Skip to content

privilege: add DDL and DML privilege check for system tables#15095

Merged
crazycs520 merged 6 commits intopingcap:masterfrom
djshow832:delete_stmt_summary
Mar 4, 2020
Merged

privilege: add DDL and DML privilege check for system tables#15095
crazycs520 merged 6 commits intopingcap:masterfrom
djshow832:delete_stmt_summary

Conversation

@djshow832
Copy link
Contributor

What problem does this PR solve?

Add DDL and DML privilege check for system tables in performance_schema and metrics_schema.

What is changed and how it works?

Prevent users from executing ALTER, DROP, INDEX, INSERT, UPDATE, DELETE statements on predefined tables.
Privileges of those tables which are defined in these schema by users themselves are kept untouched.

Check List

Tests

  • Unit test
  • Manual test (add detailed scripts or steps below)
mysql> delete from events_statements_summary_by_digest;
ERROR 8121 (HY000): privilege check fail

Code changes

  • Has exported function/method change

Side effects

  • Breaking backward compatibility

Related changes

N/A

Release note

  • Forbid users to execute DDL and update/delete/insert predefined tables in performance_schema and metrics_schema.
  • Compatibility declaration: Executing DDL and update/delete/insert predefined tables in performance_schema and metrics_schema are not allowed any longer.

@codecov
Copy link

codecov bot commented Mar 3, 2020

Codecov Report

❗ No coverage uploaded for pull request base (master@2be64f6). Click here to learn what that means.
The diff coverage is 51.9607%.

@@             Coverage Diff             @@
##             master     #15095   +/-   ##
===========================================
  Coverage          ?   80.6817%           
===========================================
  Files             ?        502           
  Lines             ?     134686           
  Branches          ?          0           
===========================================
  Hits              ?     108667           
  Misses            ?      17616           
  Partials          ?       8403

@djshow832
Copy link
Contributor Author

/run-all-tests

@djshow832 djshow832 force-pushed the delete_stmt_summary branch from cb5b63c to 5396c94 Compare March 3, 2020 10:16
@djshow832 djshow832 closed this Mar 3, 2020
@djshow832 djshow832 reopened this Mar 3, 2020
Copy link
Contributor

@AilinKid AilinKid left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Rest LGTM

Copy link
Contributor

@AilinKid AilinKid left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Copy link
Contributor

@Deardrops Deardrops left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@djshow832
Copy link
Contributor Author

/merge

@djshow832
Copy link
Contributor Author

/merge

@crazycs520 crazycs520 merged commit 9df0780 into pingcap:master Mar 4, 2020
@djshow832 djshow832 added compatibility-breaker Violation of forwards/backwards compatibility in a design-time piece. needs-cherry-pick-3.0 labels Mar 10, 2020
@djshow832
Copy link
Contributor Author

/run-cherry-picker

@sre-bot
Copy link
Contributor

sre-bot commented Mar 17, 2020

cherry pick to release-3.0 in PR #15417

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

compatibility-breaker Violation of forwards/backwards compatibility in a design-time piece. component/infoschema component/privilege

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants