Skip to content
/ server Public

MDEV-38601 require FEDERATED ADMIN for SHOW CREATE SERVER #4743

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
MooSayed1 wants to merge 1 commit into
base: 11.8
Choose a base branch
from
+69 −0
Open

MDEV-38601 require FEDERATED ADMIN for SHOW CREATE SERVER #4743

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 30 additions & 0 deletions mysql-test/main/grant_server.result
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,3 +69,33 @@ DROP USER user1@localhost;
#
# End of 10.5 tests
#
#
# Start of 11.8 tests
#
#
# MDEV-38601 SHOW CREATE SERVER does not require FEDERATED ADMIN
#
CREATE SERVER srv FOREIGN DATA WRAPPER mysql
OPTIONS (USER 'remote_user', HOST 'localhost', PASSWORD 'secret', DATABASE 'test2');
CREATE USER user1@localhost IDENTIFIED BY '';
GRANT ALL PRIVILEGES ON *.* TO user1@localhost;
REVOKE FEDERATED ADMIN, SUPER ON *.* FROM user1@localhost;
Copy link
Member

@gkodinov gkodinov Mar 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why are you revoking SUPER as well? Would SUPER allow SHOW CREATE SERVER? If it would, please document that into the Jira and the commit message.
And also add tests please.

connect con1,localhost,user1,,;
connection con1;
SHOW CREATE SERVER srv;
ERROR 42000: Access denied; you need (at least one of) the FEDERATED ADMIN privilege(s) for this operation
disconnect con1;
connection default;
GRANT FEDERATED ADMIN ON *.* TO user1@localhost;
connect con1,localhost,user1,,;
connection con1;
SHOW CREATE SERVER srv;
Server Create Server
srv CREATE SERVER `srv` FOREIGN DATA WRAPPER mysql OPTIONS (USER 'remote_user', HOST 'localhost', PASSWORD 'secret', DATABASE 'test2');
disconnect con1;
connection default;
DROP SERVER srv;
DROP USER user1@localhost;
#
# End of 11.8 tests
#
37 changes: 37 additions & 0 deletions mysql-test/main/grant_server.test
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,3 +80,40 @@ DROP USER user1@localhost;
--echo #
--echo # End of 10.5 tests
--echo #

--echo #
--echo # Start of 11.8 tests
--echo #

--echo #
--echo # MDEV-38601 SHOW CREATE SERVER does not require FEDERATED ADMIN
--echo #

CREATE SERVER srv FOREIGN DATA WRAPPER mysql
OPTIONS (USER 'remote_user', HOST 'localhost', PASSWORD 'secret', DATABASE 'test2');

CREATE USER user1@localhost IDENTIFIED BY '';
GRANT ALL PRIVILEGES ON *.* TO user1@localhost;
REVOKE FEDERATED ADMIN, SUPER ON *.* FROM user1@localhost;

connect (con1,localhost,user1,,);
connection con1;
--error ER_SPECIFIC_ACCESS_DENIED_ERROR
SHOW CREATE SERVER srv;
disconnect con1;

connection default;
GRANT FEDERATED ADMIN ON *.* TO user1@localhost;

connect (con1,localhost,user1,,);
connection con1;
SHOW CREATE SERVER srv;
disconnect con1;

connection default;
DROP SERVER srv;
DROP USER user1@localhost;

--echo #
--echo # End of 11.8 tests
--echo #
2 changes: 2 additions & 0 deletions sql/sql_parse.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5174,6 +5174,8 @@ mysql_execute_command(THD *thd, bool is_called_from_prepared_stmt)
res= show_create_db(thd, lex);
break;
case SQLCOM_SHOW_CREATE_SERVER:
if (check_global_access(thd, PRIV_STMT_CREATE_SERVER))
Copy link
Member

@gkodinov gkodinov Mar 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not the final reviewer, but here's my two cents (feel free to ignore completely):

It usually is not a good idea to reuse privileges. This turns them into roles (guarding access to multiple operations vs guarding a single operation). I'd advocate to adding a different privilege, to go inline with the already very atomic privileges for CREATE, ALTER and DROP SERVER.

Ideally servers would be like any other SQL object and the privileges to them would not be global. But it's what it is: they are global.

If you absolutely must reuse any of the privileges, I'd suggest reusing ALTER or (DROP + CREATE). As this would be how you can reroute already existing code to new servers. But I'd definitely advise against this.

break;
WSREP_SYNC_WAIT(thd, WSREP_SYNC_WAIT_BEFORE_SHOW);
res= mysql_show_create_server(thd, &lex->name);
break;
Expand Down