Pre-General Availability Draft: 2017-05-25
column_list)]] ... ON [
user_or_role] ... REVOKE ALL [PRIVILEGES], GRANT OPTION FROM
user_or_role] ... REVOKE PROXY ON
user_or_role] ... REVOKE
role] ... FROM
user: (see Section 7.2.4, “Specifying Account Names”)
role: (see Section 7.2.5, “Specifying Role Names”.
REVOKE statement enables
system administrators to revoke privileges and roles, which can
be revoked from user accounts and roles.
For information about roles, see Section 7.3.4, “Using Roles”.
REVOKE either succeeds for all
named users and roles or rolls back and has no effect if any
error occurs. The statement is written to the binary log only if
it succeeds for all named users and roles.
REVOKE INSERT ON *.* FROM 'jeffrey'@'localhost'; REVOKE 'role1', 'role2' FROM 'user1'@'localhost', 'user2'@'localhost'; REVOKE SELECT ON world.* FROM 'role3';
The host name part of the account or role name, if omitted,
For details on the levels at which privileges exist, the
object_type values, and the syntax
for specifying users and passwords, see Section 188.8.131.52, “GRANT Syntax”
To revoke all privileges, use the second syntax, which drops all global, database, table, column, and routine privileges for the named users or roles:
REVOKE ALL PRIVILEGES, GRANT OPTION FROM
REVOKE ALL PRIVILEGES, GRANT OPTION does not
revoke any roles.
The syntax for which the
keyword is followed by one or more role names takes a
FROM clause indicating one or more users or
roles from which to revoke the roles.
A revoked role immediately affects any user account from which it was revoked, such that within any current session for the account, its privileges are adjusted for the next statement executed.
Revoking a role revokes the role itself, not the privileges that
it represents. If an account is granted a role that includes a
given privilege, and is also granted the privilege explicitly or
another role that includes the privilege, the account still is
granted that privilege after the first role is revoked. For
example, if an account is granted two roles that each include
SELECT, the account still can
select after either role is revoked.
REVOKE ALL ON *.* (at the global level)
revokes all granted static global privileges and all granted
User accounts and roles from which privileges and roles are to be revoked must exist, but the roles to be revoked need not be currently granted to them.
If the grant tables hold privilege rows that contain mixed-case
database or table names and the
variable is set to a nonzero value,
REVOKE cannot be used to revoke
these privileges. It will be necessary to manipulate the grant
tables directly. (
GRANT will not
create such rows when
lower_case_table_names is set,
but such rows might have been created prior to setting the
When successfully executed from the mysql
REVOKE responds with
Query OK, 0 rows affected. To determine what
privileges remain after the operation, use
SHOW GRANTS. See
Section 184.108.40.206, “SHOW GRANTS Syntax”.