Merge lp:~gl-az/percona-server/BT23597_utility-user-access_5.6 into lp:percona-server/5.6

[George Ormond Lorch III]

Merge utility-user-access from 5.5

[George Ormond Lorch III (gl-az)]

23597
jenkins http://jenkins.percona.com/view/PS%205.6/job/percona-server-5.6-param/225/

[Sergei Glushchenko (sergei.glushchenko)]

See comments on 5.5 version of MP

review: Needs Fixing (g2)

[George Ormond Lorch III (gl-az)]

Same comments as 5.5 MP

http://jenkins.percona.com/view/PS%205.6/job/percona-server-5.6-param/228/

[Sergei Glushchenko (sergei.glushchenko)]

Looks good George, but please create separate blueprint for 5.6 and link this branch to it. Approve.

review: Approve (g2)

[George Ormond Lorch III (gl-az)]

Ahh yeah, totally forgot about the duplicate blueprint thing...again.
Will do in just a minute here.

On 8/21/2013 12:46 PM, Sergei Glushchenko wrote:
> Review: Approve g2
>
> Looks good George, but please create separate blueprint for 5.6 and link this branch to it. Approve.

--
George O. Lorch III
Software Engineer, Percona
[phone] x542 US/Arizona (GMT -7)
skype: george.ormond.lorch.iii

[Laurynas Biveinis (laurynas-biveinis)]

Same comments as for 5.5 MP.

review: Needs Fixing

[George Ormond Lorch III (gl-az)]

See comments, fixes and manual test results in 5.5
http://jenkins.percona.com/view/PS%205.6/job/percona-server-5.6-param/230/

[George Ormond Lorch III (gl-az)]

Merged again from 5.5
http://jenkins.percona.com/view/PS%205.6/job/percona-server-5.6-param/231/

[George Ormond Lorch III (gl-az)]

Oops, lets try this again with the right branch in jenkins
http://jenkins.percona.com/view/PS%205.6/job/percona-server-5.6-param/232/

[Alexey Kopytov (akopytov)]

Same comments as in 5.5.

review: Needs Fixing

[George Ormond Lorch III (gl-az)]

fixes re-ported from 5.5
http://jenkins.percona.com/view/PS%205.6/job/percona-server-5.6-param/236/

[Laurynas Biveinis (laurynas-biveinis)]

Same concern as with the 5.5 MP.

review: Needs Fixing

[George Ormond Lorch III (gl-az)]

re-port from 5.5 and jenkins http://jenkins.percona.com/view/PS%205.6/job/percona-server-5.6-param/237/

[Laurynas Biveinis (laurynas-biveinis)]

s/priviliges/privileges/g in the testcase comments. This fix does not need a Jenkins re-run or another MP.

Leaving as Needs Review for Alexey.

review: Approve

[Alexey Kopytov (akopytov)]

review: Approve

=== modified file 'Percona-Server/mysql-test/r/mysqld--help-notwin.result'
--- Percona-Server/mysql-test/r/mysqld--help-notwin.result	2013-08-06 15:16:34 +0000
+++ Percona-Server/mysql-test/r/mysqld--help-notwin.result	2013-08-27 20:56:36 +0000
@@ -1044,6 +1044,10 @@
  list of users and recognized as the utility user.
  --utility-user-password=name 
  Specifies the password required for the utility user.
+ --utility-user-privileges=name 
+ Specifies the privileges that the utility user will have
+ in a comma delimited list. See the manual for a complete
+ list of privileges.
  --utility-user-schema-access=name 
  Specifies the schemas that the utility user has access to
  in a comma delimited list.
@@ -1366,6 +1370,7 @@
 userstat FALSE
 utility-user (No default value)
 utility-user-password (No default value)
+utility-user-privileges 
 utility-user-schema-access (No default value)
 validate-user-plugins TRUE
 verbose TRUE
 
=== modified file 'Percona-Server/mysql-test/r/mysqld--help-win.result'
--- Percona-Server/mysql-test/r/mysqld--help-win.result	2013-08-06 15:16:34 +0000
+++ Percona-Server/mysql-test/r/mysqld--help-win.result	2013-08-27 20:56:36 +0000
@@ -1008,6 +1008,10 @@
  list of users and recognized as the utility user.
  --utility-user-password=name 
  Specifies the password required for the utility user.
+ --utility-user-privileges=name 
+ Specifies the privileges that the utility user will have
+ in a comma delimited list. See the manual for a complete
+ list of privileges.
  --utility-user-schema-access=name 
  Specifies the schemas that the utility user has access to
  in a comma delimited list.
@@ -1311,6 +1315,7 @@
 updatable-views-with-limit YES
 utility-user (No default value)
 utility-user-password (No default value)
+utility-user-privileges 
 utility-user-schema-access (No default value)
 validate-user-plugins TRUE
 verbose TRUE
 
=== modified file 'Percona-Server/mysql-test/r/percona_utility_user.result'
--- Percona-Server/mysql-test/r/percona_utility_user.result	2013-05-06 15:43:51 +0000
+++ Percona-Server/mysql-test/r/percona_utility_user.result	2013-08-27 20:56:36 +0000
@@ -35,8 +35,6 @@
 ERROR HY000: Operation DROP USER failed for 'frank'@'localhost'
 DROP USER 'frank'@'%';
 ERROR HY000: Operation DROP USER failed for 'frank'@'%'
-CREATE DATABASE mysqltest;
-CREATE TABLE mysqltest.t1 (a INT, b INT);
 CREATE USER 'mysqltest_1'@'localhost';
 SELECT user FROM mysql.user WHERE user LIKE 'frank';
 user
@@ -49,19 +47,27 @@
 SHOW DATABASES;
 Database
 information_schema
+mtr
 mysql
 performance_schema
+test
 CREATE USER 'frankjr'@'localhost' IDENTIFIED BY 'password';
 GRANT ALL ON mysql.* TO 'frankjr'@'localhost';
 REVOKE ALL PRIVILEGES, GRANT OPTION FROM 'frankjr'@'localhost';
 SET PASSWORD FOR 'frankjr'@'localhost' = PASSWORD('');
 DROP USER 'frankjr'@'localhost';
+CREATE DATABASE mysqltest;
+CREATE TABLE mysqltest.t1 (a INT, b INT);
 SHOW TABLES IN mysqltest;
-ERROR 42000: Access denied for user 'frank'@'%' to database 'mysqltest'
-CREATE DATABASE foobar;
-ERROR 42000: Access denied for user 'frank'@'%' to database 'foobar'
+Tables_in_mysqltest
+t1
+INSERT INTO mysqltest.t1(a, b) VALUES (1, 1);
+ERROR 42000: INSERT command denied to user 'frank'@'localhost' for table 't1'
+SELECT * FROM mysqltest.t1;
+ERROR 42000: SELECT command denied to user 'frank'@'localhost' for table 't1'
+ALTER TABLE mysqltest.t1 DROP COLUMN b;
+ERROR 42000: ALTER command denied to user 'frank'@'localhost' for table 't1'
 DROP DATABASE mysqltest;
-ERROR 42000: Access denied for user 'frank'@'%' to database 'mysqltest'
 SET PASSWORD FOR 'mysqltest_1'@'localhost' = PASSWORD('newpass');
 SET @testtemp= @@global.innodb_fast_shutdown;
 SET @@global.innodb_fast_shutdown= 2;
@@ -74,7 +80,6 @@
 0
 SET @@global.innodb_fast_shutdown= @testtemp;
 DROP USER 'mysqltest_1'@'localhost';
-DROP DATABASE mysqltest;
 CREATE USER plug IDENTIFIED WITH 'test_plugin_server' AS 'frank';
 SELECT plugin,authentication_string FROM mysql.user WHERE User='plug';
 plugin	authentication_string
 
=== modified file 'Percona-Server/mysql-test/t/percona_utility_user-master.opt'
--- Percona-Server/mysql-test/t/percona_utility_user-master.opt	2013-05-06 15:43:51 +0000
+++ Percona-Server/mysql-test/t/percona_utility_user-master.opt	2013-08-27 20:56:36 +0000
@@ -1,1 +1,1 @@
---utility_user=frank@% --utility_user_password=password --utility_user_schema_access=mysql,performance_schema $PLUGIN_AUTH_OPT $PLUGIN_AUTH_LOAD
+--utility_user=frank@% --utility_user_password=password --utility_user_schema_access=mysql,performance_schema --utility-user-privileges="CREATE,DROP,SHOW DATABASES" $PLUGIN_AUTH_OPT $PLUGIN_AUTH_LOAD
 
=== modified file 'Percona-Server/mysql-test/t/percona_utility_user.test'
--- Percona-Server/mysql-test/t/percona_utility_user.test	2013-05-06 15:43:51 +0000
+++ Percona-Server/mysql-test/t/percona_utility_user.test	2013-08-27 20:56:36 +0000
@@ -66,8 +66,6 @@
 --error ER_CANNOT_USER 
 DROP USER 'frank'@'%';
 
-CREATE DATABASE mysqltest;
-CREATE TABLE mysqltest.t1 (a INT, b INT);
 CREATE USER 'mysqltest_1'@'localhost';
 
 connect (frank,localhost,frank,password,mysql);
@@ -91,13 +89,28 @@
 
 DROP USER 'frankjr'@'localhost';
 
---error ER_DBACCESS_DENIED_ERROR
+# Allowed because --utility-user-priviliges has CREATE
+CREATE DATABASE mysqltest;
+
+# Allowed because --utility-user-priviliges has CREATE
+CREATE TABLE mysqltest.t1 (a INT, b INT);
+
+# Allowed because --utility-user-priviliges has SHOW DATABASES
 SHOW TABLES IN mysqltest;
 
---error ER_DBACCESS_DENIED_ERROR
-CREATE DATABASE foobar;
-
---error ER_DBACCESS_DENIED_ERROR
+# NOT allowed because --utility-user-priviliges does not have INSERT
+--error ER_TABLEACCESS_DENIED_ERROR
+INSERT INTO mysqltest.t1(a, b) VALUES (1, 1);
+
+# NOT allowed because --utility-user-priviliges does not have SELECT
+--error ER_TABLEACCESS_DENIED_ERROR
+SELECT * FROM mysqltest.t1;
+
+# NOT allowed because --utility-user-priviliges does not have ALTER
+--error ER_TABLEACCESS_DENIED_ERROR
+ALTER TABLE mysqltest.t1 DROP COLUMN b;
+
+# Allowed because --utility-user-priviliges has DROP
 DROP DATABASE mysqltest;
 
 SET PASSWORD FOR 'mysqltest_1'@'localhost' = PASSWORD('newpass');
@@ -110,11 +123,12 @@
 SET @@global.innodb_fast_shutdown= @testtemp;
 
 connection default;
+disconnect frank;
 
+#
+# cleanup from above tests
+#
 DROP USER 'mysqltest_1'@'localhost';
-DROP DATABASE mysqltest;
-
-disconnect frank;
 
 #
 # Try to impersonate a proxied utility_user
 
=== modified file 'Percona-Server/sql/mysqld.cc'
--- Percona-Server/sql/mysqld.cc	2013-08-14 03:57:21 +0000
+++ Percona-Server/sql/mysqld.cc	2013-08-27 20:56:36 +0000
@@ -715,6 +715,10 @@
 char* utility_user_password= NULL;
 char* utility_user_schema_access= NULL;
 
+/* Plucking this from sql/sql_acl.cc for an array of privilege names */
+extern TYPELIB utility_user_privileges_typelib;
+ulonglong utility_user_privileges= 0;
+
 /* Thread specific variables */
 
 pthread_key(MEM_ROOT**,THR_MALLOC);
@@ -7389,6 +7393,11 @@
    "utility user.",
    &utility_user_password, 0, 0, GET_STR, REQUIRED_ARG,
    0, 0, 0, 0, 0, 0},
+  {"utility_user_privileges", 0, "Specifies the privileges that the utility "
+   "user will have in a comma delimited list. See the manual for a complete "
+   "list of privileges.",
+   &utility_user_privileges, 0, &utility_user_privileges_typelib,
+   GET_SET, REQUIRED_ARG, 0, 0, 0, 0, 0, 0},
   {"utility_user_schema_access", 0, "Specifies the schemas that the utility "
    "user has access to in a comma delimited list.",
    &utility_user_schema_access, 0, 0, GET_STR, REQUIRED_ARG,
 
=== modified file 'Percona-Server/sql/mysqld.h'
--- Percona-Server/sql/mysqld.h	2013-08-06 15:16:34 +0000
+++ Percona-Server/sql/mysqld.h	2013-08-27 20:56:36 +0000
@@ -312,6 +312,7 @@
 extern char* utility_user;
 extern char* utility_user_password;
 extern char* utility_user_schema_access;
+extern ulonglong utility_user_privileges;
 
 /*
   THR_MALLOC is a key which will be used to set/get MEM_ROOT** for a thread,
 
=== modified file 'Percona-Server/sql/sql_acl.cc'
--- Percona-Server/sql/sql_acl.cc	2013-08-14 03:57:21 +0000
+++ Percona-Server/sql/sql_acl.cc	2013-08-27 20:56:36 +0000
@@ -1749,7 +1749,25 @@
     goto cleanup;
   }
 
-  acl_utility_user.access= 0;
+  DBUG_ASSERT(utility_user_privileges <= UINT_MAX32);
+  acl_utility_user.access= utility_user_privileges & UINT_MAX32;
+  if (acl_utility_user.access)
+  {
+    char privilege_desc[512];
+    get_privilege_desc(privilege_desc, array_elements(privilege_desc), acl_utility_user.access);
+    sql_print_information("Utility user '%s'@'%s' in use with access rights "
+                          "'%s'.",
+                          acl_utility_user.user,
+                          acl_utility_user.host.get_host(),
+                          privilege_desc);
+  }
+  else
+  {
+    sql_print_information("Utility user '%s'@'%s' in use with basic "
+                          "access rights.",
+                          acl_utility_user.user,
+                          acl_utility_user.host.get_host());
+  }
 
   acl_utility_user.ssl_type= SSL_TYPE_NONE;
 
@@ -6517,13 +6535,21 @@
   "ALTER", "SHOW DATABASES", "SUPER", "CREATE TEMPORARY TABLES",
   "LOCK TABLES", "EXECUTE", "REPLICATION SLAVE", "REPLICATION CLIENT",
   "CREATE VIEW", "SHOW VIEW", "CREATE ROUTINE", "ALTER ROUTINE",
-  "CREATE USER", "EVENT", "TRIGGER", "CREATE TABLESPACE"
+  "CREATE USER", "EVENT", "TRIGGER", "CREATE TABLESPACE", 0
+};
+
+TYPELIB utility_user_privileges_typelib=
+{
+  array_elements(command_array) - 1,
+  "utility_user_privileges_typelib",
+  command_array,
+  NULL
 };
 
 uint command_lengths[]=
 {
   6, 6, 6, 6, 6, 4, 6, 8, 7, 4, 5, 10, 5, 5, 14, 5, 23, 11, 7, 17, 18, 11, 9,
-  14, 13, 11, 5, 7, 17
+  14, 13, 11, 5, 7, 17, 0
 };
 
 #ifndef NO_EMBEDDED_ACCESS_CHECKS