Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cleanup usage of FLUSH PRIVILEGES #15700

Merged
merged 1 commit into from
Apr 16, 2024
Merged

Cleanup usage of FLUSH PRIVILEGES #15700

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 3 additions & 13 deletions config/init_db.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,30 +1,22 @@
# This file is executed immediately after initializing a fresh data directory.

###############################################################################
# WARNING: This sql is *NOT* safe for production use,
# as it contains default well-known users and passwords.
# Care should be taken to change these users and passwords
# for production.
###############################################################################

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we want to keep this warning? We no longer have static secrets in this file anymore, which is a really good thing so the current warning is no longer accurate.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we can/should remove it.

###############################################################################
# Equivalent of mysql_secure_installation
###############################################################################
# We need to ensure that super_read_only is disabled so that we can execute
# these commands. Note that disabling it does NOT disable read_only.
# We save the current value so that we only re-enable it at the end if it was
# enabled before.

SET @original_super_read_only=IF(@@global.super_read_only=1, 'ON', 'OFF');
SET GLOBAL super_read_only='OFF';

# Changes during the init db should not make it to the binlog.
# They could potentially create errant transactions on replicas.
SET sql_log_bin = 0;
# Remove anonymous users.
DELETE FROM mysql.user WHERE User = '';

# Disable remote root access (only allow UNIX socket).
DELETE FROM mysql.user WHERE User = 'root' AND Host != 'localhost';
# Remove anonymous users & disable remote root access (only allow UNIX socket).
DROP USER IF EXISTS ''@'%', ''@'localhost', 'root'@'%';
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Technically this statement is not equivalent to the original one, because it will not remove e.g. 'root'@'10.0.0.1', but fine.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@shlomi-noach yeah, I don’t think they normally would exist by default right?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's right. I think it's good to merge.


# Remove test database.
DROP DATABASE IF EXISTS test;
Expand Down Expand Up @@ -78,8 +70,6 @@ GRANT SELECT, PROCESS, SUPER, REPLICATION CLIENT, RELOAD
GRANT SELECT, UPDATE, DELETE, DROP
ON performance_schema.* TO 'vt_monitoring'@'localhost';

FLUSH PRIVILEGES;

RESET SLAVE ALL;
RESET MASTER;

Expand Down
8 changes: 3 additions & 5 deletions examples/compose/config/init_db.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,10 +12,8 @@ SET GLOBAL super_read_only='OFF';
# Changes during the init db should not make it to the binlog.
# They could potentially create errant transactions on replicas.
SET sql_log_bin = 0;
# Remove anonymous users.
DELETE FROM mysql.user WHERE User = '';
# Disable remote root access (only allow UNIX socket).
DELETE FROM mysql.user WHERE User = 'root' AND Host != 'localhost';
# Remove anonymous users & disable remote root access (only allow UNIX socket).
DROP USER IF EXISTS ''@'%', ''@'localhost', 'root'@'%';
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same. Not a concern as these are examples.

# Remove test database.
DROP DATABASE IF EXISTS test;
###############################################################################
Expand Down Expand Up @@ -70,7 +68,7 @@ GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, RELOAD, PROCESS, FILE,
LOCK TABLES, EXECUTE, REPLICATION SLAVE, REPLICATION CLIENT, CREATE VIEW,
SHOW VIEW, CREATE ROUTINE, ALTER ROUTINE, CREATE USER, EVENT, TRIGGER
ON *.* TO 'vt_filtered'@'localhost';
FLUSH PRIVILEGES;

RESET SLAVE ALL;
RESET MASTER;

Expand Down
4 changes: 2 additions & 2 deletions examples/compose/external_db/mysql/grant.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,5 +3,5 @@ echo '**********GRANTING PRIVILEGES START*******************'
echo ${mysql[@]}
# PURGE BINARY LOGS BEFORE DATE(NOW());
mysql --protocol=socket -uroot -hlocalhost --socket=/var/run/mysqld/mysqld.sock -p$MYSQL_ROOT_PASSWORD -e \
"GRANT ALL PRIVILEGES ON *.* TO '$MYSQL_USER'@'%' IDENTIFIED BY '$MYSQL_PASSWORD'; FLUSH PRIVILEGES;"
echo '*************GRANTING PRIVILEGES END****************'
"GRANT ALL PRIVILEGES ON *.* TO '$MYSQL_USER'@'%' IDENTIFIED BY '$MYSQL_PASSWORD'"
echo '*************GRANTING PRIVILEGES END****************'
2 changes: 1 addition & 1 deletion examples/compose/vttablet-up.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,7 @@ if [ "$external" = "1" ]; then
# We need a common user for the unmanaged and managed tablets else tools like orchestrator will not function correctly
echo "Creating matching user for managed tablets..."
echo "CREATE USER IF NOT EXISTS '$DB_USER'@'%' IDENTIFIED BY '$DB_PASS';" >> $init_db_sql_file
echo "GRANT ALL ON *.* TO '$DB_USER'@'%';FLUSH PRIVILEGES;" >> $init_db_sql_file
echo "GRANT ALL ON *.* TO '$DB_USER'@'%';" >> $init_db_sql_file
fi
echo "##[CUSTOM_SQL_END]##" >> $init_db_sql_file

Expand Down
9 changes: 2 additions & 7 deletions examples/operator/101_initial_cluster.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -145,11 +145,8 @@ stringData:
# Changes during the init db should not make it to the binlog.
# They could potentially create errant transactions on replicas.
SET sql_log_bin = 0;
# Remove anonymous users.
DELETE FROM mysql.user WHERE User = '';

# Disable remote root access (only allow UNIX socket).
DELETE FROM mysql.user WHERE User = 'root' AND Host != 'localhost';
# Remove anonymous users & disable remote root access (only allow UNIX socket).
DROP USER IF EXISTS ''@'%', ''@'localhost', 'root'@'%';

# Remove test database.
DROP DATABASE IF EXISTS test;
Expand Down Expand Up @@ -215,8 +212,6 @@ stringData:
SHOW VIEW, CREATE ROUTINE, ALTER ROUTINE, CREATE USER, EVENT, TRIGGER
ON *.* TO 'vt_filtered'@'localhost';

FLUSH PRIVILEGES;

RESET SLAVE ALL;
RESET MASTER;

Expand Down
1 change: 0 additions & 1 deletion go/test/endtoend/cluster/cluster_util.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -351,7 +351,6 @@ func GetPasswordUpdateSQL(localCluster *LocalProcessCluster) string {
SET PASSWORD FOR 'vt_repl'@'%' = 'VtReplPass';
SET PASSWORD FOR 'vt_filtered'@'localhost' = 'VtFilteredPass';
SET PASSWORD FOR 'vt_appdebug'@'localhost' = 'VtDebugPass';
FLUSH PRIVILEGES;
`
return pwdChangeCmd
}
Expand Down
9 changes: 2 additions & 7 deletions go/test/endtoend/vreplication/testdata/config/init_testserver_db.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,11 +24,8 @@ SET GLOBAL read_only='OFF';
# Changes during the init db should not make it to the binlog.
# They could potentially create errant transactions on replicas.
SET sql_log_bin = 0;
# Remove anonymous users.
DELETE FROM mysql.user WHERE User = '';

# Disable remote root access (only allow UNIX socket).
DELETE FROM mysql.user WHERE User = 'root' AND Host != 'localhost';
# Remove anonymous users & disable remote root access (only allow UNIX socket).
DROP USER IF EXISTS ''@'%', ''@'localhost', 'root'@'%';

# Remove test database.
DROP DATABASE IF EXISTS test;
Expand Down Expand Up @@ -82,8 +79,6 @@ GRANT SELECT, PROCESS, SUPER, REPLICATION CLIENT, RELOAD
GRANT SELECT, UPDATE, DELETE, DROP
ON performance_schema.* TO 'vt_monitoring'@'localhost';

FLUSH PRIVILEGES;

RESET SLAVE ALL;
RESET MASTER;

Expand Down
2 changes: 0 additions & 2 deletions go/vt/vttablet/tabletmanager/tm_init_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -926,7 +926,5 @@ func grantAllPrivilegesToUser(t *testing.T, connParams mysql.ConnParams, testUse
require.NoError(t, err)
_, err = conn.ExecuteFetch(fmt.Sprintf(`GRANT GRANT OPTION ON *.* TO '%v'@'localhost'`, testUser), 1000, false)
require.NoError(t, err)
_, err = conn.ExecuteFetch("FLUSH PRIVILEGES", 1000, false)
require.NoError(t, err)
conn.Close()
}
8 changes: 3 additions & 5 deletions vitess-mixin/e2e/config/init_db.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,10 +12,8 @@ SET GLOBAL super_read_only='OFF';
# Changes during the init db should not make it to the binlog.
# They could potentially create errant transactions on replicas.
SET sql_log_bin = 0;
# Remove anonymous users.
DELETE FROM mysql.user WHERE User = '';
# Disable remote root access (only allow UNIX socket).
DELETE FROM mysql.user WHERE User = 'root' AND Host != 'localhost';
# Remove anonymous users & disable remote root access (only allow UNIX socket).
DROP USER IF EXISTS ''@'%', ''@'localhost', 'root'@'%';
# Remove test database.
DROP DATABASE IF EXISTS test;
###############################################################################
Expand Down Expand Up @@ -71,7 +69,7 @@ GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, RELOAD, PROCESS, FILE,
LOCK TABLES, EXECUTE, REPLICATION SLAVE, REPLICATION CLIENT, CREATE VIEW,
SHOW VIEW, CREATE ROUTINE, ALTER ROUTINE, CREATE USER, EVENT, TRIGGER
ON *.* TO 'vt_filtered'@'localhost';
FLUSH PRIVILEGES;

RESET SLAVE ALL;
RESET MASTER;
# custom sql is used to add custom scripts like creating users/passwords. We use it in our tests
Expand Down
4 changes: 2 additions & 2 deletions vitess-mixin/e2e/external_db/mysql/grant.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,5 +3,5 @@ echo '**********GRANTING PRIVILEGES START*******************'
echo ${mysql[@]}
# PURGE BINARY LOGS BEFORE DATE(NOW());
mysql --protocol=socket -uroot -hlocalhost --socket=/var/run/mysqld/mysqld.sock -p$MYSQL_ROOT_PASSWORD -e \
"GRANT ALL PRIVILEGES ON *.* TO '$MYSQL_USER'@'%' IDENTIFIED BY '$MYSQL_PASSWORD'; FLUSH PRIVILEGES;"
echo '*************GRANTING PRIVILEGES END****************'
"GRANT ALL PRIVILEGES ON *.* TO '$MYSQL_USER'@'%' IDENTIFIED BY '$MYSQL_PASSWORD'"
echo '*************GRANTING PRIVILEGES END****************'
2 changes: 1 addition & 1 deletion vitess-mixin/e2e/vttablet-up.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,7 @@ if [ "$external" = "1" ]; then
# We need a common user for the unmanaged and managed tablets else tools like orchestrator will not function correctly
echo "Creating matching user for managed tablets..."
echo "CREATE USER IF NOT EXISTS '$DB_USER'@'%' IDENTIFIED BY '$DB_PASS';" >> $init_db_sql_file
echo "GRANT ALL ON *.* TO '$DB_USER'@'%';FLUSH PRIVILEGES;" >> $init_db_sql_file
echo "GRANT ALL ON *.* TO '$DB_USER'@'%';" >> $init_db_sql_file
fi
echo "##[CUSTOM_SQL_END]##" >> $init_db_sql_file

Expand Down
Loading