MySQL  8.0.23
Source Code Documentation
security_context.h
Go to the documentation of this file.
1 /* Copyright (c) 2017, 2020, Oracle and/or its affiliates. All rights reserved.
2 
3 This program is free software; you can redistribute it and/or modify
4 it under the terms of the GNU General Public License, version 2.0,
5 as published by the Free Software Foundation.
6 
7 This program is also distributed with certain software (including
8 but not limited to OpenSSL) that is licensed under separate terms,
9 as designated in a particular file or component or in included license
10 documentation. The authors of MySQL hereby grant you an additional
11 permission to link the program and your derivative works with the
12 separately licensed software that they have included with MySQL.
13 
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License, version 2.0, for more details.
18 
19 You should have received a copy of the GNU General Public License
20 along with this program; if not, write to the Free Software
21 Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA */
22 
23 #ifndef SECURITY_CONTEXT_H
24 #define SECURITY_CONTEXT_H
25 
28 
29 /**
30  Below are the set of services provides methods for components to manipulate
31  the thread's security context.
32  * mysql_thd_security_context
33  * mysql_security_context_factory
34  * mysql_account_database_security_context_lookup
35  * mysql_security_context_options
36 
37  These services allows creation, copying, filling in by user accout and
38  destruction of security context objects. It also allows getting and setting
39  the security context for a thread. And it also allows reading and setting
40  security context properties.
41 
42  The range of the above services allows components to inspect the security
43  context they're running it, impersonate a user account of their choice
44  (a.k.a. sudo in Unix) and craft a security context not related to an
45  existing user account.
46 
47  No authentication is done in any of the above services. Authentication is
48  specific to the media and does not belong to the security context, that's
49  used mostly for authorization.
50 
51  Make sure you keep the original security context of a thread or restore it
52  when done, as leaving a different security context active may lead to various
53  kinds of problems.
54 */
55 
56 /* manipulates the THD relationship to the security context */
57 BEGIN_SERVICE_DEFINITION(mysql_thd_security_context)
58 /**
59  Gets the security context for the thread.
60 
61  @param[in] _thd The thread to get the context from
62  @param[out] out_ctx placeholder for the security context handle
63  @retval true failure
64  @retval false success
65 */
67 
68 /**
69  Sets a new security context for the thread.
70 
71  @param[in] _thd The thread to set the context to
72  @param[in] in_ctx The handle of the new security context
73  @retval true failure
74  @retval false success
75 */
77 END_SERVICE_DEFINITION(mysql_thd_security_context)
78 
79 /* factory methods: allocate, deallocate, copy */
80 BEGIN_SERVICE_DEFINITION(mysql_security_context_factory)
81 /**
82  Creates a new security context and initializes it with the defaults
83  (no access, no user etc).
84 
85  @param[out] out_ctx placeholder for the newly created security context
86  handle
87  @retval true failure
88  @retval false success
89 */
91 
92 /**
93  Deallocates a security context.
94 
95  @param[in] ctx The handle of the security context to destroy
96  @retval true failure
97  @retval false success
98 */
100 
101 /**
102  Duplicates a security context.
103 
104  @param[in] in_ctx The handle of the security context to copy
105  @param[out] out_ctx placeholder for the handle of the copied
106  security context
107  @retval true failure
108  @retval false success
109 */
112 END_SERVICE_DEFINITION(mysql_security_context_factory)
113 
114 /* interact with the user account database */
115 BEGIN_SERVICE_DEFINITION(mysql_account_database_security_context_lookup)
116 /**
117  Looks up in the defined user accounts an account based on
118  the user\@host[ip] combo supplied and checks if the user
119  has access to the database requested.
120  The lookup is done in exactly the same way as at login time.
121  The new security context need to checkout additional privileges using
122  the checkout_acl method.
123  @param[in] ctx The handle of the security context to update
124  @param[in] user The user name to look up
125  @param[in] host The host name to look up
126  @param[in] ip The ip of the incoming connection
127  @param[in] db The database to check access to
128  @retval true failure
129  @retval false success
130 */
132  const char *host, const char *ip, const char *db));
133 END_SERVICE_DEFINITION(mysql_account_database_security_context_lookup)
134 
135 /* options */
136 BEGIN_SERVICE_DEFINITION(mysql_security_context_options)
137 /**
138  Reads a named security context attribute and retuns its value.
139  Currently defined names are:
140 
141  - user MYSQL_LEX_CSTRING * login user (a.k.a. the user's part of USER())
142  - host MYSQL_LEX_CSTRING * login host (a.k.a. the host's part of USER())
143  - ip MYSQL_LEX_CSTRING * login client ip
144  - host_or_ip MYSQL_LEX_CSTRING * host, if present, ip if not.
145  - priv_user MYSQL_LEX_CSTRING * authenticated user
146  (a.k.a. the user's part of CURRENT_USER())
147  - priv_host MYSQL_LEX_CSTRING * authenticated host
148  (a.k.a. the host's part of CURRENT_USER())
149  - proxy_user MYSQL_LEX_CSTRING * the proxy user used in authenticating
150 
151  - privilege_super DECLARE_BOOL_METHOD * 1 if the user account has
152  supper privilege, 0 otherwise
153  - privilege_execute DECLARE_BOOL_METHOD * 1 if the user account has
154  execute privilege, 0 otherwise
155 
156  @param[in] ctx The handle of the security context to read from
157  @param[in] name The option name to read
158  @param[out] inout_pvalue The value of the option. Type depends on the name.
159  @retval true failure
160  @retval false success
161 */
163  void *inout_pvalue));
164 
165 /**
166  Sets a value for a named security context attribute
167  Currently defined names are:
168 
169  - user MYSQL_LEX_CSTRING * login user (a.k.a. the user's part of USER())
170  - host MYSQL_LEX_CSTRING * login host (a.k.a. the host's part of USER())
171  - ip MYSQL_LEX_CSTRING * login client ip
172  - priv_user MYSQL_LEX_CSTRING * authenticated user
173  (a.k.a. the user's part of CURRENT_USER())
174  - priv_host MYSQL_LEX_CSTRING * authenticated host
175  (a.k.a. the host's part of CURRENT_USER())
176  - proxy_user MYSQL_LEX_CSTRING * the proxy user used in authenticating
177 
178  - privilege_super DECLARE_BOOL_METHOD * 1 if the user account has
179  supper privilege, 0 otherwise
180  - privilege_execute DECLARE_BOOL_METHOD * 1 if the user account has
181  execute privilege, 0 otherwise
182 
183  @param[in] ctx The handle of the security context to set into
184  @param[in] name The option name to set
185  @param[in] pvalue The value of the option. Type depends on the name.
186  @retval true failure
187  @retval false success
188 */
190  void *pvalue));
191 END_SERVICE_DEFINITION(mysql_security_context_options)
192 
193 #endif /* SECURITY_CONTEXT_H */
END_SERVICE_DEFINITION
#define END_SERVICE_DEFINITION(name)
A macro to end the last Service definition started with the BEGIN_SERVICE_DEFINITION macro.
Definition: service.h:90
BEGIN_SERVICE_DEFINITION
#define BEGIN_SERVICE_DEFINITION(name)
Declares a new Service.
Definition: service.h:85
service.h
name
case opt name
Definition: sslopt-case.h:32
host
const char * host
Definition: mysqladmin.cc:58
reference_caching::channel::create
static mysql_service_status_t create(const char *service_names[], reference_caching_channel *out_channel) noexcept
Definition: component.cc:35
dynamic_privilege.h
reference_caching::cache::get
static mysql_service_status_t get(reference_caching_cache cache, unsigned service_name_index, const my_h_service **refs) noexcept
Definition: component.cc:113
user
char * user
Definition: mysqladmin.cc:59
reference_caching::channel::destroy
static mysql_service_status_t destroy(reference_caching_channel channel) noexcept
Definition: component.cc:49
lookup
char * lookup(UDF_INIT *, UDF_ARGS *args, char *result, unsigned long *res_length, unsigned char *null_value, unsigned char *)
Definition: udf_example.cc:612
Security_context_handle
struct Security_context_handle_imp * Security_context_handle
Definition: dynamic_privilege.h:28
DECLARE_BOOL_METHOD
#define DECLARE_BOOL_METHOD(name, args)
Declares a method that returns bool as a part of the Service definition.
Definition: service.h:111
classic_protocol::column_def::pos::set
constexpr value_type set
Definition: classic_protocol_constants.h:271
Counter::copy
void copy(Shards< COUNT > &dst, const Shards< COUNT > &src) noexcept
Copy the counters, overwrite destination.
Definition: ut0counter.h:353