You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
227 lines
7.0 KiB
227 lines
7.0 KiB
// Copyright 2017 PingCAP, Inc.
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
package executor
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
|
|
"github.com/pingcap/errors"
|
|
"github.com/pingcap/parser/ast"
|
|
"github.com/pingcap/parser/mysql"
|
|
"github.com/pingcap/tidb/domain"
|
|
"github.com/pingcap/tidb/infoschema"
|
|
"github.com/pingcap/tidb/sessionctx"
|
|
"github.com/pingcap/tidb/table"
|
|
"github.com/pingcap/tidb/util/chunk"
|
|
"github.com/pingcap/tidb/util/logutil"
|
|
"github.com/pingcap/tidb/util/sqlexec"
|
|
"go.uber.org/zap"
|
|
)
|
|
|
|
/***
|
|
* Revoke Statement
|
|
* See https://dev.mysql.com/doc/refman/5.7/en/revoke.html
|
|
************************************************************************************/
|
|
var (
|
|
_ Executor = (*RevokeExec)(nil)
|
|
)
|
|
|
|
// RevokeExec executes RevokeStmt.
|
|
type RevokeExec struct {
|
|
baseExecutor
|
|
|
|
Privs []*ast.PrivElem
|
|
ObjectType ast.ObjectTypeType
|
|
Level *ast.GrantLevel
|
|
Users []*ast.UserSpec
|
|
|
|
ctx sessionctx.Context
|
|
is infoschema.InfoSchema
|
|
done bool
|
|
}
|
|
|
|
// Next implements the Executor Next interface.
|
|
func (e *RevokeExec) Next(ctx context.Context, req *chunk.Chunk) error {
|
|
if e.done {
|
|
return nil
|
|
}
|
|
e.done = true
|
|
|
|
// Commit the old transaction, like DDL.
|
|
if err := e.ctx.NewTxn(ctx); err != nil {
|
|
return err
|
|
}
|
|
defer func() { e.ctx.GetSessionVars().SetStatusFlag(mysql.ServerStatusInTrans, false) }()
|
|
|
|
// Create internal session to start internal transaction.
|
|
isCommit := false
|
|
internalSession, err := e.getSysSession()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
defer func() {
|
|
if !isCommit {
|
|
_, err := internalSession.(sqlexec.SQLExecutor).Execute(context.Background(), "rollback")
|
|
if err != nil {
|
|
logutil.BgLogger().Error("rollback error occur at grant privilege", zap.Error(err))
|
|
}
|
|
}
|
|
e.releaseSysSession(internalSession)
|
|
}()
|
|
|
|
_, err = internalSession.(sqlexec.SQLExecutor).Execute(context.Background(), "begin")
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
// Revoke for each user.
|
|
for _, user := range e.Users {
|
|
// Check if user exists.
|
|
exists, err := userExists(e.ctx, user.User.Username, user.User.Hostname)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if !exists {
|
|
return errors.Errorf("Unknown user: %s", user.User)
|
|
}
|
|
|
|
err = e.revokeOneUser(internalSession, user.User.Username, user.User.Hostname)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
}
|
|
|
|
_, err = internalSession.(sqlexec.SQLExecutor).Execute(context.Background(), "commit")
|
|
if err != nil {
|
|
return err
|
|
}
|
|
isCommit = true
|
|
domain.GetDomain(e.ctx).NotifyUpdatePrivilege(e.ctx)
|
|
return nil
|
|
}
|
|
|
|
func (e *RevokeExec) revokeOneUser(internalSession sessionctx.Context, user, host string) error {
|
|
dbName := e.Level.DBName
|
|
if len(dbName) == 0 {
|
|
dbName = e.ctx.GetSessionVars().CurrentDB
|
|
}
|
|
|
|
// If there is no privilege entry in corresponding table, insert a new one.
|
|
// DB scope: mysql.DB
|
|
// Table scope: mysql.Tables_priv
|
|
// Column scope: mysql.Columns_priv
|
|
switch e.Level.Level {
|
|
case ast.GrantLevelDB:
|
|
ok, err := dbUserExists(internalSession, user, host, dbName)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if !ok {
|
|
return errors.Errorf("There is no such grant defined for user '%s' on host '%s' on database %s", user, host, dbName)
|
|
}
|
|
case ast.GrantLevelTable:
|
|
ok, err := tableUserExists(internalSession, user, host, dbName, e.Level.TableName)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if !ok {
|
|
return errors.Errorf("There is no such grant defined for user '%s' on host '%s' on table %s.%s", user, host, dbName, e.Level.TableName)
|
|
}
|
|
}
|
|
|
|
for _, priv := range e.Privs {
|
|
err := e.revokePriv(internalSession, priv, user, host)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (e *RevokeExec) revokePriv(internalSession sessionctx.Context, priv *ast.PrivElem, user, host string) error {
|
|
switch e.Level.Level {
|
|
case ast.GrantLevelGlobal:
|
|
return e.revokeGlobalPriv(internalSession, priv, user, host)
|
|
case ast.GrantLevelDB:
|
|
return e.revokeDBPriv(internalSession, priv, user, host)
|
|
case ast.GrantLevelTable:
|
|
if len(priv.Cols) == 0 {
|
|
return e.revokeTablePriv(internalSession, priv, user, host)
|
|
}
|
|
return e.revokeColumnPriv(internalSession, priv, user, host)
|
|
}
|
|
return errors.Errorf("Unknown revoke level: %#v", e.Level)
|
|
}
|
|
|
|
func (e *RevokeExec) revokeGlobalPriv(internalSession sessionctx.Context, priv *ast.PrivElem, user, host string) error {
|
|
asgns, err := composeGlobalPrivUpdate(priv.Priv, "N")
|
|
if err != nil {
|
|
return err
|
|
}
|
|
sql := fmt.Sprintf(`UPDATE %s.%s SET %s WHERE User='%s' AND Host='%s'`, mysql.SystemDB, mysql.UserTable, asgns, user, host)
|
|
_, err = internalSession.(sqlexec.SQLExecutor).Execute(context.Background(), sql)
|
|
return err
|
|
}
|
|
|
|
func (e *RevokeExec) revokeDBPriv(internalSession sessionctx.Context, priv *ast.PrivElem, userName, host string) error {
|
|
dbName := e.Level.DBName
|
|
if len(dbName) == 0 {
|
|
dbName = e.ctx.GetSessionVars().CurrentDB
|
|
}
|
|
asgns, err := composeDBPrivUpdate(priv.Priv, "N")
|
|
if err != nil {
|
|
return err
|
|
}
|
|
sql := fmt.Sprintf(`UPDATE %s.%s SET %s WHERE User='%s' AND Host='%s' AND DB='%s';`, mysql.SystemDB, mysql.DBTable, asgns, userName, host, dbName)
|
|
_, err = internalSession.(sqlexec.SQLExecutor).Execute(context.Background(), sql)
|
|
return err
|
|
}
|
|
|
|
func (e *RevokeExec) revokeTablePriv(internalSession sessionctx.Context, priv *ast.PrivElem, user, host string) error {
|
|
dbName, tbl, err := getTargetSchemaAndTable(e.ctx, e.Level.DBName, e.Level.TableName, e.is)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
asgns, err := composeTablePrivUpdateForRevoke(internalSession, priv.Priv, user, host, dbName, tbl.Meta().Name.O)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
sql := fmt.Sprintf(`UPDATE %s.%s SET %s WHERE User='%s' AND Host='%s' AND DB='%s' AND Table_name='%s';`, mysql.SystemDB, mysql.TablePrivTable, asgns, user, host, dbName, tbl.Meta().Name.O)
|
|
_, err = internalSession.(sqlexec.SQLExecutor).Execute(context.Background(), sql)
|
|
return err
|
|
}
|
|
|
|
func (e *RevokeExec) revokeColumnPriv(internalSession sessionctx.Context, priv *ast.PrivElem, user, host string) error {
|
|
dbName, tbl, err := getTargetSchemaAndTable(e.ctx, e.Level.DBName, e.Level.TableName, e.is)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
for _, c := range priv.Cols {
|
|
col := table.FindCol(tbl.Cols(), c.Name.L)
|
|
if col == nil {
|
|
return errors.Errorf("Unknown column: %s", c)
|
|
}
|
|
asgns, err := composeColumnPrivUpdateForRevoke(internalSession, priv.Priv, user, host, dbName, tbl.Meta().Name.O, col.Name.O)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
sql := fmt.Sprintf(`UPDATE %s.%s SET %s WHERE User='%s' AND Host='%s' AND DB='%s' AND Table_name='%s' AND Column_name='%s';`, mysql.SystemDB, mysql.ColumnPrivTable, asgns, user, host, dbName, tbl.Meta().Name.O, col.Name.O)
|
|
_, err = internalSession.(sqlexec.SQLExecutor).Execute(context.Background(), sql)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|