MySQL 9.1.0
Source Code Documentation
DB_restrictions_aggregator_global_grant Class Referencefinal

Restriction aggregator for GRANT statement for GLOBAL privileges. More...

#include <partial_revokes.h>

Inheritance diagram for DB_restrictions_aggregator_global_grant:
[legend]

Private Member Functions

 DB_restrictions_aggregator_global_grant (const Auth_id &grantor, const Auth_id grantee, const Access_bitmask grantor_global_access, const Access_bitmask grantee_global_access, const DB_restrictions &grantor_restrictions, const DB_restrictions &grantee_restrictions, const Access_bitmask requested_access, const Security_context *sctx)
 DB_restrictions_aggregator_global_grant constructor. More...
 
Status validate () override
 Evaluates the restrictions list of grantor and grantee, as well as requested privilege. More...
 
void aggregate (DB_restrictions &restrictions) override
 Generates DB_restrictions based on the requested access, grantor and grantee's DB_restrictions in the ACL cache. More...
 

Friends

class Restrictions_aggregator_factory
 

Additional Inherited Members

- Public Member Functions inherited from DB_restrictions_aggregator
bool generate (Abstract_restrictions &restrictions) override
 Driver function to aggregate restriction lists. More...
 
- Public Member Functions inherited from Restrictions_aggregator
virtual ~Restrictions_aggregator ()
 Destructor. More...
 
- Protected Types inherited from DB_restrictions_aggregator
enum class  SQL_OP { SET_ROLE , GLOBAL_GRANT }
 
using Status = Restrictions_aggregator::Status
 
- Protected Types inherited from Restrictions_aggregator
enum class  Status {
  Error , Warning , Validated , Aggregated ,
  No_op
}
 
- Protected Member Functions inherited from DB_restrictions_aggregator
 DB_restrictions_aggregator (const Auth_id &grantor, const Auth_id grantee, const Access_bitmask grantor_global_access, const Access_bitmask grantee_global_access, const DB_restrictions &grantor_restrictions, const DB_restrictions &grantee_restrictions, const Access_bitmask requested_access, const Security_context *sctx)
 Constructor for database level restrictions aggregator. More...
 
bool find_if_require_next_level_operation (Access_bitmask &rights) const override
 Get list of privileges that are not restricted through restriction list. More...
 
bool check_db_access_and_restrictions_collision (const Access_bitmask grantee_db_access, const Access_bitmask grantee_restrictions, const std::string &db_name) noexcept
 Check possible descrepancy between DB access being granted and existing restrictions. More...
 
void set_if_db_level_operation (const Access_bitmask requested_access, const Access_bitmask restrictions_mask) noexcept
 Set privileges that needs to be processed further. More...
 
void aggregate_restrictions (SQL_OP sql_op, const Db_access_map *m_db_map, DB_restrictions &restrictions)
 A helper method that aggregates the restrictions for global_grant and set_role operations since both are similar in nature. More...
 
Access_bitmask get_grantee_db_access (const std::string &db_name) const
 Fetches the grantee's DB access on the specified DB If security context of current user exists and has some active roles then probe the security context since current user must be grantee. More...
 
void get_grantee_db_access (const std::string &db_name, Access_bitmask &access) const
 Fetches the grantee's DB access on the specified DB If security context of current user exists and has some active roles then probe the security context since current user must be grantee. More...
 
- Protected Member Functions inherited from Restrictions_aggregator
 Restrictions_aggregator (const Auth_id &grantor, const Auth_id grantee, const Access_bitmask grantor_global_access, const Access_bitmask grantee_global_access, const Access_bitmask requested_access)
 Constructor. More...
 
 Restrictions_aggregator (const Restrictions_aggregator &)=delete
 
Restrictions_aggregatoroperator= (const Restrictions_aggregator &)=delete
 
 Restrictions_aggregator (const Restrictions_aggregator &&)=delete
 
Restrictions_aggregatoroperator= (const Restrictions_aggregator &&)=delete
 
- Protected Attributes inherited from DB_restrictions_aggregator
Access_bitmask m_privs_not_processed = 0
 Privileges that needs to be checked further through DB grants. More...
 
DB_restrictions m_grantor_rl
 Database restrictions for grantor. More...
 
DB_restrictions m_grantee_rl
 Database restrictions for grantee. More...
 
const Security_contextm_sctx
 Security context of the current user. More...
 
- Protected Attributes inherited from Restrictions_aggregator
const Auth_id m_grantor
 Grantor information. More...
 
const Auth_id m_grantee
 Grantee information. More...
 
const Access_bitmask m_grantor_global_access
 Global static privileges of grantor. More...
 
const Access_bitmask m_grantee_global_access
 Global static privileges of grantee. More...
 
const Access_bitmask m_requested_access
 Privileges that are being granted or revoked. More...
 
Status m_status
 Internal status of aggregation process. More...
 

Detailed Description

Restriction aggregator for GRANT statement for GLOBAL privileges.

Constructor & Destructor Documentation

◆ DB_restrictions_aggregator_global_grant()

DB_restrictions_aggregator_global_grant::DB_restrictions_aggregator_global_grant ( const Auth_id grantor,
const Auth_id  grantee,
const Access_bitmask  grantor_global_access,
const Access_bitmask  grantee_global_access,
const DB_restrictions grantor_db_restrictions,
const DB_restrictions grantee_db_restrictions,
const Access_bitmask  requested_access,
const Security_context sctx 
)
private

DB_restrictions_aggregator_global_grant constructor.

Parameters
[in]grantorGrantor's user name and host info
[in]granteeGrantee's user name and host info
[in]grantor_global_accessCurrent privileges mask of grantor
[in]grantee_global_accessCurrent privileges mask of grantee
[in]grantor_db_restrictionsDB_restrictions of grantor
[in]grantee_db_restrictionsDB_restrictions of grantee
[in]requested_accessRequested privileges mask in the SQL statement
[in]sctxSecurity_context of current user. Default value is nullptr

Member Function Documentation

◆ aggregate()

void DB_restrictions_aggregator_global_grant::aggregate ( DB_restrictions restrictions)
overrideprivatevirtual

Generates DB_restrictions based on the requested access, grantor and grantee's DB_restrictions in the ACL cache.

  • If grantor has restrictions
    • Retain Grantee's restrictions if it has more privileges than grantor
    • If grantee has restrictions than aggregate them
    • If grantee does not have restrictions keep only those restrictions of grantor for which there is no DB level access to grantee.
  • else if grantee has restrictions
    • Remove the restrictions on which global grant is requested.
Parameters
[out]restrictionsFills the parameter with the generated DB_restrictions

Implements DB_restrictions_aggregator.

◆ validate()

Restrictions_aggregator::Status DB_restrictions_aggregator_global_grant::validate ( )
overrideprivatevirtual

Evaluates the restrictions list of grantor and grantee, as well as requested privilege.

  • Checks possible descrepancy between DB access being granted and existing restrictions.
Returns
Status Moves the object in the appropriate status. For instance :
  • Validated, if validation was performed successfully
  • NO_op, if there is no aggregation of privileges required.
  • Error, if an error encountered

Implements DB_restrictions_aggregator.

Friends And Related Function Documentation

◆ Restrictions_aggregator_factory

friend class Restrictions_aggregator_factory
friend

The documentation for this class was generated from the following files: