 |
MySQL 9.1.0
Source Code Documentation
|
|
MySQL 9.1.0
Source Code Documentation
|
AUTHORIZATION CODE. More...
#include "sql/auth/sql_authorization.h"#include <limits.h>#include <stdio.h>#include <string.h>#include <sys/types.h>#include <algorithm>#include <boost/concept/usage.hpp>#include <boost/function.hpp>#include <boost/graph/adjacency_iterator.hpp>#include <boost/graph/adjacency_list.hpp>#include <boost/graph/breadth_first_search.hpp>#include <boost/graph/filtered_graph.hpp>#include <boost/graph/graph_traits.hpp>#include <boost/graph/graphml.hpp>#include <boost/graph/named_function_params.hpp>#include <boost/graph/properties.hpp>#include <boost/iterator/iterator_facade.hpp>#include <boost/move/utility_core.hpp>#include <boost/property_map/dynamic_property_map.hpp>#include <boost/property_map/property_map.hpp>#include <boost/range/irange.hpp>#include <boost/smart_ptr/make_shared_object.hpp>#include <boost/smart_ptr/shared_ptr.hpp>#include <boost/tuple/tuple.hpp>#include <cstdlib>#include <iterator>#include <map>#include <memory>#include <set>#include <sstream>#include <string>#include <tuple>#include <type_traits>#include <unordered_map>#include <unordered_set>#include <utility>#include <vector>#include "lex_string.h"#include "m_string.h"#include "map_helpers.h"#include "mf_wcomp.h"#include "my_alloc.h"#include "my_compiler.h"#include "my_dbug.h"#include "my_inttypes.h"#include "my_macros.h"#include "my_sqlcommand.h"#include "my_sys.h"#include "mysql/components/services/log_builtins.h"#include "mysql/components/services/log_shared.h"#include "mysql/my_loglevel.h"#include "mysql/mysql_lex_string.h"#include "mysql/plugin_audit.h"#include "mysql/psi/mysql_mutex.h"#include "mysql/service_mysql_alloc.h"#include "mysql/strings/m_ctype.h"#include "mysql_com.h"#include "mysqld_error.h"#include "nulls.h"#include "prealloced_array.h"#include "sql/auth/auth_acls.h"#include "sql/auth/auth_common.h"#include "sql/auth/auth_internal.h"#include "sql/auth/auth_utility.h"#include "sql/auth/dynamic_privilege_table.h"#include "sql/auth/partial_revokes.h"#include "sql/auth/role_tables.h"#include "sql/auth/roles.h"#include "sql/auth/sql_auth_cache.h"#include "sql/auth/sql_security_ctx.h"#include "sql/auth/sql_user_table.h"#include "sql/current_thd.h"#include "sql/dd/dd_table.h"#include "sql/debug_sync.h"#include "sql/derror.h"#include "sql/error_handler.h"#include "sql/field.h"#include "sql/handler.h"#include "sql/item.h"#include "sql/key_spec.h"#include "sql/mdl.h"#include "sql/mysqld.h"#include "sql/nested_join.h"#include "sql/protocol.h"#include "sql/sp.h"#include "sql/sql_admin.h"#include "sql/sql_alter.h"#include "sql/sql_audit.h"#include "sql/sql_base.h"#include "sql/sql_class.h"#include "sql/sql_connect.h"#include "sql/sql_error.h"#include "sql/sql_lex.h"#include "sql/sql_list.h"#include "sql/sql_parse.h"#include "sql/sql_rewrite.h"#include "sql/sql_show.h"#include "sql/sql_view.h"#include "sql/strfunc.h"#include "sql/system_variables.h"#include "sql/table.h"#include "sql/thd_raii.h"#include "sql_string.h"#include "string_with_len.h"#include "strxmov.h"#include "template_utils.h"#include "thr_lock.h"#include "violite.h"Classes | |
| class | Grant_validator |
| Class to handle sanity checks for GRANT ... AS ... statement. More... | |
| class | Get_access_maps |
| A graph visitor used for doing breadth-first traversal of the global role graph. More... | |
| class | Silence_routine_definer_errors |
| If the defining user for a routine does not exist, then the ACL lookup code should raise two errors which we should intercept. More... | |
Typedefs | |
| typedef boost::graph_traits< Granted_roles_graph >::adjacency_iterator | Role_adjacency_iterator |
Functions | |
| bool | operator== (const Role_id &a, const std::string &b) |
| bool | operator== (const std::pair< Role_id, bool > &a, const std::string &b) |
| static bool | is_dynamic_privilege_registered (const std::string &privilege) |
| The dynamic privilege is probed in the global map that keeps track of dynamic privileges registered with server. More... | |
| static bool | check_routine_level_acl (THD *thd, const char *db, const char *name, bool is_proc) |
| void | get_granted_roles (Role_vertex_descriptor &v, List_of_granted_roles *granted_roles) |
| Populates a list of authorization IDs that are connected to a specified graph vertex in the global roles graph. More... | |
| bool | revoke_role_helper (THD *thd, std::string &authid_role, std::string &authid_user, Role_vertex_descriptor *user_vert, Role_vertex_descriptor *role_vert) |
| This utility function is used by revoke_role() and remove_all_granted_roles() for removing a specific edge from the role graph. More... | |
| static void | update_role_flag_of_acl_user (const Role_vertex_descriptor &role_vert, ACL_USER *acl_user) |
| This utility function checks for the connecting vertices of the role descriptor(authid node) and updates the role flag of the corresponding ACL user. More... | |
| void | revoke_role (THD *thd, ACL_USER *role, ACL_USER *user) |
| Used by mysql_revoke_role() for revoking a specified role from a specified user. More... | |
| void | rebuild_vertex_index (THD *thd) |
| Since the gap in the vertex vector was removed all the vertex descriptors has changed. More... | |
| bool | drop_role (THD *thd, TABLE *edge_table, TABLE *defaults_table, const Auth_id_ref &authid_user) |
| bool | revoke_all_roles_from_user (THD *thd, TABLE *edge_table, TABLE *defaults_table, LEX_USER *user_name) |
| Used by mysql_drop_user. More... | |
| bool | revoke_all_granted_roles (THD *thd, TABLE *table, LEX_USER *user_from, List_of_granted_roles *granted_roles) |
| If possible, it will revoke all roles and default roles from user_from and set them for user_to instead. More... | |
| bool | is_role_id (LEX_USER *authid) |
| void | grant_role (ACL_USER *role, const ACL_USER *user, bool with_admin_opt) |
| Grants a single role to a single user. More... | |
| void | create_role_vertex (ACL_USER *role_acl_user) |
| Helper function for create_roles_vertices. More... | |
| bool | roles_rename_authid (THD *thd, TABLE *edge_table, TABLE *defaults_table, LEX_USER *user_from, LEX_USER *user_to) |
| Renames a user in the mysql.role_edge and the mysql.default_roles tables. More... | |
| void | make_global_privilege_statement (THD *thd, Access_bitmask want_access, ACL_USER *acl_user, String *global) |
| Maps a global ACL to a string representation. More... | |
| void | make_database_privilege_statement (THD *thd, ACL_USER *role, Protocol *protocol, const Db_access_map &db_map, const Db_access_map &db_wild_map, const DB_restrictions &restrictions) |
| Maps a set of database level ACLs to string representations and sends them through the client protocol. More... | |
| void | make_proxy_privilege_statement (THD *thd, ACL_USER *user, Protocol *protocol) |
| Maps a set of global level proxy ACLs to string representations and sends them through the client protocol. More... | |
| void | make_sp_privilege_statement (THD *thd, ACL_USER *role, Protocol *protocol, SP_access_map &sp_map, int type) |
| Maps a set of database level ACLs for stored programs to string representations and sends them through the client protocol. More... | |
| void | make_with_admin_privilege_statement (THD *thd, ACL_USER *acl_user, Protocol *protocol, const Grant_acl_set &with_admin_acl, const List_of_granted_roles &granted_roles) |
| void | make_dynamic_privilege_statement (THD *thd, ACL_USER *role, Protocol *protocol, const Dynamic_privileges &dyn_priv) |
| void | make_roles_privilege_statement (THD *thd, ACL_USER *role, Protocol *protocol, List_of_granted_roles &granted_roles, bool show_mandatory_roles) |
| void | make_table_privilege_statement (THD *thd, ACL_USER *role, Protocol *protocol, Table_access_map &table_map) |
| void | get_sp_access_map (ACL_USER *acl_user, SP_access_map *sp_map, malloc_unordered_multimap< std::string, unique_ptr_destroy_only< GRANT_NAME > > *hash) |
| void | get_table_access_map (ACL_USER *acl_user, Table_access_map *table_map) |
| void | get_dynamic_privileges (ACL_USER *acl_user, Dynamic_privileges *acl) |
| bool | has_wildcard_characters (const LEX_CSTRING &db) |
| void | get_database_access_map (ACL_USER *acl_user, Db_access_map *db_map, Db_access_map *db_wild_map) |
| const ACL_internal_schema_access * | get_cached_schema_access (GRANT_INTERNAL_INFO *grant_internal_info, const char *schema_name) |
| Get a cached internal schema access. More... | |
| const ACL_internal_table_access * | get_cached_table_access (GRANT_INTERNAL_INFO *grant_internal_info, const char *schema_name, const char *table_name) |
| Get a cached internal table access. More... | |
| bool | lock_tables_precheck (THD *thd, Table_ref *tables) |
| Check privileges for LOCK TABLES statement. More... | |
| bool | create_table_precheck (THD *thd, Table_ref *tables, Table_ref *create_table) |
| CREATE TABLE query pre-check. More... | |
| bool | check_readonly (THD *thd, bool err_if_readonly) |
| Performs standardized check whether to prohibit (true) or allow (false) operations based on read_only and super_read_only state. More... | |
| void | err_readonly (THD *thd) |
| Generates appropriate error messages for read-only state depending on whether user has SUPER privilege or not. More... | |
| bool | check_one_table_access (THD *thd, Access_bitmask privilege, Table_ref *all_tables) |
| Check grants for commands which work only with one table and all other tables belonging to subselects or implicitly opened tables. More... | |
| bool | check_single_table_access (THD *thd, Access_bitmask privilege, Table_ref *all_tables, bool no_errors) |
| Check grants for commands which work only with one table. More... | |
| bool | check_routine_access (THD *thd, Access_bitmask want_access, const char *db, char *name, bool is_proc, bool no_errors) |
| bool | check_some_access (THD *thd, Access_bitmask want_access, Table_ref *table) |
| Check if the given table has any of the asked privileges. More... | |
| bool | has_full_view_routine_access (THD *thd, const char *db, const char *definer_user, const char *definer_host) |
| Check if user has full access to view routine's properties (i.e including stored routine code). More... | |
| bool | has_partial_view_routine_access (THD *thd, const char *db, const char *routine_name, bool is_proc) |
| Check if user has partial access to view routine's properties (i.e. More... | |
| bool | check_access (THD *thd, Access_bitmask want_access, const char *db, Access_bitmask *save_priv, GRANT_INTERNAL_INFO *grant_internal_info, bool dont_check_global_grants, bool no_errors) |
| Compare requested privileges with the privileges acquired from the User- and Db-tables. More... | |
| bool | check_table_access (THD *thd, Access_bitmask requirements, Table_ref *tables, bool any_combination_of_privileges_will_do, uint number, bool no_errors) |
| Check if the requested privileges exists in either User-, DB- or, tables- tables. More... | |
| bool | check_table_encryption_admin_access (THD *thd) |
| Check if a current user has the privilege TABLE_ENCRYPTION_ADMIN required to create encrypted table. More... | |
| bool | is_granted_table_access (THD *thd, Access_bitmask required_acl, Table_ref *table) |
| Given a Table_ref object this function checks against. More... | |
| bool | has_grant_role_privilege (THD *thd, const List< LEX_USER > *roles) |
| bool | report_missing_user_grant_message (THD *thd, bool user_exists, const char *user, const char *host, const char *object_name, int err_code) |
| Helper method to check if warning or error should be reported based on: More... | |
| int | mysql_table_grant (THD *thd, Table_ref *table_list, List< LEX_USER > &user_list, List< LEX_COLUMN > &columns, Access_bitmask rights, bool revoke_grant, bool all_current_privileges) |
| bool | mysql_routine_grant (THD *thd, Table_ref *table_list, bool is_proc, List< LEX_USER > &user_list, Access_bitmask rights, bool revoke_grant, bool write_to_binlog, bool all_current_privileges) |
| Store routine level grants in the privilege tables. More... | |
| bool | mysql_revoke_role (THD *thd, const List< LEX_USER > *users, const List< LEX_USER > *roles) |
| bool | has_dynamic_privilege_grant_option (Security_context *sctx, std::string priv) |
| static bool | check_if_granted_role_recursive (LEX_CSTRING start, LEX_CSTRING start_host, LEX_CSTRING search_for, LEX_CSTRING search_for_host) |
| Search if an auth_id (search_for@search_for_host) is granted either directly or indirectly to an auth_id (start@start_host) or to one of the mandatory roles. More... | |
| bool | mysql_grant_role (THD *thd, const List< LEX_USER > *users, const List< LEX_USER > *roles, bool with_admin_opt) |
| Grants a list of roles to a list of users. More... | |
| bool | mysql_grant (THD *thd, const char *db, List< LEX_USER > &list, Access_bitmask rights, bool revoke_grant, bool is_proxy, const List< LEX_CSTRING > &dynamic_privilege, bool grant_all_current_privileges, LEX_GRANT_AS *grant_as) |
| bool | check_grant (THD *thd, Access_bitmask want_access, Table_ref *tables, bool any_combination_will_do, uint number, bool no_errors) |
| Check table level grants. More... | |
| bool | check_grant_column (THD *thd, GRANT_INFO *grant, const char *db_name, const char *table_name, const char *name, size_t length, Security_context *sctx, Access_bitmask want_privilege) |
| bool | check_column_grant_in_table_ref (THD *thd, Table_ref *table_ref, const char *name, size_t length, Access_bitmask want_privilege) |
| Check the privileges for a column depending on the type of table. More... | |
| bool | check_grant_all_columns (THD *thd, Access_bitmask want_access_arg, Field_iterator_table_ref *fields) |
| check if a query can access a set of columns More... | |
| static bool | check_grant_db_routine (THD *thd, const char *db, malloc_unordered_multimap< std::string, unique_ptr_destroy_only< GRANT_NAME > > *hash) |
| bool | has_any_table_acl (Security_context *sctx, const LEX_CSTRING &str) |
| bool | has_any_routine_acl (Security_context *sctx, const LEX_CSTRING &db) |
| bool | check_grant_db (THD *thd, const char *db, const bool check_table_grant) |
| Check if a user has the right to access a database. More... | |
| bool | check_grant_routine (THD *thd, Access_bitmask want_access, Table_ref *procs, bool is_proc, bool no_errors) |
| Access_bitmask | get_table_grant (THD *thd, Table_ref *table) |
| Access_bitmask | get_column_grant (THD *thd, GRANT_INFO *grant, const char *db_name, const char *table_name, const char *field_name) |
| void | get_privilege_desc (char *to, uint max_length, Access_bitmask access) |
| void | iterate_comma_separated_quoted_string (std::string str, const std::function< bool(const std::string)> &f) |
| Iterate a string by comma separation and apply a function on each chunk separated by the commas. More... | |
| std::pair< std::string, std::string > | get_authid_from_quoted_string (std::string str) |
| Return the unquoted authorization id as a user,host-tuple. More... | |
| bool | operator== (const std::pair< Role_id, bool > &rid, const Auth_id_ref &ref) |
| bool | operator== (const Auth_id_ref &ref, const std::pair< Role_id, bool > &rid) |
| void | get_privilege_access_maps (ACL_USER *acl_user, const List_of_auth_id_refs *using_roles, Access_bitmask *access, Db_access_map *db_map, Db_access_map *db_wild_map, Table_access_map *table_map, SP_access_map *sp_map, SP_access_map *func_map, List_of_granted_roles *granted_roles, Grant_acl_set *with_admin_acl, Dynamic_privileges *dynamic_acl, Restrictions &restrictions) |
| bool | mysql_show_grants (THD *thd, LEX_USER *lex_user, const List_of_auth_id_refs &using_roles, bool show_mandatory_roles, bool have_using_clause) |
| SHOW GRANTS FOR user USING [ALL | role [,role ...]]. More... | |
| void | roles_graphml (THD *thd, String *str) |
| static int | remove_db_access_privileges (THD *thd, TABLE *table, const LEX_USER &lex_user) |
| Remove db access privileges. More... | |
| static int | remove_column_access_privileges (THD *thd, TABLE *tables_priv_table, TABLE *columns_priv_table, const LEX_USER &lex_user) |
| Remove column access privileges. More... | |
| static int | remove_procedure_access_privileges (THD *thd, TABLE *procs_priv_table, const LEX_USER &lex_user) |
| Remove procedure access privileges. More... | |
| bool | mysql_revoke_all (THD *thd, List< LEX_USER > &list) |
| bool | sp_revoke_privileges (THD *thd, const char *sp_db, const char *sp_name, bool is_proc) |
| Revoke privileges for all users on a stored procedure. More... | |
| bool | sp_grant_privileges (THD *thd, const char *sp_db, const char *sp_name, bool is_proc) |
| Grant EXECUTE,ALTER privilege for a stored procedure. More... | |
| static bool | update_schema_privilege (THD *thd, TABLE *table, char *buff, const char *db, const char *t_name, const char *column, size_t col_length, const char *priv, size_t priv_length, const char *is_grantable) |
| void | fill_effective_table_privileges (THD *thd, GRANT_INFO *grant, const char *db, const char *table) |
| bool | acl_check_proxy_grant_access (THD *thd, const char *host, const char *user, bool with_grant) |
| int | fill_schema_user_privileges (THD *thd, Table_ref *tables, Item *) |
| int | fill_schema_schema_privileges (THD *thd, Table_ref *tables, Item *) |
| int | fill_schema_table_privileges (THD *thd, Table_ref *tables, Item *) |
| int | fill_schema_column_privileges (THD *thd, Table_ref *tables, Item *) |
| bool | is_privileged_user_for_credential_change (THD *thd) |
| bool | check_global_access (THD *thd, Access_bitmask want_access) |
| check for global access and give descriptive error message if it fails. More... | |
| bool | check_fk_parent_table_access (THD *thd, HA_CREATE_INFO *create_info, Alter_info *alter_info) |
| Checks foreign key's parent table access. More... | |
| bool | check_lock_view_underlying_table_access (THD *thd, Table_ref *tbl, bool *fake_lock_tables_acl) |
| For LOCK TABLES on a view checks if user in which context view is executed or user that has initiated this operation has SELECT and LOCK TABLES privileges on one of its underlying tables. More... | |
| bool | check_if_granted_role (LEX_CSTRING user, LEX_CSTRING host, LEX_CSTRING role, LEX_CSTRING role_host) |
| Examines if a user@host authid is connected to a role@role_host authid by comparing all out-edges if the user@host vertex in the global role graph. More... | |
| bool | find_if_granted_role (Role_vertex_descriptor v, LEX_CSTRING role, LEX_CSTRING role_host, Role_vertex_descriptor *found_vertex) |
| Given a vertex in the roles graph, this function finds a directly connected vertex given a (role, role_host) tuple. More... | |
| void | get_granted_roles (Role_vertex_descriptor &v, std::function< void(const Role_id &, bool)> f) |
| void | activate_all_granted_roles (const ACL_USER *acl_user, Security_context *sctx) |
| Activates all roles granted to the auth_id. More... | |
| void | activate_all_mandatory_roles (Security_context *sctx) |
| Activates all the mandatory roles for the current user. More... | |
| void | activate_all_granted_and_mandatory_roles (const ACL_USER *acl_user, Security_context *sctx) |
| void | get_granted_roles (LEX_USER *user, List_of_granted_roles *granted_roles) |
| This is a convenience function. More... | |
| void | get_active_roles (const THD *thd, List_of_granted_roles *roles) |
| Helper function for func_current_role used for Item_func_current_role. More... | |
| void | func_current_role (const THD *thd, String *active_role) |
| Helper function for Item_func_current_role. More... | |
| void | get_default_roles (const Auth_id_ref &acl_user, List_of_auth_id_refs &authlist) |
| Shallow copy a list of default role authorization IDs from an Role_id storage. More... | |
| bool | lock_and_get_mandatory_roles (std::vector< Role_id > *mandatory_roles) |
| Copy a list of mandatory role authorization IDs. More... | |
| bool | clear_default_roles (THD *thd, TABLE *table, const Auth_id_ref &user_auth_id, std::vector< Role_id > *default_roles) |
| Removes all default role policies assigned to user. More... | |
| bool | drop_default_role_policy (THD *thd, TABLE *table, const Auth_id_ref &default_role_policy, const Auth_id_ref &user) |
| Drop a specific default role policy given the role- and user names. More... | |
| bool | mysql_alter_or_clear_default_roles (THD *thd, role_enum role_type, const List< LEX_USER > *users, const List< LEX_USER > *roles) |
| Set the default roles to NONE, ALL or list of authorization IDs as roles, depending upon the role_type argument. More... | |
| bool | alter_user_set_default_roles_all (THD *thd, TABLE *def_role_table, LEX_USER *user) |
| Set all granted role as default roles. More... | |
| bool | alter_user_set_default_roles (THD *thd, TABLE *table, LEX_USER *user, const List_of_auth_id_refs &new_auth_ids) |
| Set the default roles for a particular user. More... | |
| std::string | create_authid_str_from (const LEX_USER *user) |
| Helper used for producing a key to a key-value-map. More... | |
| Auth_id_ref | create_authid_from (const LEX_USER *user) |
| Auth_id_ref | create_authid_from (const Role_id &user) |
| Auth_id_ref | create_authid_from (const LEX_CSTRING &user, const LEX_CSTRING &host) |
| std::string | create_authid_str_from (const ACL_USER *user) |
| Helper used for producing a key to a key-value-map. More... | |
| std::string | create_authid_str_from (const Auth_id_ref &user) |
| Auth_id_ref | create_authid_from (const ACL_USER *user) |
| bool | mysql_set_active_role_none (THD *thd) |
| Reset active roles. More... | |
| bool | mysql_set_role_default (THD *thd) |
| Activates all the default roles in the current security context. More... | |
| bool | mysql_set_active_role_all (THD *thd, const List< LEX_USER > *except_users) |
| Activates all granted role in the current security context. More... | |
| bool | mysql_set_active_role (THD *thd, const List< LEX_USER > *role_list) |
| bool | is_granted_role (LEX_CSTRING user, LEX_CSTRING host, LEX_CSTRING role, LEX_CSTRING role_host) |
| This function works just like check_if_granted_role, but also guarantees that the proper lock is taken so that the function can be used in a wider context. More... | |
| bool | is_mandatory_role (LEX_CSTRING role, LEX_CSTRING role_host, bool *is_mandatory) |
| Determine if a role@role_host authid is a mandatory role. More... | |
| bool | grant_dynamic_privilege (const LEX_CSTRING &str_priv, const LEX_CSTRING &str_user, const LEX_CSTRING &str_host, bool with_grant_option, Update_dynamic_privilege_table &update_table) |
| Grant one privilege to one user. More... | |
| bool | grant_grant_option_for_all_dynamic_privileges (const LEX_CSTRING &str_user, const LEX_CSTRING &str_host, Update_dynamic_privilege_table &update_table) |
| Grant grant option to one user for all dynamic privileges. More... | |
| bool | revoke_grant_option_for_all_dynamic_privileges (const LEX_CSTRING &str_user, const LEX_CSTRING &str_host, Update_dynamic_privilege_table &update_table) |
| Revoke grant option to one user for all dynamic privileges. More... | |
| bool | grant_dynamic_privileges_to_auth_id (const Role_id &id, const std::vector< std::string > &priv_list) |
| Grant needed dynamic privielges to in memory internal auth id. More... | |
| void | revoke_dynamic_privileges_from_auth_id (const Role_id &id, const std::vector< std::string > &priv_list) |
| Revoke dynamic privielges from in memory internal auth id. More... | |
| bool | revoke_dynamic_privilege (const LEX_CSTRING &str_priv, const LEX_CSTRING &str_user, const LEX_CSTRING &str_host, Update_dynamic_privilege_table &update_table) |
| Revoke one privilege from one user. More... | |
| bool | revoke_all_dynamic_privileges (const LEX_CSTRING &user, const LEX_CSTRING &host, Update_dynamic_privilege_table &update_table) |
| Revoke all dynamic global privileges. More... | |
| bool | rename_dynamic_grant (const LEX_CSTRING &old_user, const LEX_CSTRING &old_host, const LEX_CSTRING &new_user, const LEX_CSTRING &new_host, Update_dynamic_privilege_table &update_table) |
| void | default_roles_init () |
| Initialize the default role map that keeps the content from the default_roles table. More... | |
| void | default_roles_delete () |
| Delete the default role instance. More... | |
| void | roles_graph_init () |
| Initialize the roles graph artifacts. More... | |
| void | roles_graph_delete () |
| Delete the ACL role graph artifacts. More... | |
| void | roles_init () |
| Initialize the roles caches that consist of the role graphs related artifacts and default role map. More... | |
| void | roles_delete () |
| Delete the role caches. More... | |
| void | dynamic_privileges_init () |
| void | dynamic_privileges_delete () |
| User_to_dynamic_privileges_map * | get_dynamic_privileges_map () |
| void | set_dynamic_privileges_map (User_to_dynamic_privileges_map *map) |
| User_to_dynamic_privileges_map * | swap_dynamic_privileges_map (User_to_dynamic_privileges_map *map) |
| bool | assert_valid_privilege_id (const List< LEX_USER > *priv_list) |
| bool | check_authorization_id_string (THD *thd, LEX_STRING &mandatory_roles) |
| void | get_mandatory_roles (std::vector< Role_id > *mandatory_roles) |
| void | update_mandatory_roles (void) |
| bool | operator== (const Role_id &a, const Auth_id_ref &b) |
| bool | operator== (const Auth_id_ref &a, const Role_id &b) |
| bool | operator== (const std::pair< const Role_id, Role_id > &a, const Auth_id_ref &b) |
| bool | operator== (const Role_id &a, const Role_id &b) |
| bool | operator< (const Auth_id_ref &a, const Auth_id_ref &b) |
| bool | operator== (std::pair< const Role_id, std::pair< std::string, bool > > &a, const std::string &b) |
| bool | operator== (const LEX_CSTRING &a, const LEX_CSTRING &b) |
| bool | do_update_sctx (Security_context *sctx, LEX_USER *from_user_ptr) |
| Checks if current user needs to be changed in case it is same as the LEX_USER. More... | |
| void | update_sctx (Security_context *sctx, LEX_USER *to_user_ptr) |
| bool | check_system_user_privilege (THD *thd, List< LEX_USER > list) |
| Checks if any of the users has SYSTEM_USER privilege then current user must also have SYSTEM_USER privilege. More... | |
| bool | check_valid_definer (THD *thd, LEX_USER *definer) |
| Check if the definer is a valid one. More... | |
Variables | |
| Granted_roles_graph * | g_granted_roles = nullptr |
| Role_index_map * | g_authid_to_vertex = nullptr |
| static char | g_active_dummy_user [] = "active dummy user" |
| bool | initialized |
| Default_roles * | g_default_roles |
| User_to_dynamic_privileges_map * | g_dynamic_privileges_map = nullptr |
| const char * | any_db = "*any*" |
| static const int | GRANTEE_MAX_BUFF_LENGTH |
| Grantee is of form 'user'@'hostname', so add +1 for '@' and +4 for the single quotes. More... | |
AUTHORIZATION CODE.
| typedef boost::graph_traits<Granted_roles_graph>::adjacency_iterator Role_adjacency_iterator |
| bool acl_check_proxy_grant_access | ( | THD * | thd, |
| const char * | host, | ||
| const char * | user, | ||
| bool | with_grant | ||
| ) |
| void activate_all_granted_and_mandatory_roles | ( | const ACL_USER * | acl_user, |
| Security_context * | sctx | ||
| ) |
| void activate_all_granted_roles | ( | const ACL_USER * | acl_user, |
| Security_context * | sctx | ||
| ) |
Activates all roles granted to the auth_id.
| [in] | acl_user | ACL_USER for which all granted roles to be activated. |
| [in] | sctx | Push the activated role to security context |
| void activate_all_mandatory_roles | ( | Security_context * | sctx | ) |
Activates all the mandatory roles for the current user.
| [in] | sctx | Push the activated role to security context |
| bool alter_user_set_default_roles | ( | THD * | thd, |
| TABLE * | table, | ||
| LEX_USER * | user, | ||
| const List_of_auth_id_refs & | new_auth_ids | ||
| ) |
Set the default roles for a particular user.
| thd | Thread handle |
| table | Table handle to an open table |
| user | AST component for the user for which we set def roles |
| new_auth_ids | Default roles to set |
| true | Operation failed |
| false | Operation was successful. |
Set all granted role as default roles.
Writes to table mysql.default_roles and binlog.
| thd | Thread handler |
| def_role_table | Default role table |
| user | The user whose default roles are set. |
| true | An error occurred and DA is set |
| false | Successful |
| bool check_access | ( | THD * | thd, |
| Access_bitmask | want_access, | ||
| const char * | db, | ||
| Access_bitmask * | save_priv, | ||
| GRANT_INTERNAL_INFO * | grant_internal_info, | ||
| bool | dont_check_global_grants, | ||
| bool | no_errors | ||
| ) |
Compare requested privileges with the privileges acquired from the User- and Db-tables.
| thd | Thread handler | |
| want_access | The requested access privileges. | |
| db | A pointer to the Db name. | |
| [out] | save_priv | A pointer to the granted privileges will be stored. |
| grant_internal_info | A pointer to the internal grant cache. | |
| dont_check_global_grants | True if no global grants are checked. | |
| no_errors | True if no errors should be sent to the client. |
'save_priv' is used to save the User-table (global) and Db-table grants for the supplied db name. Note that we don't store db level grants if the global grants is enough to satisfy the request AND the global grants contains a SELECT grant.
For internal databases (INFORMATION_SCHEMA, PERFORMANCE_SCHEMA), additional rules apply, see ACL_internal_schema_access.
| false | Access can't exclusively be denied by Db- and User-table access unless Column- and Table-grants are checked too. |
| true | Access denied. The DA is set if no_error = false! |
| bool check_authorization_id_string | ( | THD * | thd, |
| LEX_STRING & | mandatory_roles | ||
| ) |
| bool check_column_grant_in_table_ref | ( | THD * | thd, |
| Table_ref * | table_ref, | ||
| const char * | name, | ||
| size_t | length, | ||
| Access_bitmask | want_privilege | ||
| ) |
Check the privileges for a column depending on the type of table.
| thd | thread handler |
| table_ref | table reference where to check the field |
| name | name of field to check |
| length | length of name |
| want_privilege | wanted privileges |
Check the privileges for a column depending on the type of table the column belongs to. The function provides a generic interface to check column privileges that hides the heterogeneity of the column representation - whether it belongs to a view or a base table.
Notice that this function does not understand that a column from a view reference must be checked for privileges both in the view and in the underlying base table (or view) reference. This is the responsibility of the caller.
Columns from temporary tables and derived tables are ignored by this function.
| bool check_fk_parent_table_access | ( | THD * | thd, |
| HA_CREATE_INFO * | create_info, | ||
| Alter_info * | alter_info | ||
| ) |
Checks foreign key's parent table access.
| [in] | thd | Thread handler |
| [in] | create_info | Create information (like MAX_ROWS, ENGINE or temporary table flag) |
| [in] | alter_info | Initial list of columns and indexes for the table to be created |
| false | ok. |
| true | error or access denied. Error is sent to client in this case. |
| bool check_global_access | ( | THD * | thd, |
| Access_bitmask | want_access | ||
| ) |
check for global access and give descriptive error message if it fails.
| thd | Thread handler |
| want_access | Use should have any of these global rights |
| 0 | ok |
| 1 | Access denied. In this case an error is sent to the client |
| bool check_grant | ( | THD * | thd, |
| Access_bitmask | want_access, | ||
| Table_ref * | tables, | ||
| bool | any_combination_will_do, | ||
| uint | number, | ||
| bool | no_errors | ||
| ) |
Check table level grants.
| thd | Thread handler |
| want_access | Bits of privileges user needs to have. |
| tables | List of tables to check. The user should have 'want_access' to all tables in list. |
| any_combination_will_do | true if it's enough to have any privilege for any combination of the table columns. |
| number | Check at most this number of tables. |
| no_errors | true if no error should be sent directly to the client. |
If table->grant.want_privilege != 0 then the requested privileges where in the set of COL_ACLS but access was not granted on the table level. As a consequence an extra check of column privileges is required.
Specifically if this function returns false the user has some kind of privilege on a combination of columns in each table.
This function is usually preceded by check_access which establish the User-, Db- and Host access rights.
| false | Access granted; But column privileges need to be checked. |
| true | The user did not have the requested privileges on any of the tables. |
| bool check_grant_all_columns | ( | THD * | thd, |
| Access_bitmask | want_access_arg, | ||
| Field_iterator_table_ref * | fields | ||
| ) |
check if a query can access a set of columns
| thd | the current thread |
| want_access_arg | the privileges requested |
| fields | an iterator over the fields of a table reference. |
| 0 | Success |
| 1 | Failure |
This function walks over the columns of a table reference The columns may originate from different tables, depending on the kind of table reference, e.g. join, view. For each table it will retrieve the grant information and will use it to check the required access privileges for the fields requested from it.
| bool check_grant_column | ( | THD * | thd, |
| GRANT_INFO * | grant, | ||
| const char * | db_name, | ||
| const char * | table_name, | ||
| const char * | name, | ||
| size_t | length, | ||
| Security_context * | sctx, | ||
| Access_bitmask | want_privilege | ||
| ) |
| bool check_grant_db | ( | THD * | thd, |
| const char * | db, | ||
| const bool | check_table_grant | ||
| ) |
Check if a user has the right to access a database.
Access is accepted if the user has a database operations related grant (i.e. not including the GRANT_ACL) for any table/column/routine in the database.
| thd | The thread handler |
| db | The name of the database |
| check_table_grant | false by default, Access is granted for "show databases" and "show tables in database" when user has table level grant. |
| 1 | Access is denied |
| 0 | Otherwise |
|
static |
| bool check_grant_routine | ( | THD * | thd, |
| Access_bitmask | want_access, | ||
| Table_ref * | procs, | ||
| bool | is_proc, | ||
| bool | no_errors | ||
| ) |
| bool check_if_granted_role | ( | LEX_CSTRING | user, |
| LEX_CSTRING | host, | ||
| LEX_CSTRING | role, | ||
| LEX_CSTRING | role_host | ||
| ) |
Examines if a user@host authid is connected to a role@role_host authid by comparing all out-edges if the user@host vertex in the global role graph.
| true | the two vertices are connected (role is granted) |
| false | not connected (role is not granted) |
|
static |
Search if an auth_id (search_for@search_for_host) is granted either directly or indirectly to an auth_id (start@start_host) or to one of the mandatory roles.
Searched if search_for@search_for_host is a direct or indirect descendant of start@start_host or to one of the mandatory roles
| start | the user name to check |
| start_host | the host name to check |
| search_for | the user name of auth_id to look for |
| search_for_host | the host name of the auth_id to look for |
| true | search_for@search_for_host is granted directly or indirectly to start@start_host |
| false | the two auth ids are not related |
| bool check_lock_view_underlying_table_access | ( | THD * | thd, |
| Table_ref * | tbl, | ||
| bool * | fake_lock_tables_acl | ||
| ) |
For LOCK TABLES on a view checks if user in which context view is executed or user that has initiated this operation has SELECT and LOCK TABLES privileges on one of its underlying tables.
| [in] | thd | Thread context. |
| [in] | tbl | Table list element for underlying table on which we check privilege. |
| [out] | fake_lock_tables_acl | Set to true if table in question is one of special I_S or P_S tables on which nobody can get LOCK TABLES privilege. So to preserve compatibility with dump tools we need to fake this privilege. Set to false otherwise. |
| false | Success. |
| true | Access denied. Error has been reported. |
| bool check_one_table_access | ( | THD * | thd, |
| Access_bitmask | privilege, | ||
| Table_ref * | all_tables | ||
| ) |
Check grants for commands which work only with one table and all other tables belonging to subselects or implicitly opened tables.
| thd | Thread handler |
| privilege | requested privilege |
| all_tables | global table list of query |
| bool check_readonly | ( | THD * | thd, |
| bool | err_if_readonly | ||
| ) |
Performs standardized check whether to prohibit (true) or allow (false) operations based on read_only and super_read_only state.
| thd | Thread handler |
| err_if_readonly | Boolean indicating whether or not to add the error to the thread context if read-only is violated. |
| true | The operation should be prohibited. @ retval false The operation should be allowed. |
| bool check_routine_access | ( | THD * | thd, |
| Access_bitmask | want_access, | ||
| const char * | db, | ||
| char * | name, | ||
| bool | is_proc, | ||
| bool | no_errors | ||
| ) |
|
static |
| bool check_single_table_access | ( | THD * | thd, |
| Access_bitmask | privilege, | ||
| Table_ref * | all_tables, | ||
| bool | no_errors | ||
| ) |
Check grants for commands which work only with one table.
| thd | Thread handler |
| privilege | requested privilege |
| all_tables | global table list of query |
| no_errors | false/true - report/don't report error to the client (using my_error() call). |
| 0 | OK |
| 1 | access denied, error is sent to client |
| bool check_some_access | ( | THD * | thd, |
| Access_bitmask | want_access, | ||
| Table_ref * | table | ||
| ) |
Check if the given table has any of the asked privileges.
| thd | Thread handler |
| want_access | Bitmap of possible privileges to check for |
| table | The table for which access needs to be validated |
| 0 | ok |
| 1 | error |
Checks if any of the users has SYSTEM_USER privilege then current user must also have SYSTEM_USER privilege.
It is a wrapper over the Privilege_checker class that does privilege checks for one user at a time.
| [in] | thd | Thread handle for security context |
| [in] | list | List of user being processed |
| false | Either none of the users in list has SYSTEM_USER privilege or current user has SYSTEM_USER privilege |
| true | Failed in get_current_user() OR one of the user in the list has SYSTEM_USER privilege but current user does not. |
| bool check_table_access | ( | THD * | thd, |
| Access_bitmask | requirements, | ||
| Table_ref * | tables, | ||
| bool | any_combination_of_privileges_will_do, | ||
| uint | number, | ||
| bool | no_errors | ||
| ) |
Check if the requested privileges exists in either User-, DB- or, tables- tables.
| thd | Thread context |
| requirements | Privileges requested |
| tables | List of tables to be compared against |
| no_errors | Don't report error to the client (using my_error() call). |
| any_combination_of_privileges_will_do | true if any privileges on any column combination is enough. |
| number | Only the first 'number' tables in the linked list are relevant. |
The supplied table list contains cached privileges. This functions calls the help functions check_access and check_grant to verify the first three steps in the privileges check queue:
| false | OK |
| true | Access denied; But column or routine privileges might need to be checked also. |
| bool check_table_encryption_admin_access | ( | THD * | thd | ) |
Check if a current user has the privilege TABLE_ENCRYPTION_ADMIN required to create encrypted table.
We skip the same for slave threads.
| thd | Current thread |
| false | A user has the privilege TABLE_ENCRYPTION_ADMIN |
| true | A user doesn't have the privilege TABLE_ENCRYPTION_ADMIN |
Check if the definer is a valid one.
if the definer is different to the current session account, make sure it's OK to use it:
if it's not OK, generate an error.
Also checks if the user@host is a non-existent user account and if it is throws an error and returns true, given that SUPER or ALLOW_NONEXISTENT_DEFINER are not granted. If the privs arent granted a warning is produced instead of an error.
| thd | the session |
| definer | the definer to check |
| false | : success |
| true | : failure |
| bool clear_default_roles | ( | THD * | thd, |
| TABLE * | table, | ||
| const Auth_id_ref & | user_auth_id, | ||
| std::vector< Role_id > * | default_roles | ||
| ) |
Removes all default role policies assigned to user.
If the user is used as a default role policy, this policy needs to be removed too. Removed policies are copied to the vector supplied in the arguments.
| thd | Thread handler | |
| table | Open table handler | |
| user_auth_id | A reference to the authorization ID to clear | |
| [out] | default_roles | The vector to which the removed roles are copied. |
| true | An error occurred. |
| false | Success |
| Auth_id_ref create_authid_from | ( | const ACL_USER * | user | ) |
| Auth_id_ref create_authid_from | ( | const LEX_CSTRING & | user, |
| const LEX_CSTRING & | host | ||
| ) |
| Auth_id_ref create_authid_from | ( | const LEX_USER * | user | ) |
| Auth_id_ref create_authid_from | ( | const Role_id & | user | ) |
| std::string create_authid_str_from | ( | const ACL_USER * | user | ) |
Helper used for producing a key to a key-value-map.
| std::string create_authid_str_from | ( | const Auth_id_ref & | user | ) |
| std::string create_authid_str_from | ( | const LEX_USER * | user | ) |
Helper used for producing a key to a key-value-map.
| void create_role_vertex | ( | ACL_USER * | role_acl_user | ) |
Helper function for create_roles_vertices.
Creates a vertex in the role graph and associate it with an ACL_USER. If the ACL_USER already exists in the vertex-to-acl-user index then we ignore this request.
| role_acl_user | The acial user to be mapped to a vertex. |
CREATE TABLE query pre-check.
| thd | Thread handler |
| tables | Global table list |
| create_table | Table which will be created |
| false | OK |
| true | Error |
| void default_roles_delete | ( | void | ) |
Delete the default role instance.
| void default_roles_init | ( | void | ) |
Initialize the default role map that keeps the content from the default_roles table.
| bool do_update_sctx | ( | Security_context * | sctx, |
| LEX_USER * | from_user_ptr | ||
| ) |
Checks if current user needs to be changed in case it is same as the LEX_USER.
This check is useful to take backup of security context in case current user renames itself.
| sctx | The security context to check |
| from_user_ptr | User name to be renamed |
| true | security context need to be updated |
| false | otherwise |
| bool drop_default_role_policy | ( | THD * | thd, |
| TABLE * | table, | ||
| const Auth_id_ref & | default_role_policy, | ||
| const Auth_id_ref & | user | ||
| ) |
Drop a specific default role policy given the role- and user names.
| thd | Thread handler |
| table | An open table handler to the default_roles table |
| default_role_policy | The role name |
| user | The user name |
| Error | state |
| true | An error occurred |
| false | Success |
| bool drop_role | ( | THD * | thd, |
| TABLE * | edge_table, | ||
| TABLE * | defaults_table, | ||
| const Auth_id_ref & | authid_user | ||
| ) |
| void dynamic_privileges_delete | ( | void | ) |
| void dynamic_privileges_init | ( | void | ) |
| void err_readonly | ( | THD * | thd | ) |
Generates appropriate error messages for read-only state depending on whether user has SUPER privilege or not.
| thd | Thread handler |
| void fill_effective_table_privileges | ( | THD * | thd, |
| GRANT_INFO * | grant, | ||
| const char * | db, | ||
| const char * | table | ||
| ) |
| bool find_if_granted_role | ( | Role_vertex_descriptor | v, |
| LEX_CSTRING | role, | ||
| LEX_CSTRING | role_host, | ||
| Role_vertex_descriptor * | found_vertex | ||
| ) |
Given a vertex in the roles graph, this function finds a directly connected vertex given a (role, role_host) tuple.
The resulting vertex is returned to the caller through an out-param.
| v | Vertex descriptor of the authid which might have a granted role | |
| role | User name part of an authid | |
| role_host | Host name part of an authid | |
| [out] | found_vertex | The corresponding vertex of the granted role. |
| true | The role is granted and the corresponding vertex is returned. |
| false | No such role is granted. |
Helper function for Item_func_current_role.
| thd | Thread handler |
| active_role | [out] Comma separated list of auth ids |
| void get_active_roles | ( | const THD * | thd, |
| List_of_granted_roles * | roles | ||
| ) |
Helper function for func_current_role used for Item_func_current_role.
| thd | The thread handler |
| roles | [out] A list of Role_id granted to the current user. |
| std::pair< std::string, std::string > get_authid_from_quoted_string | ( | std::string | str | ) |
Return the unquoted authorization id as a user,host-tuple.
| str | The quoted or unquoted string representation of an authid |
| const ACL_internal_schema_access * get_cached_schema_access | ( | GRANT_INTERNAL_INFO * | grant_internal_info, |
| const char * | schema_name | ||
| ) |
Get a cached internal schema access.
| grant_internal_info | the cache |
| schema_name | the name of the internal schema |
| const ACL_internal_table_access * get_cached_table_access | ( | GRANT_INTERNAL_INFO * | grant_internal_info, |
| const char * | schema_name, | ||
| const char * | table_name | ||
| ) |
Get a cached internal table access.
| grant_internal_info | the cache |
| schema_name | the name of the internal schema |
| table_name | the name of the internal table |
| Access_bitmask get_column_grant | ( | THD * | thd, |
| GRANT_INFO * | grant, | ||
| const char * | db_name, | ||
| const char * | table_name, | ||
| const char * | field_name | ||
| ) |
| void get_database_access_map | ( | ACL_USER * | acl_user, |
| Db_access_map * | db_map, | ||
| Db_access_map * | db_wild_map | ||
| ) |
| void get_default_roles | ( | const Auth_id_ref & | acl_user, |
| List_of_auth_id_refs & | authlist | ||
| ) |
Shallow copy a list of default role authorization IDs from an Role_id storage.
| acl_user | A valid authID for which we want the default roles. | |
| [out] | authlist | The target list to be populated. The target list is set to empty if no default role is found. |
| void get_dynamic_privileges | ( | ACL_USER * | acl_user, |
| Dynamic_privileges * | acl | ||
| ) |
| User_to_dynamic_privileges_map * get_dynamic_privileges_map | ( | ) |
| void get_granted_roles | ( | LEX_USER * | user, |
| List_of_granted_roles * | granted_roles | ||
| ) |
This is a convenience function.
| user | The authid to check for granted roles | |
| [out] | granted_roles | A list of granted authids |
| void get_granted_roles | ( | Role_vertex_descriptor & | v, |
| List_of_granted_roles * | granted_roles | ||
| ) |
Populates a list of authorization IDs that are connected to a specified graph vertex in the global roles graph.
The constructed list contains references to a shared memory. The authIDs are not copied!
The list of granted roles is /appended/ to the out variable.
| v | A valid vertex descriptor from the global roles graph | |
| [out] | granted_roles | A list of authorization IDs |
| void get_granted_roles | ( | Role_vertex_descriptor & | v, |
| std::function< void(const Role_id &, bool)> | f | ||
| ) |
| void get_mandatory_roles | ( | std::vector< Role_id > * | mandatory_roles | ) |
| void get_privilege_access_maps | ( | ACL_USER * | acl_user, |
| const List_of_auth_id_refs * | using_roles, | ||
| Access_bitmask * | access, | ||
| Db_access_map * | db_map, | ||
| Db_access_map * | db_wild_map, | ||
| Table_access_map * | table_map, | ||
| SP_access_map * | sp_map, | ||
| SP_access_map * | func_map, | ||
| List_of_granted_roles * | granted_roles, | ||
| Grant_acl_set * | with_admin_acl, | ||
| Dynamic_privileges * | dynamic_acl, | ||
| Restrictions & | restrictions | ||
| ) |
| void get_privilege_desc | ( | char * | to, |
| uint | max_length, | ||
| Access_bitmask | access | ||
| ) |
| void get_sp_access_map | ( | ACL_USER * | acl_user, |
| SP_access_map * | sp_map, | ||
| malloc_unordered_multimap< std::string, unique_ptr_destroy_only< GRANT_NAME > > * | hash | ||
| ) |
| void get_table_access_map | ( | ACL_USER * | acl_user, |
| Table_access_map * | table_map | ||
| ) |
| Access_bitmask get_table_grant | ( | THD * | thd, |
| Table_ref * | table | ||
| ) |
| bool grant_dynamic_privilege | ( | const LEX_CSTRING & | str_priv, |
| const LEX_CSTRING & | str_user, | ||
| const LEX_CSTRING & | str_host, | ||
| bool | with_grant_option, | ||
| Update_dynamic_privilege_table & | update_table | ||
| ) |
Grant one privilege to one user.
| str_priv | Dynamic privilege being granted |
| str_user | Username part of the grantee |
| str_host | Hostname part of the grantee |
| with_grant_option | Flag that determines if grantee can manage the dynamic privilege |
| update_table | Table update handler |
| true | An error occurred. DA must be checked. |
| false | Success |
| bool grant_dynamic_privileges_to_auth_id | ( | const Role_id & | id, |
| const std::vector< std::string > & | priv_list | ||
| ) |
Grant needed dynamic privielges to in memory internal auth id.
| id | auth id to which privileges needs to be granted |
| priv_list | List of privileges to be added to internal auth id |
| True | In case privilege is not registered |
| False | Success |
| bool grant_grant_option_for_all_dynamic_privileges | ( | const LEX_CSTRING & | str_user, |
| const LEX_CSTRING & | str_host, | ||
| Update_dynamic_privilege_table & | update_table | ||
| ) |
Grant grant option to one user for all dynamic privileges.
| str_user | Username part of the grantee |
| str_host | Hostname part of the grantee |
| update_table | Table update handler |
| true | An error occurred. DA must be checked. |
| false | Success |
Grants a single role to a single user.
The change is made to the in-memory roles graph and not persistent.
| role | A pointer to the role to be granted |
| user | A pointer to the user which will be granted |
| with_admin_opt | True if the user should have the ability to pass on the granted role to another authorization id. |
| bool has_any_routine_acl | ( | Security_context * | sctx, |
| const LEX_CSTRING & | db | ||
| ) |
| bool has_any_table_acl | ( | Security_context * | sctx, |
| const LEX_CSTRING & | str | ||
| ) |
| bool has_dynamic_privilege_grant_option | ( | Security_context * | sctx, |
| std::string | priv | ||
| ) |
| bool has_full_view_routine_access | ( | THD * | thd, |
| const char * | db, | ||
| const char * | definer_user, | ||
| const char * | definer_host | ||
| ) |
Check if user has full access to view routine's properties (i.e including stored routine code).
User must have GLOBAL SELECT or SHOW_ROUTINE privilege, or be the definer of this routine.
| thd | Thread handler |
| db | Database name |
| definer_user | Definer username |
| definer_host | Definer host |
| false | no full access. |
| true | has full access. |
| bool has_partial_view_routine_access | ( | THD * | thd, |
| const char * | db, | ||
| const char * | routine_name, | ||
| bool | is_proc | ||
| ) |
Check if user has partial access to view routine's properties (i.e.
excluding stored routine code). User must have EXECUTE/CREATE/ALTER ROUTINE privileges.
| thd | Thread handler |
| db | Database name |
| routine_name | Routine name |
| is_proc | True if this routine is a stored procedure, rather than a stored function. |
| false | no access. |
| true | has partial access. |
| bool has_wildcard_characters | ( | const LEX_CSTRING & | db | ) |
|
static |
The dynamic privilege is probed in the global map that keeps track of dynamic privileges registered with server.
The policy is that
This method assumes that caller must have acquired the necessory ACL_LOCK.
| [in] | privilege | Privilege to be checked in the dynamic privilege map |
| true | Privilege is registered |
| false | Otherwise |
| bool is_granted_role | ( | LEX_CSTRING | user, |
| LEX_CSTRING | host, | ||
| LEX_CSTRING | role, | ||
| LEX_CSTRING | role_host | ||
| ) |
This function works just like check_if_granted_role, but also guarantees that the proper lock is taken so that the function can be used in a wider context.
| user | The user name part of a authid which should be tested |
| host | The host name part of a authid which should be tested |
| role | The role name part of the role authid |
| role_host | The host name part of the role authid |
| true | The value user@host was previously granted role@role_host |
| false | role@role_host is not granted to user@host |
| bool is_granted_table_access | ( | THD * | thd, |
| Access_bitmask | required_acl, | ||
| Table_ref * | table | ||
| ) |
Given a Table_ref object this function checks against.
This function only checks the existence of required ACL on a single table object. No special consideration is made for the table type (derived, view, temporary etc).
| thd | Thread handle |
| required_acl | The privileges which are required to continue |
| table | An initialized, single Table_ref object |
| true | Access is granted |
| false | Access denied |
| bool is_mandatory_role | ( | LEX_CSTRING | role, |
| LEX_CSTRING | role_host, | ||
| bool * | is_mandatory | ||
| ) |
Determine if a role@role_host authid is a mandatory role.
| role | Role name. | |
| role_host | Host name of role. | |
| [out] | is_mandatory | Pointer to boolean hold status of check. |
| true | if failed to determine. e.g., ACL lock acquire failed. |
| false | otherwise. |
| bool is_privileged_user_for_credential_change | ( | THD * | thd | ) |
| bool is_role_id | ( | LEX_USER * | authid | ) |
| void iterate_comma_separated_quoted_string | ( | std::string | str, |
| const std::function< bool(const std::string)> & | f | ||
| ) |
Iterate a string by comma separation and apply a function on each chunk separated by the commas.
| str | The string to be iterated |
| f | A function which will receive the comma separated strings. |
| bool lock_and_get_mandatory_roles | ( | std::vector< Role_id > * | mandatory_roles | ) |
Copy a list of mandatory role authorization IDs.
| [out] | mandatory_roles | Pointer to the target list to be populated. The target list is set to empty if no mandatory role is found. |
Check privileges for LOCK TABLES statement.
| thd | Thread context. |
| tables | List of tables to be locked. |
| false | - Success. |
| true | - Failure. |
| void make_database_privilege_statement | ( | THD * | thd, |
| ACL_USER * | role, | ||
| Protocol * | protocol, | ||
| const Db_access_map & | db_map, | ||
| const Db_access_map & | db_wild_map, | ||
| const DB_restrictions & | restrictions | ||
| ) |
Maps a set of database level ACLs to string representations and sends them through the client protocol.
| thd | The thread handler |
| role | The authid associated with the ACLs |
| protocol | A handler used for sending data to the client |
| db_map | A list of database level ACLs |
| db_wild_map | A list of database level ACLs which use pattern matching |
| restrictions | List of databases on which there exists different restrictions for the ACL_USER. |
| void make_dynamic_privilege_statement | ( | THD * | thd, |
| ACL_USER * | role, | ||
| Protocol * | protocol, | ||
| const Dynamic_privileges & | dyn_priv | ||
| ) |
| void make_global_privilege_statement | ( | THD * | thd, |
| Access_bitmask | want_access, | ||
| ACL_USER * | acl_user, | ||
| String * | global | ||
| ) |
Maps a global ACL to a string representation.
| thd | Thread handler | |
| want_access | An ACL | |
| acl_user | The associated user which carries the ACL | |
| [out] | global | The resulting string |
Maps a set of global level proxy ACLs to string representations and sends them through the client protocol.
| thd | The thread handler |
| user | The authid associated with the proxy ACLs. |
| protocol | The handler used for sending data through the client protocol |
| void make_roles_privilege_statement | ( | THD * | thd, |
| ACL_USER * | role, | ||
| Protocol * | protocol, | ||
| List_of_granted_roles & | granted_roles, | ||
| bool | show_mandatory_roles | ||
| ) |
| void make_sp_privilege_statement | ( | THD * | thd, |
| ACL_USER * | role, | ||
| Protocol * | protocol, | ||
| SP_access_map & | sp_map, | ||
| int | type | ||
| ) |
Maps a set of database level ACLs for stored programs to string representations and sends them through the client protocol.
| thd | A thread handler |
| role | The authid associated with the ACLs |
| protocol | The handler used for sending data through the client protocol |
| sp_map | The ACLs granted to role |
| type | Either 0 for procedures or 1 for functions |
| void make_table_privilege_statement | ( | THD * | thd, |
| ACL_USER * | role, | ||
| Protocol * | protocol, | ||
| Table_access_map & | table_map | ||
| ) |
| void make_with_admin_privilege_statement | ( | THD * | thd, |
| ACL_USER * | acl_user, | ||
| Protocol * | protocol, | ||
| const Grant_acl_set & | with_admin_acl, | ||
| const List_of_granted_roles & | granted_roles | ||
| ) |
| bool mysql_alter_or_clear_default_roles | ( | THD * | thd, |
| role_enum | role_type, | ||
| const List< LEX_USER > * | users, | ||
| const List< LEX_USER > * | roles | ||
| ) |
Set the default roles to NONE, ALL or list of authorization IDs as roles, depending upon the role_type argument.
It writes to table mysql.default_roles and binlog.
| thd | Thread handler |
| role_type | default role type specified by the user. |
| users | Users for whom the default roles are set. |
| roles | list of default roles to be set. |
| true | An error occurred and DA is set |
| false | Successful |
| bool mysql_grant | ( | THD * | thd, |
| const char * | db, | ||
| List< LEX_USER > & | list, | ||
| Access_bitmask | rights, | ||
| bool | revoke_grant, | ||
| bool | is_proxy, | ||
| const List< LEX_CSTRING > & | dynamic_privilege, | ||
| bool | grant_all_current_privileges, | ||
| LEX_GRANT_AS * | grant_as | ||
| ) |
| bool mysql_grant_role | ( | THD * | thd, |
| const List< LEX_USER > * | users, | ||
| const List< LEX_USER > * | roles, | ||
| bool | with_admin_opt | ||
| ) |
Grants a list of roles to a list of users.
Changes are persistent and written in the mysql.roles_edges table.
| thd | Thread handler |
| users | A list of authorization IDs |
| roles | A list of authorization IDs |
| with_admin_opt | True if the granted users should be able to pass on the roles to other authorization IDs |
| true | An error occurred and the DA is set. |
| false | The operation was successful and DA is set. |
| bool mysql_revoke_role | ( | THD * | thd, |
| const List< LEX_USER > * | users, | ||
| const List< LEX_USER > * | roles | ||
| ) |
| bool mysql_routine_grant | ( | THD * | thd, |
| Table_ref * | table_list, | ||
| bool | is_proc, | ||
| List< LEX_USER > & | user_list, | ||
| Access_bitmask | rights, | ||
| bool | revoke_grant, | ||
| bool | write_to_binlog, | ||
| bool | all_current_privileges | ||
| ) |
Store routine level grants in the privilege tables.
| thd | Thread handle |
| table_list | List of routines to give grant |
| is_proc | Is this a list of procedures? |
| user_list | List of users to give grant |
| rights | Table level grant |
| revoke_grant | Is this is a REVOKE command? |
| write_to_binlog | True if this statement should be written to binlog |
| all_current_privileges | Set to true if this is GRANT/REVOKE ALL |
| false | Success. |
| true | An error occurred. |
Activates all granted role in the current security context.
This function acquires the acl_user->lock mutex.
| thd | A valid THD handle |
| except_users | A pointer to a list of LEX_USER objects which represent roles that shouldn't be activated. |
| 0 | Success; the specified role was activated. |
| != | 0 Failure. DA is set. |
| bool mysql_set_active_role_none | ( | THD * | thd | ) |
Reset active roles.
| [in] | thd | THD handle |
| false | Success |
| true | Error |
| bool mysql_set_role_default | ( | THD * | thd | ) |
Activates all the default roles in the current security context.
This function acquires the Acl_cache_lock_guard in read lock.
| thd | A valid THD handle |
| 0 | Success; the specified role was activated. |
| != | 0 Failure. DA is set. |
| bool mysql_show_grants | ( | THD * | thd, |
| LEX_USER * | lex_user, | ||
| const List_of_auth_id_refs & | using_roles, | ||
| bool | show_mandatory_roles, | ||
| bool | have_using_clause | ||
| ) |
SHOW GRANTS FOR user USING [ALL | role [,role ...]].
| thd | thread handler |
| lex_user | The user,host descriptor |
| using_roles | An forward iterable container of LEX_STRING std::pair |
| show_mandatory_roles | true means mandatory roles are listed |
| have_using_clause | true means there's a non-empty USING clause specified |
| int mysql_table_grant | ( | THD * | thd, |
| Table_ref * | table_list, | ||
| List< LEX_USER > & | user_list, | ||
| List< LEX_COLUMN > & | columns, | ||
| Access_bitmask | rights, | ||
| bool | revoke_grant, | ||
| bool | all_current_privileges | ||
| ) |
| bool operator< | ( | const Auth_id_ref & | a, |
| const Auth_id_ref & | b | ||
| ) |
| bool operator== | ( | const Auth_id_ref & | a, |
| const Role_id & | b | ||
| ) |
| bool operator== | ( | const Auth_id_ref & | ref, |
| const std::pair< Role_id, bool > & | rid | ||
| ) |
| bool operator== | ( | const LEX_CSTRING & | a, |
| const LEX_CSTRING & | b | ||
| ) |
| bool operator== | ( | const Role_id & | a, |
| const Auth_id_ref & | b | ||
| ) |
| bool operator== | ( | const Role_id & | a, |
| const std::string & | b | ||
| ) |
| bool operator== | ( | const std::pair< const Role_id, Role_id > & | a, |
| const Auth_id_ref & | b | ||
| ) |
| bool operator== | ( | const std::pair< Role_id, bool > & | a, |
| const std::string & | b | ||
| ) |
| bool operator== | ( | const std::pair< Role_id, bool > & | rid, |
| const Auth_id_ref & | ref | ||
| ) |
| bool operator== | ( | std::pair< const Role_id, std::pair< std::string, bool > > & | a, |
| const std::string & | b | ||
| ) |
| void rebuild_vertex_index | ( | THD * | thd | ) |
Since the gap in the vertex vector was removed all the vertex descriptors has changed.
As a consequence we now need to rebuild the authid_to_vertex index.
|
static |
Remove column access privileges.
| thd | Thread handler. |
| tables_priv_table | Pointer to a TABLE object for opened table mysql.tables_priv_table. |
| columns_priv_table | Pointer to a TABLE object for opened table mysql.columns_priv_table. |
| lex_user | User information. |
| 0 | OK. |
| 1 | Application error happen, it is allowed continuing of operations. |
| < | 0 Engine error. |
|
static |
Remove db access privileges.
| thd | Current thread execution context. |
| table | Pointer to a TABLE object for opened table mysql.db. |
| lex_user | User information. |
| 0 | OK. |
| 1 | Application error happen, it is allowed continuing of operations. |
| < | 0 Engine error. |
|
static |
Remove procedure access privileges.
| thd | Thread handler. |
| procs_priv_table | Pointer to a TABLE object for opened table mysql.procs_priv_table. |
| lex_user | User information. |
| 0 | OK. |
| 1 | Application error happen, it is allowed continuing of operations. |
| < | 0 Engine error. |
| bool rename_dynamic_grant | ( | const LEX_CSTRING & | old_user, |
| const LEX_CSTRING & | old_host, | ||
| const LEX_CSTRING & | new_user, | ||
| const LEX_CSTRING & | new_host, | ||
| Update_dynamic_privilege_table & | update_table | ||
| ) |
| bool report_missing_user_grant_message | ( | THD * | thd, |
| bool | user_exists, | ||
| const char * | user, | ||
| const char * | host, | ||
| const char * | object_name, | ||
| int | err_code | ||
| ) |
Helper method to check if warning or error should be reported based on:
If user does not exists and IGNORE UNKNOWN USER clause is specified then report a warning. If user exists, privilege being revoked is not granted to specified user and IF EXISTS clause is specified report a warning. In none of the above case report error.
| thd | Current thread |
| user_exists | True if user exists in memory structure else false |
| user | user name |
| host | host name |
| object_name | object name on which privilege is being revoked |
| err_code | error code |
| false | for warning. |
| true | for error. |
| bool revoke_all_dynamic_privileges | ( | const LEX_CSTRING & | user, |
| const LEX_CSTRING & | host, | ||
| Update_dynamic_privilege_table & | update_table | ||
| ) |
Revoke all dynamic global privileges.
| user | The target user name |
| host | The target host name |
| update_table | Functor for updating a table |
| true | An error occurred. DA might not be set. |
| false | Success |
| bool revoke_all_granted_roles | ( | THD * | thd, |
| TABLE * | table, | ||
| LEX_USER * | user_from, | ||
| List_of_granted_roles * | granted_roles | ||
| ) |
If possible, it will revoke all roles and default roles from user_from and set them for user_to instead.
| thd | Thread handle | |
| table | A table handler | |
| user_from | The name of the ACL_USER which will be renamed. | |
| [out] | granted_roles | A list of roles that were successfully revoked. |
| true | En error occurred |
| false | Successful |
| bool revoke_all_roles_from_user | ( | THD * | thd, |
| TABLE * | edge_table, | ||
| TABLE * | defaults_table, | ||
| LEX_USER * | user_name | ||
| ) |
Used by mysql_drop_user.
Will drop all
| thd | THD handle |
| edge_table | Handle to table that stores role grants |
| defaults_table | Handle to table that stores default role information |
| user_name | User being dropped |
| true | An error occurred |
| false | Success |
| bool revoke_dynamic_privilege | ( | const LEX_CSTRING & | str_priv, |
| const LEX_CSTRING & | str_user, | ||
| const LEX_CSTRING & | str_host, | ||
| Update_dynamic_privilege_table & | update_table | ||
| ) |
Revoke one privilege from one user.
| str_priv | Privilege being revoked |
| str_user | Username part of the grantee |
| str_host | Hostname part of the grantee |
| update_table | Table update handler |
| true | An error occurred. DA must be checked. |
| false | Success |
| void revoke_dynamic_privileges_from_auth_id | ( | const Role_id & | id, |
| const std::vector< std::string > & | priv_list | ||
| ) |
Revoke dynamic privielges from in memory internal auth id.
| id | auth id from which privileges needs to be revoked |
| priv_list | List of privileges to be removed for internal auth id |
| bool revoke_grant_option_for_all_dynamic_privileges | ( | const LEX_CSTRING & | str_user, |
| const LEX_CSTRING & | str_host, | ||
| Update_dynamic_privilege_table & | update_table | ||
| ) |
Revoke grant option to one user for all dynamic privileges.
| str_user | Username part of the grantee |
| str_host | Hostname part of the grantee |
| update_table | Table update handler |
| true | An error occurred. DA must be checked. |
| false | Success |
Used by mysql_revoke_role() for revoking a specified role from a specified user.
| thd | Thread handler |
| role | The role which will be revoked |
| user | The user who will get its role revoked |
| bool revoke_role_helper | ( | THD * | thd, |
| std::string & | authid_role, | ||
| std::string & | authid_user, | ||
| Role_vertex_descriptor * | user_vert, | ||
| Role_vertex_descriptor * | role_vert | ||
| ) |
This utility function is used by revoke_role() and remove_all_granted_roles() for removing a specific edge from the role graph.
| thd | Thread handler | |
| authid_role | The role which should be revoked | |
| authid_user | The user who will get its role revoked | |
| [out] | user_vert | The vertex descriptor of the user |
| [out] | role_vert | The vertex descriptor of the role |
| true | No such user |
| false | User was removed |
| void roles_delete | ( | void | ) |
Delete the role caches.
| void roles_graph_delete | ( | void | ) |
Delete the ACL role graph artifacts.
| void roles_graph_init | ( | void | ) |
Initialize the roles graph artifacts.
| void roles_init | ( | void | ) |
Initialize the roles caches that consist of the role graphs related artifacts and default role map.
In theory, default role map is supposed to be a policy which has to be kept in sync with role graphs.
| bool roles_rename_authid | ( | THD * | thd, |
| TABLE * | edge_table, | ||
| TABLE * | defaults_table, | ||
| LEX_USER * | user_from, | ||
| LEX_USER * | user_to | ||
| ) |
Renames a user in the mysql.role_edge and the mysql.default_roles tables.
user_to must already exist in the acl_user cache, but user_from may not as long as it exist in the role graph.
| thd | Thread handler |
| edge_table | An open table handle for mysql.edge_mysql |
| defaults_table | An open table handle for mysql.default_roles |
| user_from | The user to rename |
| user_to | The target user name |
| true | An error occurred |
| false | Success |
| void set_dynamic_privileges_map | ( | User_to_dynamic_privileges_map * | map | ) |
| bool sp_grant_privileges | ( | THD * | thd, |
| const char * | sp_db, | ||
| const char * | sp_name, | ||
| bool | is_proc | ||
| ) |
Grant EXECUTE,ALTER privilege for a stored procedure.
| thd | The current thread. |
| sp_db | DB of the stored procedure. |
| sp_name | Name of the stored procedure |
| is_proc | True if this is a SP rather than a function |
| false | Success |
| true | An error occurred. Error message not yet sent. |
| bool sp_revoke_privileges | ( | THD * | thd, |
| const char * | sp_db, | ||
| const char * | sp_name, | ||
| bool | is_proc | ||
| ) |
Revoke privileges for all users on a stored procedure.
Use an error handler that converts errors about missing grants into warnings.
| thd | The current thread. |
| sp_db | DB of the stored procedure |
| sp_name | Name of the stored procedure |
| is_proc | True if this is a SP rather than a function. |
| false | OK. |
| true | Error. Error message not yet sent. |
| User_to_dynamic_privileges_map * swap_dynamic_privileges_map | ( | User_to_dynamic_privileges_map * | map | ) |
| void update_mandatory_roles | ( | void | ) |
|
static |
This utility function checks for the connecting vertices of the role descriptor(authid node) and updates the role flag of the corresponding ACL user.
If there are no incoming edges to this authid node then this is not a role id anymore. It assumes that acl user and role descriptor are, valid and passed correctly.
| [in] | role_vert | The role vertex descriptor |
| [in,out] | acl_user | The acl role |
|
static |
| void update_sctx | ( | Security_context * | sctx, |
| LEX_USER * | to_user_ptr | ||
| ) |
| const char* any_db = "*any*" |
|
static |
| Role_index_map* g_authid_to_vertex = nullptr |
|
extern |
| User_to_dynamic_privileges_map* g_dynamic_privileges_map = nullptr |
| Granted_roles_graph* g_granted_roles = nullptr |
|
static |
Grantee is of form 'user'@'hostname', so add +1 for '@' and +4 for the single quotes.
And +1 for null byte too.
Note that we use USERNAME_LENGTH and not USERNAME_CHAR_LENGTH here because the username can be utf8.
|
extern |
1.9.2