@ -8,6 +9,9 @@ ERROR HY000: Operation DROP ROLE failed for 'test_role' alter table user add column is_role enum('N', 'Y') default 'N' not null COLLATE utf8_general_ci after password_expired; +alter table user add column default_role char(80) binary default '' not null +COLLATE utf8_general_ci +after is_role; update user set is_role='N'; flush privileges; create role test_role; diff --git a/mysql-test/suite/roles/create_and_drop_role_invalid_user_table.test b/mysql-test/suite/roles/create_and_drop_role_invalid_user_table.test index fddab71724..9ffac07d24 100644 --- a/mysql-test/suite/roles/create_and_drop_role_invalid_user_table.test +++ b/mysql-test/suite/roles/create_and_drop_role_invalid_user_table.test @@ -4,6 +4,7 @@ connect (mysql, localhost, root,,); use mysql; alter table user drop column is_role; +alter table user drop column default_role; flush privileges; @@ -15,12 +16,12 @@ drop role test_role; alter table user add column is_role enum('N', 'Y') default 'N' not null COLLATE utf8_general_ci after password_expired; +alter table user add column default_role char(80) binary default '' not null + COLLATE utf8_general_ci +after is_role; update user set is_role='N'; flush privileges; create role test_role; drop role test_role; - - - diff --git a/mysql-test/suite/roles/set_default_role_clear.result b/mysql-test/suite/roles/set_default_role_clear.result new file mode 100644 index 0000000000..382d3d27c7 --- /dev/null +++ b/mysql-test/suite/roles/set_default_role_clear.result @@ -0,0 +1,35 @@ +create user test_user@localhost; +create role test_role; +grant select on *.* to test_role; +grant test_role to test_user@localhost; +show grants; +Grants for test_user@localhost +GRANT test_role TO 'test_user'@'localhost' +GRANT USAGE ON *.* TO 'test_user'@'localhost' +set default role test_role; +select user, host, default_role from mysql.user; +ERROR 42000: SELECT command denied to user 'test_user'@'localhost' for table 'user' +select user, host, default_role from mysql.user where user='test_user'; +user host default_role +test_user localhost test_role +show grants; +Grants for test_user@localhost +GRANT test_role TO 'test_user'@'localhost' +GRANT USAGE ON *.* TO 'test_user'@'localhost' +GRANT SELECT ON *.* TO 'test_role' +select user, host, default_role from mysql.user where user='test_user'; +user host default_role +test_user localhost test_role +set default role NONE; +select user, host, default_role from mysql.user where user='test_user'; +user host default_role +test_user localhost +set default role invalid_role; +ERROR OP000: Invalid role specification `invalid_role`. +select user, host, default_role from mysql.user where user='test_user'; +user host default_role +test_user localhost +select user, host, default_role from mysql.user; +ERROR 42000: SELECT command denied to user 'test_user'@'localhost' for table 'user' +drop role test_role; +drop user test_user@localhost; diff --git a/mysql-test/suite/roles/set_default_role_clear.test b/mysql-test/suite/roles/set_default_role_clear.test new file mode 100644 index 0000000000..32c9661c57 --- /dev/null +++ b/mysql-test/suite/roles/set_default_role_clear.test @@ -0,0 +1,52 @@ +source include/not_embedded.inc; + +# This test checks clearing a default role from a user. + +# Create a user with no privileges +create user test_user@localhost; + +create role test_role; + +grant select on *.* to test_role; +grant test_role to test_user@localhost; + +change_user 'test_user'; +show grants; +set default role test_role; + +# Even though a user has the default role set, without reconnecting, we should +# not already have the roles privileges. +--error ER_TABLEACCESS_DENIED_ERROR +select user, host, default_role from mysql.user; + +change_user 'root'; +select user, host, default_role from mysql.user where user='test_user'; + +change_user 'test_user'; +# This should show that the new test_user has the role's grants enabled. +show grants; +select user, host, default_role from mysql.user where user='test_user'; + +set default role NONE; + +# We should still have the role set right now. +select user, host, default_role from mysql.user where user='test_user'; + +# Make sure we do not somehow get privileges to set an invalid role +--error ER_INVALID_ROLE +set default role invalid_role; + +change_user 'root'; +select user, host, default_role from mysql.user where user='test_user'; + +change_user 'test_user'; +# The user does not have a default role set anymore. Make sure we don't still +# get the privileges. +--error ER_TABLEACCESS_DENIED_ERROR +select user, host, default_role from mysql.user; + +change_user 'root'; + +# Cleanup +drop role test_role; +drop user test_user@localhost; diff --git a/mysql-test/suite/roles/set_default_role_for.result b/mysql-test/suite/roles/set_default_role_for.result new file mode 100644 index 0000000000..2949584f04 --- /dev/null +++ b/mysql-test/suite/roles/set_default_role_for.result @@ -0,0 +1,65 @@ +create user user_a@localhost; +create user user_b@localhost; +create role role_a; +create role role_b; +grant role_a to user_a@localhost; +grant role_b to user_b@localhost; +grant role_a to user_a@localhost; +grant select on *.* to role_a; +grant role_b to user_b@localhost; +grant insert, update on *.* to role_b; +set default role role_a for user_b@localhost; +ERROR 42000: Access denied for user 'user_a'@'localhost' to database 'mysql' +set default role role_a for user_a@localhost; +set default role invalid_role for user_a@localhost; +ERROR OP000: Invalid role specification `invalid_role`. +set default role role_b for user_a@localhost; +ERROR OP000: Invalid role specification `role_b`. +set default role role_b for user_b@localhost; +show grants; +Grants for user_a@localhost +GRANT role_a TO 'user_a'@'localhost' +GRANT USAGE ON *.* TO 'user_a'@'localhost' +GRANT SELECT ON *.* TO 'role_a' +select user, host, default_role from mysql.user where user like 'user_%'; +user host default_role +user_a localhost role_a +user_b localhost role_b +set default role NONE for current_user; +select user, host, default_role from mysql.user where user like 'user_%'; +user host default_role +user_a localhost +user_b localhost role_b +set default role current_role for current_user; +select user, host, default_role from mysql.user where user like 'user_%'; +user host default_role +user_a localhost role_a +user_b localhost role_b +set default role role_b for current_user; +ERROR OP000: Invalid role specification `role_b`. +show grants; +Grants for user_b@localhost +GRANT role_b TO 'user_b'@'localhost' +GRANT USAGE ON *.* TO 'user_b'@'localhost' +GRANT INSERT, UPDATE ON *.* TO 'role_b' +select user, host, default_role from mysql.user where user like 'user_%'; +ERROR 42000: SELECT command denied to user 'user_b'@'localhost' for table 'user' +insert into mysql.user (user, host) values ('someuser', 'somehost'); +Warnings: +Warning 1364 Field 'ssl_cipher' doesn't have a default value +Warning 1364 Field 'x509_issuer' doesn't have a default value +Warning 1364 Field 'x509_subject' doesn't have a default value +Warning 1364 Field 'authentication_string' doesn't have a default value +set default role NONE for user_a@localhost; +show grants; +Grants for user_a@localhost +GRANT role_a TO 'user_a'@'localhost' +GRANT USAGE ON *.* TO 'user_a'@'localhost' +GRANT INSERT, UPDATE ON *.* TO 'role_b' +select user, host, default_role from mysql.user where user like 'user_%'; +ERROR 42000: SELECT command denied to user 'user_a'@'localhost' for table 'user' +drop role role_a; +drop role role_b; +drop user someuser@somehost; +drop user user_a@localhost; +drop user user_b@localhost; diff --git a/mysql-test/suite/roles/set_default_role_for.test b/mysql-test/suite/roles/set_default_role_for.test new file mode 100644 index 0000000000..d51c13bcec --- /dev/null +++ b/mysql-test/suite/roles/set_default_role_for.test @@ -0,0 +1,84 @@ +source include/not_embedded.inc; + +# This test checks setting a default role to a different user; + + +create user user_a@localhost; +create user user_b@localhost; + +create role role_a; +create role role_b; + +grant role_a to user_a@localhost; +grant role_b to user_b@localhost; + +grant role_a to user_a@localhost; +grant select on *.* to role_a; + +grant role_b to user_b@localhost; +grant insert, update on *.* to role_b; + +change_user 'user_a'; + +# A user should not be a able to set a default role for someone else, +# if he hasn't got write access to the database. +--error ER_DBACCESS_DENIED_ERROR +set default role role_a for user_b@localhost; + +# Should have the same effect as set default role role_a. +set default role role_a for user_a@localhost; + +change_user 'root'; + +# Not even a 'root' user should be able to set an invalid role for a user. +--error ER_INVALID_ROLE +set default role invalid_role for user_a@localhost; + +--error ER_INVALID_ROLE +set default role role_b for user_a@localhost; + +# Make sure we can set a default role for a different user than the one that +# is actually running the command. +set default role role_b for user_b@localhost; + +change_user 'user_a'; + +show grants; +select user, host, default_role from mysql.user where user like 'user_%'; + +set default role NONE for current_user; +select user, host, default_role from mysql.user where user like 'user_%'; + +set default role current_role for current_user; +select user, host, default_role from mysql.user where user like 'user_%'; + +# Make sure we can't set a default role not granted to us, using current_user +--error ER_INVALID_ROLE +set default role role_b for current_user; + +change_user 'user_b'; + +show grants; +--error ER_TABLEACCESS_DENIED_ERROR +select user, host, default_role from mysql.user where user like 'user_%'; + +# Make sure the default role setting worked from root. +insert into mysql.user (user, host) values ('someuser', 'somehost'); +# Since we have update privileges on the mysql.user table, we should +# be able to set a default role for a different user. +set default role NONE for user_a@localhost; + +change_user 'user_a'; + +# There is no default role set any more. +show grants; +--error ER_TABLEACCESS_DENIED_ERROR +select user, host, default_role from mysql.user where user like 'user_%'; + +change_user 'root'; + +drop role role_a; +drop role role_b; +drop user someuser@somehost; +drop user user_a@localhost; +drop user user_b@localhost; diff --git a/mysql-test/suite/roles/set_default_role_invalid.result b/mysql-test/suite/roles/set_default_role_invalid.result new file mode 100644 index 0000000000..3916bacfd4 --- /dev/null +++ b/mysql-test/suite/roles/set_default_role_invalid.result @@ -0,0 +1,40 @@ +create user test_user@localhost; +create role test_role; +create role not_granted_role; +grant select on *.* to test_role; +grant test_role to test_user@localhost; +show grants; +Grants for test_user@localhost +GRANT test_role TO 'test_user'@'localhost' +GRANT USAGE ON *.* TO 'test_user'@'localhost' +select user, host, default_role from mysql.user; +ERROR 42000: SELECT command denied to user 'test_user'@'localhost' for table 'user' +set default role invalid_role; +ERROR OP000: Invalid role specification `invalid_role`. +set default role not_granted_role; +ERROR OP000: Invalid role specification `not_granted_role`. +set default role test_role; +select user, host, default_role from mysql.user; +ERROR 42000: SELECT command denied to user 'test_user'@'localhost' for table 'user' +select user, host, default_role from mysql.user where user='test_user'; +user host default_role +test_user localhost test_role +show grants; +Grants for test_user@localhost +GRANT test_role TO 'test_user'@'localhost' +GRANT USAGE ON *.* TO 'test_user'@'localhost' +GRANT SELECT ON *.* TO 'test_role' +select user, host, default_role from mysql.user where user='test_user'; +user host default_role +test_user localhost test_role +set default role invalid_role; +ERROR OP000: Invalid role specification `invalid_role`. +select user, host, default_role from mysql.user where user='test_user'; +user host default_role +test_user localhost test_role +revoke test_role from test_user@localhost; +select user, host, default_role from mysql.user where user='test_user'; +ERROR 42000: SELECT command denied to user 'test_user'@'localhost' for table 'user' +drop role test_role; +drop role not_granted_role; +drop user test_user@localhost; diff --git a/mysql-test/suite/roles/set_default_role_invalid.test b/mysql-test/suite/roles/set_default_role_invalid.test new file mode 100644 index 0000000000..8e72e316d4 --- /dev/null +++ b/mysql-test/suite/roles/set_default_role_invalid.test @@ -0,0 +1,62 @@ +source include/not_embedded.inc; + +# This test checks the error paths possible during set default role. + +# Create a user with no privileges +create user test_user@localhost; + +create role test_role; +create role not_granted_role; + +grant select on *.* to test_role; +grant test_role to test_user@localhost; + +change_user 'test_user'; +show grants; +--error ER_TABLEACCESS_DENIED_ERROR +select user, host, default_role from mysql.user; + +# A user can not set a default role that does not exist in the database. +--error ER_INVALID_ROLE +set default role invalid_role; + +# A user can not set a default role if he can not call set role <role>. +--error ER_INVALID_ROLE +set default role not_granted_role; + +set default role test_role; + +# Even though a user has the default role set, without reconnecting, we should +# not already have the roles privileges. +--error ER_TABLEACCESS_DENIED_ERROR +select user, host, default_role from mysql.user; + +change_user 'root'; +select user, host, default_role from mysql.user where user='test_user'; + +change_user 'test_user'; +# This should show that the new test_user has the role's grants enabled. +show grants; +select user, host, default_role from mysql.user where user='test_user'; + +# If we have a failed set default role attempt, don't change the already set +# default role. +--error ER_INVALID_ROLE +set default role invalid_role; +select user, host, default_role from mysql.user where user='test_user'; + +change_user 'root'; +# Now, even though a default role is still set for test_user, make sure the +# user does not get the rights, if he can not set the role. +revoke test_role from test_user@localhost; + +change_user 'test_user'; +--error ER_TABLEACCESS_DENIED_ERROR +select user, host, default_role from mysql.user where user='test_user'; + +change_user 'root'; + +# Cleanup +drop role test_role; +drop role not_granted_role; +drop user test_user@localhost; diff --git a/mysql-test/suite/roles/set_default_role_new_connection.result b/mysql-test/suite/roles/set_default_role_new_connection.result new file mode 100644 index 0000000000..d88ead7003 --- /dev/null +++ b/mysql-test/suite/roles/set_default_role_new_connection.result @@ -0,0 +1,48 @@ +create user test_user@localhost; +create role test_role; +grant select on *.* to test_role; +grant test_role to test_user@localhost; +show grants; +Grants for test_user@localhost +GRANT test_role TO 'test_user'@'localhost' +GRANT USAGE ON *.* TO 'test_user'@'localhost' +select user, host, default_role from mysql.user where user = 'test_user'; +ERROR 42000: SELECT command denied to user 'test_user'@'localhost' for table 'user' +set default role test_role; +select user, host, default_role from mysql.user where user = 'test_user'; +ERROR 42000: SELECT command denied to user 'test_user'@'localhost' for table 'user' +select user, host, default_role from mysql.user where user = 'test_user'; +user host default_role +test_user localhost test_role +show grants; +Grants for test_user@localhost +GRANT test_role TO 'test_user'@'localhost' +GRANT USAGE ON *.* TO 'test_user'@'localhost' +GRANT SELECT ON *.* TO 'test_role' +select user, host, default_role from mysql.user where user = 'test_user'; +user host default_role +test_user localhost test_role +set default role NONE; +select user, host, default_role from mysql.user where user = 'test_user'; +user host default_role +test_user localhost +show grants; +Grants for test_user@localhost +GRANT test_role TO 'test_user'@'localhost' +GRANT USAGE ON *.* TO 'test_user'@'localhost' +select user, host, default_role from mysql.user where user = 'test_user'; +ERROR 42000: SELECT command denied to user 'test_user'@'localhost' for table 'user' +select user, host, default_role from mysql.user where user = 'test_user'; +user host default_role +test_user localhost +set default role test_role for test_user@localhost; +show grants; +Grants for test_user@localhost +GRANT test_role TO 'test_user'@'localhost' +GRANT USAGE ON *.* TO 'test_user'@'localhost' +GRANT SELECT ON *.* TO 'test_role' +select user, host, default_role from mysql.user where user = 'test_user'; +user host default_role +test_user localhost test_role +drop role test_role; +drop user test_user@localhost; diff --git a/mysql-test/suite/roles/set_default_role_new_connection.test b/mysql-test/suite/roles/set_default_role_new_connection.test new file mode 100644 index 0000000000..81f7f2ffb5 --- /dev/null +++ b/mysql-test/suite/roles/set_default_role_new_connection.test @@ -0,0 +1,47 @@ +source include/not_embedded.inc; + +create user test_user@localhost; +create role test_role; +grant select on *.* to test_role; +grant test_role to test_user@localhost; + +--connect (c1, localhost, test_user,,) +show grants; +--error ER_TABLEACCESS_DENIED_ERROR +select user, host, default_role from mysql.user where user = 'test_user'; +set default role test_role; +--error ER_TABLEACCESS_DENIED_ERROR +select user, host, default_role from mysql.user where user = 'test_user'; +disconnect c1; + +connection default; +select user, host, default_role from mysql.user where user = 'test_user'; + + +--connect (c1, localhost, test_user,,) +show grants; +select user, host, default_role from mysql.user where user = 'test_user'; +set default role NONE; +disconnect c1; + +connection default; +select user, host, default_role from mysql.user where user = 'test_user'; + +--connect (c1, localhost, test_user,,) +show grants; +--error ER_TABLEACCESS_DENIED_ERROR +select user, host, default_role from mysql.user where user = 'test_user'; +disconnect c1; + +connection default; +select user, host, default_role from mysql.user where user = 'test_user'; +set default role test_role for test_user@localhost; + +--connect (c1, localhost, test_user,,) +show grants; +select user, host, default_role from mysql.user where user = 'test_user'; +disconnect c1; + +connection default; +drop role test_role; +drop user test_user@localhost; diff --git a/mysql-test/suite/roles/set_role-recursive.result b/mysql-test/suite/roles/set_role-recursive.result index 0bec8026ab..008de2c326 100644 --- a/mysql-test/suite/roles/set_role-recursive.result +++ b/mysql-test/suite/roles/set_role-recursive.result @@ -16,11 +16,11 @@ Host User Role Admin_option test_role1 test_role2 N grant select on *.* to test_role2; select * from mysql.user where user like 'test_role1'; -Host User Password Select_priv Insert_priv Update_priv Delete_priv Create_priv Drop_priv Reload_priv Shutdown_priv Process_priv File_priv Grant_priv References_priv Index_priv Alter_priv Show_db_priv Super_priv Create_tmp_table_priv Lock_tables_priv Execute_priv Repl_slave_priv Repl_client_priv Create_view_priv Show_view_priv Create_routine_priv Alter_routine_priv Create_user_priv Event_priv Trigger_priv Create_tablespace_priv ssl_type ssl_cipher x509_issuer x509_subject max_questions max_updates max_connections max_user_connections plugin authentication_string password_expired is_role - test_role1 N N N N N N N N N N N N N N N N N N N N N N N N N N N N N 0 0 0 0 N Y +Host User Password Select_priv Insert_priv Update_priv Delete_priv Create_priv Drop_priv Reload_priv Shutdown_priv Process_priv File_priv Grant_priv References_priv Index_priv Alter_priv Show_db_priv Super_priv Create_tmp_table_priv Lock_tables_priv Execute_priv Repl_slave_priv Repl_client_priv Create_view_priv Show_view_priv Create_routine_priv Alter_routine_priv Create_user_priv Event_priv Trigger_priv Create_tablespace_priv ssl_type ssl_cipher x509_issuer x509_subject max_questions max_updates max_connections max_user_connections plugin authentication_string password_expired is_role default_role + test_role1 N N N N N N N N N N N N N N N N N N N N N N N N N N N N N 0 0 0 0 N Y select * from mysql.user where user like 'test_role2'; -Host User Password Select_priv Insert_priv Update_priv Delete_priv Create_priv Drop_priv Reload_priv Shutdown_priv Process_priv File_priv Grant_priv References_priv Index_priv Alter_priv Show_db_priv Super_priv Create_tmp_table_priv Lock_tables_priv Execute_priv Repl_slave_priv Repl_client_priv Create_view_priv Show_view_priv Create_routine_priv Alter_routine_priv Create_user_priv Event_priv Trigger_priv Create_tablespace_priv ssl_type ssl_cipher x509_issuer x509_subject max_questions max_updates max_connections max_user_connections plugin authentication_string password_expired is_role - test_role2 Y N N N N N N N N N N N N N N N N N N N N N N N N N N N N 0 0 0 0 N Y +Host User Password Select_priv Insert_priv Update_priv Delete_priv Create_priv Drop_priv Reload_priv Shutdown_priv Process_priv File_priv Grant_priv References_priv Index_priv Alter_priv Show_db_priv Super_priv Create_tmp_table_priv Lock_tables_priv Execute_priv Repl_slave_priv Repl_client_priv Create_view_priv Show_view_priv Create_routine_priv Alter_routine_priv Create_user_priv Event_priv Trigger_priv Create_tablespace_priv ssl_type ssl_cipher x509_issuer x509_subject max_questions max_updates max_connections max_user_connections plugin authentication_string password_expired is_role default_role + test_role2 Y N N N N N N N N N N N N N N N N N N N N N N N N N N N N 0 0 0 0 N Y select * from mysql.roles_mapping; ERROR 42000: SELECT command denied to user 'test_user'@'localhost' for table 'roles_mapping' show grants; diff --git a/mysql-test/suite/roles/set_role-simple.result b/mysql-test/suite/roles/set_role-simple.result index ea41683501..f870bf8eb3 100644 --- a/mysql-test/suite/roles/set_role-simple.result +++ b/mysql-test/suite/roles/set_role-simple.result @@ -11,8 +11,8 @@ localhost root test_role1 Y localhost test_user test_role1 N grant select on *.* to test_role1; select * from mysql.user where user='test_role1'; -Host User Password Select_priv Insert_priv Update_priv Delete_priv Create_priv Drop_priv Reload_priv Shutdown_priv Process_priv File_priv Grant_priv References_priv Index_priv Alter_priv Show_db_priv Super_priv Create_tmp_table_priv Lock_tables_priv Execute_priv Repl_slave_priv Repl_client_priv Create_view_priv Show_view_priv Create_routine_priv Alter_routine_priv Create_user_priv Event_priv Trigger_priv Create_tablespace_priv ssl_type ssl_cipher x509_issuer x509_subject max_questions max_updates max_connections max_user_connections plugin authentication_string password_expired is_role - test_role1 Y N N N N N N N N N N N N N N N N N N N N N N N N N N N N 0 0 0 0 N Y +Host User Password Select_priv Insert_priv Update_priv Delete_priv Create_priv Drop_priv Reload_priv Shutdown_priv Process_priv File_priv Grant_priv References_priv Index_priv Alter_priv Show_db_priv Super_priv Create_tmp_table_priv Lock_tables_priv Execute_priv Repl_slave_priv Repl_client_priv Create_view_priv Show_view_priv Create_routine_priv Alter_routine_priv Create_user_priv Event_priv Trigger_priv Create_tablespace_priv ssl_type ssl_cipher x509_issuer x509_subject max_questions max_updates max_connections max_user_connections plugin authentication_string password_expired is_role default_role + test_role1 Y N N N N N N N N N N N N N N N N N N N N N N N N N N N N 0 0 0 0 N Y select * from mysql.roles_mapping; ERROR 42000: SELECT command denied to user 'test_user'@'localhost' for table 'roles_mapping' show grants; diff --git a/sql/set_var.cc b/sql/set_var.cc index ea577bbfa7..5c1e00af33 100644 --- a/sql/set_var.cc +++ b/sql/set_var.cc @@ -852,6 +852,7 @@ int set_var_password::update(THD *thd) /***************************************************************************** Functions to handle SET ROLE *****************************************************************************/ + int set_var_role::check(THD *thd) { #ifndef NO_EMBEDDED_ACCESS_CHECKS @@ -871,6 +872,29 @@ int set_var_role::update(THD *thd) #endif } +/***************************************************************************** + Functions to handle SET DEFAULT ROLE +*****************************************************************************/ + +int set_var_default_role::check(THD *thd) +{ +#ifndef NO_EMBEDDED_ACCESS_CHECKS + user= get_current_user(thd, user); + int status= acl_check_set_default_role(thd, user->host.str, user->user.str); + return status; +#else + return 0; +#endif +} + +int set_var_default_role::update(THD *thd) +{ +#ifndef NO_EMBEDDED_ACCESS_CHECKS + return acl_set_default_role(thd, user->host.str, user->user.str, role.str); +#else + return 0; +#endif +} /***************************************************************************** Functions to handle SET NAMES and SET CHARACTER SET diff --git a/sql/set_var.h b/sql/set_var.h index 564dac587d..bb92e555aa 100644 --- a/sql/set_var.h +++ b/sql/set_var.h @@ -291,6 +291,18 @@ public: int update(THD *thd); }; +/* For SET DEFAULT ROLE */ + +class set_var_default_role: public set_var_base +{ + LEX_USER *user; + LEX_STRING role; +public: + set_var_default_role(LEX_USER *user_arg, LEX_STRING role_arg) : + user(user_arg), role(role_arg) {} + int check(THD *thd); + int update(THD *thd); +}; /* For SET NAMES and SET CHARACTER SET */ diff --git a/sql/share/errmsg-utf8.txt b/sql/share/errmsg-utf8.txt index 6ee6698bb1..32cdbe138b 100644 --- a/sql/share/errmsg-utf8.txt +++ b/sql/share/errmsg-utf8.txt @@ -2936,7 +2936,7 @@ ER_PASSWORD_ANONYMOUS_USER 42000 cze "Pou啪铆v谩te MySQL jako anonymn铆 u啪ivatel a anonymn铆 u啪ivatel茅 nemaj铆 povoleno m臎nit hesla" dan "Du bruger MariaDB som anonym bruger. Anonyme brugere m氓 ikke 忙ndre adgangskoder" nla "U gebruikt MariaDB als anonieme gebruiker en deze mogen geen wachtwoorden wijzigen" - eng "You are using MariaDB as an anonymous user and anonymous users are not allowed to change passwords" + eng "You are using MariaDB as an anonymous user and anonymous users are not allowed to modify user settings" est "Te kasutate MariaDB-i anon眉眉mse kasutajana, kelledel pole parooli muutmise 玫igust" fre "Vous utilisez un utilisateur anonyme et les utilisateurs anonymes ne sont pas autoris茅s 脿 changer les mots de passe" ger "Sie benutzen MariaDB als anonymer Benutzer und d眉rfen daher keine Passw枚rter 盲ndern" @@ -2946,7 +2946,7 @@ ER_PASSWORD_ANONYMOUS_USER 42000 jpn "MySQL 銈掑尶鍚嶃儲銉笺偠銉笺仹浣跨敤銇椼仸銇勩倠銇仹銆併儜銈广儻銉笺儔銇鏇淬伅銇с亶銇俱仜銈撱€�" kor "雼轨嫚鞚€ MariaDB靹滊矂鞐� 鞚惦獏鞚� 靷毄鞛愲 鞝戩啀鞚� 頃橃叏鞀惦媹雼�.鞚惦獏鞚� 靷毄鞛愲姅 鞎旐樃毳� 氤€瓴巾暊 靾� 鞐嗢姷雼堧嫟." por "Voc锚 est谩 usando o MariaDB como usu谩rio an么nimo e usu谩rios an么nimos n茫o t锚m permiss茫o para mudar senhas" - rum "Dumneavoastra folositi MariaDB ca un utilizator anonim si utilizatorii anonimi nu au voie sa schimbe parolele" + rum "Dumneavoastra folositi MariaDB ca un utilizator anonim si utilizatorii anonimi nu au voie sa schimbe setarile utilizatorilor." rus "袙褘 懈褋锌芯谢褜蟹褍械褌械 MariaDB 芯褌 懈屑械薪懈 邪薪芯薪懈屑薪芯谐芯 锌芯谢褜蟹芯胁邪褌械谢褟, 邪 邪薪芯薪懈屑薪褘屑 锌芯谢褜蟹芯胁邪褌械谢褟屑 薪械 褉邪蟹褉械褕邪械褌褋褟 屑械薪褟褌褜 锌邪褉芯谢懈" serbian "Vi koristite MariaDB kao anonimni korisnik a anonimnim korisnicima nije dozvoljeno da menjaju lozinke" spa "Tu est谩s usando MariaDB como un usuario anonimo y usuarios anonimos no tienen permiso para cambiar las claves" @@ -7110,9 +7110,3 @@ ER_IT_IS_A_VIEW 42S02 eng "'%-.192s' is a view" ER_SLAVE_SKIP_NOT_IN_GTID eng "When using GTID, @@sql_slave_skip_counter can not be used. Instead, setting @@gtid_slave_pos explicitly can be used to skip to after a given GTID position." -ER_DEFAULT_ROLE_ANONYMOUS_USER - eng "You are using MariaDB as an anonymous user and anonymous users are not allowed to change default roles." - rum "Dumneavoastra folositi MariaDB ca un utilizator anonim si utilizatorii anonimi nu au voie sa schimbe rolurile implicite." -ER_NO_SUCH_ROLE - eng "The role specified '%-.64s' does not exist." - rum "Rolul specificat '%-.64s' nu exist膬." diff --git a/sql/sql_acl.cc b/sql/sql_acl.cc index eff0574562..9ad7811560 100644 --- a/sql/sql_acl.cc +++ b/sql/sql_acl.cc @@ -265,6 +265,7 @@ public: const char *ssl_cipher, *x509_issuer, *x509_subject; LEX_STRING plugin; LEX_STRING auth_string; + LEX_STRING default_rolename; ACL_USER *copy(MEM_ROOT *root) { @@ -284,6 +285,8 @@ public: dst->plugin.str= strmake_root(root, plugin.str, plugin.length); dst->auth_string.str= safe_strdup_root(root, auth_string.str); dst->host.hostname= safe_strdup_root(root, host.hostname); + dst->default_rolename.str= safe_strdup_root(root, default_rolename.str); + dst->default_rolename.length= default_rolename.length; bzero(&dst->role_grants, sizeof(role_grants)); return dst; } @@ -702,6 +705,7 @@ bool ROLE_GRANT_PAIR::init(MEM_ROOT *mem, char *username, #define NORMAL_HANDSHAKE_SIZE 6 #define ROLE_ASSIGN_COLUMN_IDX 43 +#define DEFAULT_ROLE_COLUMN_IDX 44 /* various flags valid for ACL_USER */ #define IS_ROLE (1L << 0) /* Flag to mark that a ROLE is on the recursive DEPTH_FIRST_SEARCH stack */ @@ -1347,6 +1351,14 @@ static bool acl_load(THD *thd, TABLE_LIST *tables) (void) my_init_dynamic_array(&user.role_grants,sizeof(ACL_ROLE *), 8, 8, MYF(0)); + /* check default role, if any */ + if (!is_role && table->s->fields >= 45) + { + user.default_rolename.str= get_field(&acl_memroot, table->field[44]); + user.default_rolename.length= user.default_rolename.str ? + strlen(user.default_rolename.str) : 0; + } + if (is_role) { DBUG_PRINT("info", ("Found role %s", user.user.str)); @@ -1867,7 +1879,8 @@ bool acl_getroot(Security_context *sctx, char *user, char *host, DBUG_RETURN(res); } -int acl_check_setrole(THD *thd, char *rolename, ulonglong *access) +int check_user_can_set_role(const char *host, const char *user, + const char *rolename, ulonglong *access) { ACL_ROLE *role; ACL_USER_BASE *acl_user_base; @@ -1882,8 +1895,7 @@ int acl_check_setrole(THD *thd, char *rolename, ulonglong *access) { /* have to clear the privileges */ /* get the current user */ - acl_user= find_user_exact(thd->security_ctx->priv_host, - thd->security_ctx->priv_user); + acl_user= find_user_exact(host, user); if (acl_user == NULL) { my_error(ER_INVALID_CURRENT_USER, MYF(0), rolename); @@ -1911,9 +1923,7 @@ int acl_check_setrole(THD *thd, char *rolename, ulonglong *access) continue; acl_user= (ACL_USER *)acl_user_base; - /* Yes! priv_user@host. Don't ask why - that's what check_access() does. */ - if (acl_user->wild_eq(thd->security_ctx->priv_user, - thd->security_ctx->host)) + if (acl_user->wild_eq(user, host)) { is_granted= TRUE; break; @@ -1935,6 +1945,15 @@ int acl_check_setrole(THD *thd, char *rolename, ulonglong *access) end: mysql_mutex_unlock(&acl_cache->lock); return result; + +} + +int acl_check_setrole(THD *thd, char *rolename, ulonglong *access) +{ + /* Yes! priv_user@host. Don't ask why - that's what check_access() does. */ + return check_user_can_set_role(thd->security_ctx->host, + thd->security_ctx->priv_user, + rolename, access); } @@ -1960,7 +1979,6 @@ int acl_setrole(THD *thd, char *rolename, ulonglong access) return 0; } - static uchar* check_get_key(ACL_USER *buff, size_t *length, my_bool not_used __attribute__((unused))) { @@ -2068,6 +2086,7 @@ static void acl_insert_user(const char *user, const char *host, mysql_mutex_assert_owner(&acl_cache->lock); + bzero(&acl_user, sizeof(acl_user)); acl_user.user.str=*user ? strdup_root(&acl_memroot,user) : 0; acl_user.user.length= strlen(user); update_hostname(&acl_user.host, safe_strdup_root(&acl_memroot, host)); @@ -2518,41 +2537,40 @@ bool acl_check_host(const char *host, const char *ip) return 1; // Host is not allowed } - /** - Check if the user is allowed to change password + Check if the user is allowed to alter the mysql.user table @param thd THD @param host Hostname for the user @param user User name - @param new_password New password - @param new_password_len The length of the new password - - new_password cannot be NULL @return Error status @retval 0 OK - @retval 1 ERROR; In this case the error is sent to the client. + @retval 1 skip grant tables error + @retval 2 ANONYMOUS user error + @retval 3 the entry to change is a role, not a user + @retval 4 no UPDATE_ACL error + */ -int check_change_password(THD *thd, const char *host, const char *user, - char *new_password, uint new_password_len) +int check_alter_user(THD *thd, const char *host, const char *user) { + int error = 1; if (!initialized) { my_error(ER_OPTION_PREVENTS_STATEMENT, MYF(0), "--skip-grant-tables"); - return(1); + goto end; } if (!thd->slave_thread && !thd->security_ctx->priv_user[0]) { my_message(ER_PASSWORD_ANONYMOUS_USER, ER(ER_PASSWORD_ANONYMOUS_USER), MYF(0)); - return(1); + goto end; } if (!host) // Role { my_error(ER_PASSWORD_NO_MATCH, MYF(0)); - return 1; + goto end; } if (!thd->slave_thread && (strcmp(thd->security_ctx->priv_user, user) || @@ -2560,16 +2578,44 @@ int check_change_password(THD *thd, const char *host, const char *user, thd->security_ctx->priv_host))) { if (check_access(thd, UPDATE_ACL, "mysql", NULL, NULL, 1, 0)) - return(1); + goto end; } + + error = 0; + +end: + return error; +} +/** + Check if the user is allowed to change password + + @param thd THD + @param host Hostname for the user + @param user User name + @param new_password New password + @param new_password_len The length of the new password + + new_password cannot be NULL + + @return Error status + @retval 0 OK + @retval 1 ERROR; In this case the error is sent to the client. +*/ + +int check_change_password(THD *thd, const char *host, const char *user, + char *new_password, uint new_password_len) +{ + if (check_alter_user(thd, host, user)) + return 1; + size_t len= strlen(new_password); if (len && len != SCRAMBLED_PASSWORD_CHAR_LENGTH && len != SCRAMBLED_PASSWORD_CHAR_LENGTH_323) { my_error(ER_PASSWD_LENGTH, MYF(0), SCRAMBLED_PASSWORD_CHAR_LENGTH); - return -1; + return 1; } - return(0); + return 0; } @@ -2669,6 +2715,152 @@ end: DBUG_RETURN(result); } +int acl_check_set_default_role(THD *thd, const char *host, const char *user) +{ + return check_alter_user(thd, host, user); +} + +int acl_set_default_role(THD *thd, const char *host, const char *user, + const char *rolename) +{ + TABLE_LIST tables; + TABLE *table; + char user_key[MAX_KEY_LENGTH]; + int result= 1; + int error; + bool clear_role= FALSE; + Rpl_filter *rpl_filter; + enum_binlog_format save_binlog_format; + + + DBUG_ENTER("acl_set_default_role"); + DBUG_PRINT("enter",("host: '%s' user: '%s' rolename: '%s'", + safe_str(user), safe_str(host), safe_str(rolename))); + + if (rolename == current_role.str) { + if (!thd->security_ctx->priv_role[0]) + rolename= "NONE"; + else + rolename= thd->security_ctx->priv_role; + } + + if (check_user_can_set_role(host, user, rolename, NULL)) + DBUG_RETURN(result); + + if (!strcasecmp(rolename, "NONE")) + clear_role= TRUE; + + tables.init_one_table("mysql", 5, "user", 4, "user", TL_WRITE); + +#ifdef HAVE_REPLICATION + /* + GRANT and REVOKE are applied the slave in/exclusion rules as they are + some kind of updates to the mysql.% tables. + */ + if (thd->slave_thread && + (rpl_filter= thd->system_thread_info.rpl_sql_info->rpl_filter)->is_on()) + { + /* + The tables must be marked "updating" so that tables_ok() takes them into + account in tests. It's ok to leave 'updating' set after tables_ok. + */ + tables.updating= 1; + /* Thanks to bzero, tables.next==0 */ + if (!(thd->spcont || rpl_filter->tables_ok(0, &tables))) + DBUG_RETURN(0); + } +#endif + + if (!(table= open_ltable(thd, &tables, TL_WRITE, MYSQL_LOCK_IGNORE_TIMEOUT))) + DBUG_RETURN(1); + + /* + This statement will be replicated as a statement, even when using + row-based replication. The flag will be reset at the end of the + statement. + This has to be handled here as it's called by set_var.cc, which is + not automaticly handled by sql_parse.cc + */ + save_binlog_format= thd->set_current_stmt_binlog_format_stmt(); + + mysql_mutex_lock(&acl_cache->lock); + ACL_USER *acl_user; + if (!(acl_user= find_user_exact(host, user))) + { + mysql_mutex_unlock(&acl_cache->lock); + my_message(ER_PASSWORD_NO_MATCH, ER(ER_PASSWORD_NO_MATCH), MYF(0)); + goto end; + } + + if (!clear_role) { + /* set new default_rolename */ + acl_user->default_rolename.str= safe_strdup_root(&acl_memroot, rolename); + acl_user->default_rolename.length= strlen(rolename); + } + else + { + /* clear the default_rolename */ + acl_user->default_rolename.str = NULL; + acl_user->default_rolename.length = 0; + } + + /* update the mysql.user table with the new default role */ + table->use_all_columns(); + if (table->s->fields < 45) + { + my_error(ER_COL_COUNT_DOESNT_MATCH_PLEASE_UPDATE, MYF(0), + table->alias.c_ptr(), DEFAULT_ROLE_COLUMN_IDX + 1, table->s->fields, + static_cast<int>(table->s->mysql_version), MYSQL_VERSION_ID); + mysql_mutex_unlock(&acl_cache->lock); + goto end; + } + table->field[0]->store(host,(uint) strlen(host), system_charset_info); + table->field[1]->store(user,(uint) strlen(user), system_charset_info); + key_copy((uchar *) user_key, table->record[0], table->key_info, + table->key_info->key_length); + + if (table->file->ha_index_read_idx_map(table->record[0], 0, + (uchar *) user_key, HA_WHOLE_KEY, + HA_READ_KEY_EXACT)) + { + mysql_mutex_unlock(&acl_cache->lock); + my_message(ER_PASSWORD_NO_MATCH, ER(ER_PASSWORD_NO_MATCH), MYF(0)); + goto end; + } + store_record(table, record[1]); + table->field[DEFAULT_ROLE_COLUMN_IDX]->store(acl_user->default_rolename.str, + acl_user->default_rolename.length, + system_charset_info); + if ((error=table->file->ha_update_row(table->record[1],table->record[0])) && + error != HA_ERR_RECORD_IS_THE_SAME) + { + mysql_mutex_unlock(&acl_cache->lock); + table->file->print_error(error,MYF(0)); /* purecov: deadcode */ + goto end; + } + + acl_cache->clear(1); + mysql_mutex_unlock(&acl_cache->lock); + result= 0; + if (mysql_bin_log.is_open()) + { + char buff[512]; + int query_length= + sprintf(buff,"SET DEFAULT ROLE '%-.120s' FOR '%-.120s'@'%-.120s'", + safe_str(acl_user->default_rolename.str), + safe_str(acl_user->user.str), + safe_str(acl_user->host.hostname)); + thd->clear_error(); + result= thd->binlog_query(THD::STMT_QUERY_TYPE, buff, query_length, + FALSE, FALSE, FALSE, 0); + } +end: + close_mysql_tables(thd); + thd->restore_stmt_binlog_format(save_binlog_format); + + DBUG_RETURN(result); +} + /* Find user in ACL @@ -12075,6 +12267,22 @@ bool acl_authenticate(THD *thd, uint com_change_user_pkt_len) */ sctx->db_access=0; +#ifndef NO_EMBEDDED_ACCESS_CHECKS + /* + In case the user has a default role set, attempt to set that role + */ + if (acl_user->default_rolename.length) { + ulonglong access= 0; + int result; + result= acl_check_setrole(thd, acl_user->default_rolename.str, &access); + if (!result) + result= acl_setrole(thd, acl_user->default_rolename.str, access); + if (result) + thd->clear_error(); // even if the default role was not granted, do not + // close the connection + } +#endif + /* Change a database if necessary */ if (mpvio.db.length) { diff --git a/sql/sql_acl.h b/sql/sql_acl.h index 3f628b5a08..7833fb8736 100644 --- a/sql/sql_acl.h +++ b/sql/sql_acl.h @@ -401,6 +401,9 @@ bool acl_check_proxy_grant_access (THD *thd, const char *host, const char *user, bool with_grant); int acl_setrole(THD *thd, char *rolename, ulonglong access); int acl_check_setrole(THD *thd, char *rolename, ulonglong *access); +int acl_check_set_default_role(THD *thd, const char *host, const char *user); +int acl_set_default_role(THD *thd, const char *host, const char *user, + const char *rolename); #ifndef DBUG_OFF extern ulong role_global_merges, role_db_merges, role_table_merges, diff --git a/sql/sql_yacc.yy b/sql/sql_yacc.yy index db569ad01f..a261d611aa 100644 --- a/sql/sql_yacc.yy +++ b/sql/sql_yacc.yy @@ -14667,10 +14667,39 @@ option_value_no_option_type: MYSQL_YYABORT; lex->var_list.push_back(var); } + | DEFAULT ROLE_SYM grant_role + { + LEX *lex = Lex; + LEX_USER *user; + if (!(user=(LEX_USER *) thd->calloc(sizeof(LEX_USER)))) + MYSQL_YYABORT; + user->user= current_user; + set_var_default_role *var= new set_var_default_role(user, + $3->user); + if (var == NULL) + MYSQL_YYABORT; + lex->var_list.push_back(var); + thd->lex->autocommit= TRUE; + if (lex->sphead) + lex->sphead->m_flags|= sp_head::HAS_SET_AUTOCOMMIT_STMT; + } + | DEFAULT ROLE_SYM grant_role FOR_SYM user + { + LEX *lex = Lex; + set_var_default_role *var= new set_var_default_role($5, $3->user); + if (var == NULL) + MYSQL_YYABORT; + lex->var_list.push_back(var); + thd->lex->autocommit= TRUE; + if (lex->sphead) + lex->sphead->m_flags|= sp_head::HAS_SET_AUTOCOMMIT_STMT; + } | ROLE_SYM ident_or_text { LEX *lex = Lex; set_var_role *var= new set_var_role($2); + if (var == NULL) + MYSQL_YYABORT; lex->var_list.push_back(var); } | PASSWORD equal text_or_password @@ -14710,6 +14739,7 @@ option_value_no_option_type: } ; + internal_variable_name: ident { -- 2.30.9