快活林资源网

关于MySQL绕过授予information_schema中对象时报ERROR 1044（4200）错误
数据库 2024/12/23 佚名
3 1
快活林资源网 Design By www.csstdc.com

这个问题是微信群中网友关于MySQL权限的讨论，有这么一个业务需求（下面是他的原话）：

因为MySQL的很多功能都依赖主键，我想用zabbix用户，来监控业务数据库的所有表，是否都建立了主键。

监控的语句是：

FROM  information_schema.tables t1 
    LEFT OUTER JOIN information_schema.table_constraints t2 
          ON t1.table_schema = t2.table_schema 
            AND t1.table_name = t2.table_name 
            AND t2.constraint_name IN ( 'PRIMARY' ) 
WHERE t2.table_name IS NULL 
    AND t1.table_schema NOT IN ( 'information_schema', 'myawr', 'mysql', 
                  'performance_schema', 
                  'slowlog', 'sys', 'test' ) 
    AND t1.table_type = 'BASE TABLE'

但是我不希望zabbix用户，能读取业务库的数据。一旦不给zabbix用户读取业务库数据的权限，那么information_schema.TABLES 和 information_schema.TABLE_CONSTRAINTS 就不包含业务库的表信息了，也就统计不出来业务库的表是否有建主键。有没有什么办法，即让zabbix不能读取业务库数据，又能监控是否业务库的表没有建立主键？

首先，我们要知道一个事实：information_schema下的视图没法授权给某个用户。如下所示

mysql> GRANT SELECT ON information_schema.TABLES TO test@'%';
ERROR 1044 (42000): Access denied for user 'root'@'localhost' to database 'information_schema'

关于这个问题，可以参考mos上这篇文章：Why Setting Privileges on INFORMATION_SCHEMA does not Work (文档 ID 1941558.1)

APPLIES TO:

MySQL Server - Version 5.6 and later

Information in this document applies to any platform.

GOAL

To determine how MySQL privileges work for INFORMATION_SCHEMA.

SOLUTION

A simple GRANT statement would be something like:

mysql> grant select,execute on information_schema.* to 'dbadm'@'localhost';

ERROR 1044 (42000): Access denied for user 'root'@'localhost' to database 'information_schema'

The error indicates that the super user does not have the privileges to change the information_schema access privileges.

Which seems to go against what is normally the case for the root account which has SUPER privileges.

The reason for this error is that the information_schema database is actually a virtual database that is built when the service is started.

It is made up of tables and views designed to keep track of the server meta-data, that is, details of all the tables, procedures etc. in the database server.

So looking specifically at the above command, there is an attempt to add SELECT and EXECUTE privileges to this specialised database.

The SELECT option is not required however, because all users have the ability to read the tables in the information_schema database, so this is redundant.

The EXECUTE option does not make sense, because you are not allowed to create procedures in this special database.

There is also no capability to modify the tables in terms of INSERT, UPDATE, DELETE etc., so privileges are hard coded instead of managed per user.

那么怎么解决这个授权问题呢？ 直接授权不行，那么我们只能绕过这个问题，间接实现授权。思路如下：首先创建一个存储过程（用户数据库），此存储过程找出没有主键的表的数量，然后将其授予test用户。

DELIMITER //
CREATE DEFINER=`root`@`localhost` PROCEDURE `moitor_without_primarykey`()
BEGIN
   SELECT COUNT(*) 
FROM  information_schema.tables t1 
    LEFT OUTER JOIN information_schema.table_constraints t2 
          ON t1.table_schema = t2.table_schema 
            AND t1.table_name = t2.table_name 
            AND t2.constraint_name IN ( 'PRIMARY' ) 
WHERE t2.table_name IS NULL 
    AND t1.table_schema NOT IN ( 'information_schema', 'myawr', 'mysql', 
                  'performance_schema', 
                  'slowlog', 'sys', 'test' ) 
    AND t1.table_type = 'BASE TABLE';
END //
DELIMITER ;
 
 
mysql> GRANT EXECUTE ON PROCEDURE moitor_without_primarykey TO 'test'@'%';
Query OK, 0 rows affected (0.02 sec)

此时test就能间接的去查询information_schema下的对象了。

mysql> select current_user();
+----------------+
| current_user() |
+----------------+
| test@%     |
+----------------+
1 row in set (0.00 sec)
 
mysql> call moitor_without_primarykey;
+----------+
| COUNT(*) |
+----------+
|    6 |
+----------+
1 row in set (0.02 sec)
 
Query OK, 0 rows affected (0.02 sec)

查看test用户的权限。

mysql> show grants for test@'%';
+-------------------------------------------------------------------------------+
| Grants for test@%                               |
+-------------------------------------------------------------------------------+
| GRANT USAGE ON *.* TO `test`@`%`                       |
| GRANT EXECUTE ON PROCEDURE `zabbix`.`moitor_without_primarykey` TO `test`@`%` |
+-------------------------------------------------------------------------------+
2 rows in set (0.00 sec)
快活林资源网 Design By www.csstdc.com
广告合作：本站广告合作请联系QQ：858582 申请时备注：广告合作（否则不回）
免责声明：本站资源来自互联网收集,仅供用于学习和交流,请遵循相关法律法规,本站一切资源不代表本站立场,如有侵权、后门、不妥请联系本站删除！
快活林资源网 Design By www.csstdc.com
www.csstdc.com 快活林资源网
120,135影音资源
344,641技术资源
22,817软件资源
435,032站长资源

更新日志

友情链接

杰晶网络 DDR爱好者之家 桃源资源网 杰网资源 富贵资源网 南强小屋 铁雪资源网 幽灵资源网 万梅资源网 狼山资源网 白云岛资源网 昆仑资源网 相思资源网 明霞山资源网 内蒙古资源网 黑松山资源网 茶园资源网 饿虎岗资源网 大旗谷资源网 常春岛资源网 岱庙资源网 兴国资源网 快活林资源网 蝙蝠岛资源网 帝王谷资源网 白云城资源网 伏龙阁资源网 清风细雨楼 天枫庄资源网 圆月山庄资源网 无争山庄资源网 神水资源网 移花宫资源网 神剑山庄资源网 无为清净楼资源网 金钱帮资源网 丐帮资源网 华山资源网 极乐门资源网 小李飞刀资源网 凤求凰客栈 风云阁资源网 金狮镖局 鸳鸯亭资源网 千金楼资源网 更多链接
快活林资源网 Design By www.csstdc.com