MDEV-20549 SQL SECURITY DEFINER does not work for INFORMATION_SCHEMA tables

switch to definer privileges when populating I_S tables

mysql-test/r/information_schema_db.result

@@ -244,3 +244,82 @@ connection user1;
 disconnect user1;
 connection default;
 set global sql_mode=default;
+create user foo@localhost;
+grant select on test.* to foo@localhost;
+create procedure rootonly() select 1;
+create sql security definer view v1d as select current_user(),user from information_schema.processlist;
+create sql security invoker view v1i as select current_user(),user from information_schema.processlist;
+create sql security definer view v2d as select table_name from information_schema.tables where table_schema='mysql' and table_name like '%user%';
+create sql security invoker view v2i as select table_name from information_schema.tables where table_schema='mysql' and table_name like '%user%';
+create sql security definer view v3d as select schema_name from information_schema.schemata where schema_name like '%mysql%';
+create sql security invoker view v3i as select schema_name from information_schema.schemata where schema_name like '%mysql%';
+create sql security definer view v4d as select routine_name from information_schema.routines where routine_schema='test';
+create sql security invoker view v4i as select routine_name from information_schema.routines where routine_schema='test';
+create sql security definer view v5d as select view_definition > '' from information_schema.views where table_name='v1d';
+create sql security invoker view v5i as select view_definition > '' from information_schema.views where table_name='v1d';
+connect foo,localhost,foo;
+select * from v1d;
+current_user()	user
+root@localhost	root
+root@localhost	root
+select * from v1i;
+current_user()	user
+foo@localhost	foo
+select * from v2d;
+table_name
+user
+select * from v2i;
+table_name
+select * from v3d;
+schema_name
+mysql
+select * from v3i;
+schema_name
+select * from v4d;
+routine_name
+rootonly
+select * from v4i;
+routine_name
+select * from v5d;
+view_definition > ''
+1
+select * from v5i;
+view_definition > ''
+0
+connection default;
+select * from v1d;
+current_user()	user
+root@localhost	foo
+root@localhost	root
+select * from v1i;
+current_user()	user
+root@localhost	foo
+root@localhost	root
+select * from v2d;
+table_name
+user
+select * from v2i;
+table_name
+user
+select * from v3d;
+schema_name
+mysql
+select * from v3i;
+schema_name
+mysql
+select * from v4d;
+routine_name
+rootonly
+select * from v4i;
+routine_name
+rootonly
+select * from v5d;
+view_definition > ''
+1
+select * from v5i;
+view_definition > ''
+1
+disconnect foo;
+drop view v1d, v1i, v2d, v2i, v3d, v3i, v4d, v4i, v5d, v5i;
+drop user foo@localhost;
+drop procedure rootonly;

mysql-test/suite/funcs_1/r/is_basics_mixed.result

@@ -337,7 +337,7 @@ GRANTEE	TABLE_CATALOG	TABLE_SCHEMA	TABLE_NAME	PRIVILEGE_TYPE	IS_GRANTABLE
 SELECT * FROM information_schema.schema_privileges
 WHERE table_schema = 'information_schema';
 GRANTEE	TABLE_CATALOG	TABLE_SCHEMA	PRIVILEGE_TYPE	IS_GRANTABLE
-CREATE VIEW db_datadict.v2 AS
+CREATE SQL SECURITY INVOKER VIEW db_datadict.v2 AS
 SELECT TABLE_SCHEMA,TABLE_NAME,TABLE_TYPE
 FROM information_schema.tables WHERE table_schema = 'db_datadict';
 SELECT TABLE_SCHEMA,TABLE_NAME,TABLE_TYPE

mysql-test/suite/funcs_1/t/is_basics_mixed.test

@@ -281,8 +281,9 @@ WHERE table_schema = 'information_schema';
 #          2. This user (testuser1) is also able to GRANT the SELECT privilege
 #             on this VIEW to another user (testuser2).
 #          3. The other user (testuser2) must be able to SELECT on this VIEW
-#             but gets a different result set than testuser1.
-CREATE VIEW db_datadict.v2 AS
+#             but gets a different result set than testuser1, if the view
+#             has SQL SECURITY INVOKER.
+CREATE SQL SECURITY INVOKER VIEW db_datadict.v2 AS
 SELECT TABLE_SCHEMA,TABLE_NAME,TABLE_TYPE
 FROM information_schema.tables WHERE table_schema = 'db_datadict';
 SELECT TABLE_SCHEMA,TABLE_NAME,TABLE_TYPE

mysql-test/suite/innodb/t/information_schema_grants.opt

+--enable-plugin-innodb-trx
+--enable-plugin-innodb-locks
+--enable-plugin-innodb-lock-waits
+--enable-plugin-innodb-cmp
+--enable-plugin-innodb-cmp-reset
+--enable-plugin-innodb-cmpmem
+--enable-plugin-innodb-cmpmem-reset
+--enable-plugin-innodb-cmp-per-index
+--enable-plugin-innodb-cmp-per-index-reset
+--enable-plugin-innodb-buffer-page
+--enable-plugin-innodb-buffer-page-lru
+--enable-plugin-innodb-buffer-pool-stats
+--enable-plugin-innodb-metrics
+--enable-plugin-innodb-ft-default-stopword
+--enable-plugin-innodb-ft-deleted
+--enable-plugin-innodb-ft-being-deleted
+--enable-plugin-innodb-ft-config
+--enable-plugin-innodb-ft-index-cache
+--enable-plugin-innodb-ft-index-table
+--enable-plugin-innodb-sys-tables
+--enable-plugin-innodb-sys-tablestats
+--enable-plugin-innodb-sys-indexes
+--enable-plugin-innodb-sys-columns
+--enable-plugin-innodb-sys-fields
+--enable-plugin-innodb-sys-foreign
+--enable-plugin-innodb-sys-foreign-cols
+--enable-plugin-innodb-sys-tablespaces
+--enable-plugin-innodb-sys-datafiles
+--enable-plugin-innodb-sys-virtual
+--enable-plugin-innodb-mutexes
+--enable-plugin-innodb-sys-semaphore-waits
+--enable-plugin-innodb-tablespaces-encryption
+--enable-plugin-innodb-tablespaces-scrubbing

mysql-test/t/information_schema_db.test

@@ -255,3 +255,47 @@ disconnect user1;
 connection default;
 
 set global sql_mode=default;
+
+#
+# MDEV-20549 SQL SECURITY DEFINER does not work for INFORMATION_SCHEMA tables
+#
+
+create user foo@localhost;
+grant select on test.* to foo@localhost;
+create procedure rootonly() select 1;
+create sql security definer view v1d as select current_user(),user from information_schema.processlist;
+create sql security invoker view v1i as select current_user(),user from information_schema.processlist;
+create sql security definer view v2d as select table_name from information_schema.tables where table_schema='mysql' and table_name like '%user%';
+create sql security invoker view v2i as select table_name from information_schema.tables where table_schema='mysql' and table_name like '%user%';
+create sql security definer view v3d as select schema_name from information_schema.schemata where schema_name like '%mysql%';
+create sql security invoker view v3i as select schema_name from information_schema.schemata where schema_name like '%mysql%';
+create sql security definer view v4d as select routine_name from information_schema.routines where routine_schema='test';
+create sql security invoker view v4i as select routine_name from information_schema.routines where routine_schema='test';
+create sql security definer view v5d as select view_definition > '' from information_schema.views where table_name='v1d';
+create sql security invoker view v5i as select view_definition > '' from information_schema.views where table_name='v1d';
+connect foo,localhost,foo;
+select * from v1d;
+select * from v1i;
+select * from v2d;
+select * from v2i;
+select * from v3d;
+select * from v3i;
+select * from v4d;
+select * from v4i;
+select * from v5d;
+select * from v5i;
+connection default;
+select * from v1d;
+select * from v1i;
+select * from v2d;
+select * from v2i;
+select * from v3d;
+select * from v3i;
+select * from v4d;
+select * from v4i;
+select * from v5d;
+select * from v5i;
+disconnect foo;
+drop view v1d, v1i, v2d, v2i, v3d, v3i, v4d, v4i, v5d, v5i;
+drop user foo@localhost;
+drop procedure rootonly;

sql/sql_show.cc

@@ -8429,6 +8429,7 @@ bool get_schema_tables_result(JOIN *join,
         cond= tab->cache_select->cond;
       }
 
+      Switch_to_definer_security_ctx backup_ctx(thd, table_list);
       if (table_list->schema_table->fill_table(thd, table_list, cond))
       {
         result= 1;