Edit File: processlist_priv.inc
############ suite/funcs_1/datadict/processlist_priv.inc ############### # # # Testing of privileges around # # SELECT ... PROCESSLIST/SHOW PROCESSLIST # # # # Note(mleich): # # There is a significant risk to get an unstable test because of # # timing issues. # # Example1: # # 1. Disconnect connection X # # 2. Switch to connection Y # # 3. SHOW PROCESSLIST might present a record like # # <ID> <user> <host> <db> Quit 0 cleaning up NULL # # or even a row where connection X is without # # "Quit" or "cleaning up". # # That means our SHOW PROCESSLIST can come too early. # # Solution: # # Close the connections at the end of the test. # # Example2 (2008-08-14 again observed): # # 1. connection X: SHOW PROCESSLIST/GRANT ... etc. # # 2. Switch to connection Y # # 3. SHOW PROCESSLIST might present a record like # # <ID> <user> <host> <db> Query TIME cleaning up <command> # # <ID> <user> <host> <db> Query TIME writing to net <command> # # Problems happens more often in case of slow filesystem! # # First Solution: # # Insert a dummy SQL command where the cleanup is most probably # # fast before switching to another connection and running # # SHOW/SELECT PROCESSLIST. # # Suppress writing to protocol by assignment to $variable. # # let $my_var= `SELECT 1`; # # Even the 'SELECT 1' was in some cases in state # # "writing to net". # # Final Solution: # # --real_sleep 0.3 # # This value was at least on my box sufficient. # # Please inform us if this test fails so that we can adjust # # the sleep time better or switch to poll routines. # # # # Storage engine variants of this test do not make sense. # # - I_S tables use the MEMORY storage engine whenever possible. # # - There are some I_S table which need column data types which # # are not supported by MEMORY. Example: LONGTEXT/BLOB # # MyISAM will be used for such tables. # # The column PROCESSLIST.INFO is of data type LONGTEXT # # ----> MyISAM # # - There is no impact of the GLOBAL(server) or SESSION default # # storage engine setting on the engine used for I_S tables. # # That means we cannot get NDB or InnoDB instead. # # # # Creation: # # 2007-08 hhunger Implement this test as part of # # WL#3982 Test information_schema.processlist # # # # Last update: # # 2008-08-14 mleich Bug#38270 Test "processlist_priv_ps" fails on # # varying "processlist" output # # - Replace one sleep by a poll routines # # - Remove or disable superfluous sleeps # # # ######################################################################## # The following variables are used in "datadict_priv.inc" and here. # # information_schema table to be tested let $table= processlist; # # columns of the information_schema table e.g. to use in a select. let $columns= ID, USER, HOST, DB, COMMAND, TIME, STATE, INFO; # # Where clause for an update. let $update_where= WHERE id=1 ; # # Column to be used in the SET of an update. let $set_column= user='any_user' ; # # Where clause of a delete. let $delete_where= WHERE id=1 ; # # Column to be dropped. let $drop_column= user; # # Column to be indexed let $index_col= user; USE information_schema; --echo #################################################################################### --echo 1 Prepare test. --echo connection default (user=root) --echo #################################################################################### if (`SELECT COUNT(*) <> 1 FROM processlist`) { --echo This test expects one connection to the server. --echo Expectation: USER HOST DB COMMAND STATE INFO --echo Expectation: root localhost information_schema Query executing SELECT USER,HOST,DB,COMMAND,STATE,INFO FROM processlist ORDER BY ID --echo But we found in the moment: SELECT USER,HOST,DB,COMMAND,STATE,INFO FROM processlist ORDER BY ID; --echo Maybe --echo - the base configuration (no of parallel auxiliary sessions) of the server has changed --echo - a parallel test intended for another server accidently connected to our current one --echo We cannot proceed in this situation. Abort exit; } --echo #################################################################################### --echo 1.1 Create two user --echo #################################################################################### # access to info tables as normal user --error 0, ER_CANNOT_USER DROP USER ddicttestuser1@'localhost'; --error 0, ER_CANNOT_USER DROP USER ddicttestuser2@'localhost'; CREATE USER ddicttestuser1@'localhost'; CREATE USER ddicttestuser2@'localhost'; SET PASSWORD FOR ddicttestuser1@'localhost' = PASSWORD('ddictpass'); SET PASSWORD FOR ddicttestuser2@'localhost' = PASSWORD('ddictpass'); --echo #################################################################################### --echo 1.2 Establish connection con100 (user=ddicttestuser1 with no PROCESS privilege): connect (con100,localhost,ddicttestuser1,ddictpass,information_schema); --echo #################################################################################### --echo #################################################################################### --echo 2 connection default(user=root with default privileges): --echo SHOW/SELECT shows all processes/threads. --echo #################################################################################### connection default; # Avoid Bug#38270 Test "processlist_priv_ps" fails on varying "processlist" output # This subtest expects that the connection con100 is in state 'Sleep'. # Poll till the connection con100 is in state COMMAND = 'Sleep'. let $wait_timeout= 10; let $wait_condition= SELECT COUNT(*) = 1 FROM INFORMATION_SCHEMA.PROCESSLIST WHERE DB = 'information_schema' AND COMMAND = 'Sleep' AND USER = 'ddicttestuser1'; --source include/wait_condition.inc eval SHOW CREATE TABLE $table; --replace_column 1 ID 3 HOST_NAME 6 TIME eval SHOW $table; --replace_column 1 ID 3 HOST_NAME 6 TIME eval SELECT * FROM $table $select_where ORDER BY id; --replace_column 1 ID 3 HOST_NAME 6 TIME eval SELECT $columns FROM $table $select_where ORDER BY id; --source suite/funcs_1/datadict/datadict_priv.inc --echo #################################################################################### --echo 3 Switch to connection con100 (user=ddicttestuser1 with no PROCESS privilege): connection con100; --echo SHOW/SELECT shows only the processes (1) of the user. --echo #################################################################################### # No need for poll routine here. # The current state of the default session might depend on load of testing box # but "ddicttestuser1" must not see anything of the root session. eval SHOW CREATE TABLE $table; --replace_column 1 ID 3 HOST_NAME 6 TIME eval SHOW $table; --replace_column 1 ID 3 HOST_NAME 6 TIME eval SELECT * FROM $table $select_where ORDER BY id; --replace_column 1 ID 3 HOST_NAME 6 TIME eval SELECT $columns FROM $table $select_where ORDER BY id; --source suite/funcs_1/datadict/datadict_priv.inc --real_sleep 0.3 --echo #################################################################################### --echo 4 Grant PROCESS privilege to ddicttestuser1 --echo connection default (user=root) --echo #################################################################################### connection default; GRANT PROCESS ON *.* TO ddicttestuser1@'localhost' IDENTIFIED BY 'ddictpass'; --real_sleep 0.3 --echo #################################################################################### --echo 4.1 Existing connection con100 (ddicttestuser1) --echo The user ddicttestuser1 has the PROCESS privilege, but the connection was --echo established before PROCESS was granted. --echo SHOW/SELECT shows only the processes (1) of the user. --echo #################################################################################### connection con100; SHOW GRANTS; --replace_column 1 ID 3 HOST_NAME 6 TIME SHOW processlist; --replace_column 1 ID 3 HOST_NAME 6 TIME SELECT * FROM information_schema.processlist; --real_sleep 0.3 --echo #################################################################################### --echo 4.2 New connection con101 (ddicttestuser1 with PROCESS privilege) --echo SHOW/SELECT shows all processes/threads. --echo #################################################################################### connect (con101,localhost,ddicttestuser1,ddictpass,information_schema); SHOW GRANTS; --replace_column 1 ID 3 HOST_NAME 6 TIME SHOW processlist; --replace_column 1 ID 3 HOST_NAME 6 TIME SELECT * FROM information_schema.processlist; --real_sleep 0.3 --echo #################################################################################### --echo 5 Grant PROCESS privilege to anonymous user. --echo connection default (user=root) --echo #################################################################################### connection default; GRANT PROCESS ON *.* TO ''@'localhost'; --real_sleep 0.3 --echo #################################################################################### --echo 5.1 Establish connection (anonymous1,localhost,'',,information_schema) --echo anonymous user with PROCESS privilege --echo SHOW/SELECT shows all processes/threads. --echo #################################################################################### connect (anonymous1,localhost,"''",,information_schema); SHOW GRANTS; --replace_column 1 ID 3 HOST_NAME 6 TIME SHOW processlist; --replace_column 1 ID 3 HOST_NAME 6 TIME SELECT * FROM information_schema.processlist; --real_sleep 0.3 --echo #################################################################################### --echo 6 Revoke PROCESS privilege from ddicttestuser1 --echo connection default (user=root) --echo #################################################################################### connection default; REVOKE PROCESS ON *.* FROM ddicttestuser1@'localhost' IDENTIFIED BY 'ddictpass'; --real_sleep 0.3 --echo #################################################################################### --echo 6.1 New connection con102 (ddicttestuser1 has no more PROCESS privilege) connect (con102,localhost,ddicttestuser1,ddictpass,information_schema); --echo Again (compared to state before GRANT PROCESS) only the processes of --echo ddicttestuser1 are visible. --echo #################################################################################### SHOW GRANTS; --replace_column 1 ID 3 HOST_NAME 6 TIME SHOW processlist; --replace_column 1 ID 3 HOST_NAME 6 TIME SELECT * FROM information_schema.processlist; --real_sleep 0.3 --echo #################################################################################### --echo 7 Revoke PROCESS privilege from anonymous user --echo connection default (user=root) --echo #################################################################################### connection default; REVOKE PROCESS ON *.* FROM ''@'localhost'; --real_sleep 0.3 --echo #################################################################################### --echo 7.1 New connection (anonymous2,localhost,'',,information_schema) connect (anonymous2,localhost,"''",,information_schema); --echo The anonymous user has no more the PROCESS privilege --echo Again only the processes of the anonymous user are visible. --echo #################################################################################### SHOW GRANTS FOR ''@'localhost'; if ($fixed_bug_30395) { # Bug#30395 strange results after REVOKE PROCESS ON *.* FROM ... --replace_column 1 ID 3 HOST_NAME 6 TIME SHOW processlist; } --replace_column 1 ID 3 HOST_NAME 6 TIME SELECT * FROM information_schema.processlist; --real_sleep 0.3 --echo #################################################################################### --echo 8 Grant SUPER (does not imply PROCESS) privilege to ddicttestuser1 --echo connection default (user=root) --echo #################################################################################### connection default; GRANT SUPER ON *.* TO 'ddicttestuser1'@'localhost'; --real_sleep 0.3 --echo #################################################################################### --echo 8.1 New connection con103 (ddicttestuser1 with SUPER privilege) connect (con103,localhost,ddicttestuser1,ddictpass,information_schema); --echo Only the processes of ddicttestuser1 user are visible. --echo #################################################################################### SHOW GRANTS FOR 'ddicttestuser1'@'localhost'; --replace_column 1 ID 3 HOST_NAME 6 TIME SHOW processlist; --replace_column 1 ID 3 HOST_NAME 6 TIME SELECT * FROM information_schema.processlist; --real_sleep 0.3 --echo #################################################################################### --echo 9 Revoke SUPER privilege from user ddicttestuser1 --echo connection default (user=root) --echo #################################################################################### connection default; REVOKE SUPER ON *.* FROM 'ddicttestuser1'@'localhost'; --real_sleep 0.3 --echo #################################################################################### --echo 9.1 New connection con104 (ddicttestuser1 without SUPER privilege) connect (con104,localhost,ddicttestuser1,ddictpass,information_schema); --echo ddicttestuser1 has no more the SUPER privilege. --echo Only the processes of ddicttestuser1 are visible. --echo #################################################################################### SHOW GRANTS FOR 'ddicttestuser1'@'localhost'; --replace_column 1 ID 3 HOST_NAME 6 TIME SHOW processlist; --replace_column 1 ID 3 HOST_NAME 6 TIME SELECT * FROM information_schema.processlist; --real_sleep 0.3 --echo #################################################################################### --echo 10 Grant SUPER privilege with grant option to user ddicttestuser1. --echo connection default (user=root) --echo #################################################################################### connection default; GRANT SUPER ON *.* TO 'ddicttestuser1'@'localhost' WITH GRANT OPTION; --real_sleep 0.3 --echo #################################################################################### --echo 10.1 New connection con105 (ddicttestuser1 with SUPER privilege and GRANT OPTION) connect (con105,localhost,ddicttestuser1,ddictpass,information_schema); --echo Try to grant PROCESS privilege to user ddicttestuser2 without having it. --echo #################################################################################### SHOW GRANTS FOR 'ddicttestuser1'@'localhost'; --error ER_ACCESS_DENIED_ERROR GRANT PROCESS ON *.* TO 'ddicttestuser2'@'localhost'; --echo #################################################################################### --echo 10.2 Grant SUPER and PROCESS privilege with grant option to user ddicttestuser1 --echo connection default (user=root) --echo #################################################################################### connection default; GRANT SUPER,PROCESS ON *.* TO 'ddicttestuser1'@'localhost' WITH GRANT OPTION; --real_sleep 0.3 --echo #################################################################################### --echo 10.3 New connection con106 (ddicttestuser1 with SUPER,PROCESS WITH GRANT OPTION) connect (con106,localhost,ddicttestuser1,ddictpass,information_schema); --echo Grant PROCESS privilege to user ddicttestuser2 --echo #################################################################################### SHOW GRANTS FOR 'ddicttestuser1'@'localhost'; GRANT PROCESS ON *.* TO 'ddicttestuser2'@'localhost'; --real_sleep 0.3 --echo #################################################################################### --echo 10.4 New connection con200 (ddicttestuser2 with PROCESS privilege) connect (con200,localhost,ddicttestuser2,ddictpass,information_schema); --echo ddicttestuser2 has now the PROCESS privilege and sees all connections --echo #################################################################################### SHOW GRANTS FOR 'ddicttestuser2'@'localhost'; --replace_column 1 ID 3 HOST_NAME 6 TIME SHOW processlist; --replace_column 1 ID 3 HOST_NAME 6 TIME SELECT * FROM information_schema.processlist; --real_sleep 0.3 --echo #################################################################################### --echo 11 User ddicttestuser1 revokes PROCESS privilege from user ddicttestuser2 --echo connection ddicttestuser1; --echo #################################################################################### connection con106; REVOKE PROCESS ON *.* FROM 'ddicttestuser2'@'localhost'; --real_sleep 0.3 --echo #################################################################################### --echo 11.1 New connection con201 (ddicttestuser2) connect (con201,localhost,ddicttestuser2,ddictpass,information_schema); --echo ddicttestuser2 has no more the PROCESS privilege and can only see own connects --echo #################################################################################### SHOW GRANTS; --replace_column 1 ID 3 HOST_NAME 6 TIME SHOW processlist; --replace_column 1 ID 3 HOST_NAME 6 TIME SELECT * FROM information_schema.processlist; --real_sleep 0.3 --echo #################################################################################### --echo 11.2 Revoke SUPER,PROCESS,GRANT OPTION privilege from user ddicttestuser1 --echo connection default (user=root) --echo #################################################################################### connection default; REVOKE SUPER,PROCESS,GRANT OPTION ON *.* FROM 'ddicttestuser1'@'localhost'; --real_sleep 0.3 --echo #################################################################################### --echo 11.3 New connection con107 (ddicttestuser1) connect (con107,localhost,ddicttestuser1,ddictpass,information_schema); --echo ddicttestuser1 has no more the PROCESS privilege and can only see own connects --echo He is also unable to GRANT the PROCESS privilege to ddicttestuser2 --echo #################################################################################### SHOW GRANTS FOR 'ddicttestuser1'@'localhost'; --error ER_ACCESS_DENIED_ERROR GRANT PROCESS ON *.* TO 'ddicttestuser2'@'localhost'; --replace_column 1 ID 3 HOST_NAME 6 TIME SHOW processlist; --replace_column 1 ID 3 HOST_NAME 6 TIME SELECT * FROM information_schema.processlist; --real_sleep 0.3 --echo #################################################################################### --echo 12 Revoke the SELECT privilege from user ddicttestuser1 --echo connection default (user=root) --echo #################################################################################### connection default; REVOKE SELECT ON *.* FROM 'ddicttestuser1'@'localhost'; --real_sleep 0.3 --echo #################################################################################### --echo 12.1 New connection con108 (ddicttestuser1) connect (con108,localhost,ddicttestuser1,ddictpass,information_schema); --echo ddicttestuser1 has neither PROCESS nor SELECT privilege --echo Manual says: Each MySQL user has the right to access these tables, but can see --echo only the rows ... --echo Therefore the missing SELECT privilege does not affect SELECTs on PROCESSLIST. --echo #################################################################################### SHOW GRANTS FOR 'ddicttestuser1'@'localhost'; --replace_column 1 ID 3 HOST_NAME 6 TIME SHOW processlist; --replace_column 1 ID 3 HOST_NAME 6 TIME SELECT * FROM information_schema.processlist; --real_sleep 0.3 --echo #################################################################################### --echo 12.2 Revoke only the SELECT privilege on the information_schema from ddicttestuser1. --echo connection default (user=root) --echo #################################################################################### connection default; --error ER_DBACCESS_DENIED_ERROR REVOKE SELECT ON information_schema.* FROM 'ddicttestuser3'@'localhost'; --real_sleep 0.3 --echo #################################################################################### --echo connection default (user=root) --echo Cleanup: close connections, DROP USER etc. --echo #################################################################################### connection default; disconnect con100; disconnect con101; disconnect con102; disconnect con103; disconnect con104; disconnect con105; disconnect con106; disconnect con107; disconnect con108; disconnect con200; disconnect con201; disconnect anonymous1; disconnect anonymous2; DROP USER ddicttestuser1@'localhost'; DROP USER ddicttestuser2@'localhost'; REVOKE USAGE ON *.* FROM ''@'localhost'; DROP USER ''@'localhost';
Back to File Manager