Privilege System Grant Tables
579
• The
SUPER
[578]
privilege can be used to terminate other sessions or change how the server
operates.
• Privileges granted for the
mysql
database itself can be used to change passwords and other access
privilege information. Passwords are stored encrypted, so a malicious user cannot simply read them
to know the plain text password. However, a user with write access to the
user
table
Password
column can change an account's password, and then connect to the MySQL server using that
account.
6.2.2. Privilege System Grant Tables
Normally, you manipulate the contents of the grant tables in the
mysql
database indirectly by using
statements such as
GRANT
and
REVOKE
to set up accounts and control the privileges available to
each one. See
Section 13.7.1, “Account Management Statements”
. The discussion here describes the
underlying structure of the grant tables and how the server uses their contents when interacting with
clients.
These
mysql
database tables contain grant information:
•
user
: Contains user accounts, global privileges, and other non-privilege columns.
•
db
: Contains database-level privileges.
•
host
: Obsolete.
•
tables_priv
: Contains table-level privileges.
•
columns_priv
: Contains column-level privileges.
•
procs_priv
: Contains stored procedure and function privileges.
Other tables in the
mysql
database do not hold grant information and are discussed elsewhere:
•
func
: Contains information about user-defined functions: See
Section 21.2, “Adding New Functions
to MySQL”
.
•
help_xxx
: These tables are used for server-side help: See
Section 5.1.8, “Server-Side Help”
.
•
proc
: Contains information about stored procedures and functions: See
Section 18.2, “Using Stored
Routines (Procedures and Functions)”
.
•
time_zone_xxx
: These tables contain time zone information: See
Section 10.6, “MySQL Server
Time Zone Support”
.
Each grant table contains scope columns and privilege columns:
• Scope columns determine the scope of each row (entry) in the tables; that is, the context in which
the row applies. For example, a
user
table row with
Host
and
User
values of
'thomas.loc.gov'
and
'bob'
would be used for authenticating connections made to the server from the host
thomas.loc.gov
by a client that specifies a user name of
bob
. Similarly, a
db
table row with
Host
,
User
, and
Db
column values of
'thomas.loc.gov'
,
'bob'
and
'reports'
would be
used when
bob
connects from the host
thomas.loc.gov
to access the
reports
database. The
tables_priv
and
columns_priv
tables contain scope columns indicating tables or table/column
combinations to which each row applies. The
procs_priv
scope columns indicate the stored
routine to which each row applies.
• Privilege columns indicate which privileges are granted by a table row; that is, what operations can
be performed. The server combines the information in the various grant tables to form a complete
description of a user's privileges.
Section 6.2.5, “Access Control, Stage 2: Request Verification”
,
describes the rules that are used to do this.
The server uses the grant tables in the following manner:
Summary of Contents for 5.0
Page 1: ...MySQL 5 0 Reference Manual ...
Page 18: ...xviii ...
Page 60: ...40 ...
Page 396: ...376 ...
Page 578: ...558 ...
Page 636: ...616 ...
Page 844: ...824 ...
Page 1234: ...1214 ...
Page 1427: ...MySQL Proxy Scripting 1407 ...
Page 1734: ...1714 ...
Page 1752: ...1732 ...
Page 1783: ...Configuring Connector ODBC 1763 ...
Page 1793: ...Connector ODBC Examples 1773 ...
Page 1839: ...Connector Net Installation 1819 2 You must choose the type of installation to perform ...
Page 2850: ...2830 ...
Page 2854: ...2834 ...
Page 2928: ...2908 ...
Page 3000: ...2980 ...
Page 3122: ...3102 ...
Page 3126: ...3106 ...
Page 3174: ...3154 ...
Page 3232: ...3212 ...
