Skip to content

Commit 85517f6

Browse files
author
Alexey Botchkov
committed
MDEV-33393 audit plugin do not report user did the action..
The '<replication_slave>' user is assigned to the slave replication thread so this name appears in the auditing logs.
1 parent b770633 commit 85517f6

File tree

9 files changed

+154
-8
lines changed

9 files changed

+154
-8
lines changed

‎mysql-test/suite/rpl/r/rpl_auditing.result

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
include/master-slave.inc
2+
[connection master]
3+
drop table if exists t1;
4+
connection slave;
5+
reset master;
6+
CREATE TABLE IF NOT EXISTS mysql.server_audit_filters (
7+
filtername char(80) COLLATE utf8_bin NOT NULL DEFAULT '',
8+
rule longtext CHARACTER SET utf8mb4 COLLATE utf8mb4_bin NOT NULL DEFAULT 'true' CHECK (json_valid(rule)),
9+
CONSTRAINT c_filtername UNIQUE (filtername)
10+
) ENGINE=Aria;
11+
CREATE TABLE IF NOT EXISTS mysql.server_audit_users (host char(60) COLLATE utf8_bin NOT NULL DEFAULT '',
12+
user char(80) COLLATE utf8_bin NOT NULL DEFAULT '',
13+
filtername char(80) NOT NULL DEFAULT '',
14+
CONSTRAINT c_host_user UNIQUE (host, user)
15+
) ENGINE=Aria;
16+
INSERT INTO mysql.server_audit_filters VALUES ('ignore_sys', '{"ignore_tables" : "mysql.*"}');
17+
INSERT INTO mysql.server_audit_users VALUES ('%','<replication_slave>','ignore_sys');
18+
INSERT INTO mysql.server_audit_users VALUES ('%','root','ignore_sys');
19+
install plugin server_audit soname 'server_audit2';
20+
set global server_audit_logging=on;
21+
connection master;
22+
create table t1 (a int);
23+
insert into t1 values (1);
24+
truncate t1;
25+
drop table t1;
26+
connection slave;
27+
set global server_audit_logging=off;
28+
truncate mysql.server_audit_filters;
29+
truncate mysql.server_audit_users;
30+
INSERT INTO mysql.server_audit_filters VALUES ('no_logging','false');
31+
INSERT INTO mysql.server_audit_users VALUES ('%','<replication_slave>','no_logging');
32+
set global server_audit_logging=on;
33+
connection master;
34+
create table t1 (a int);
35+
insert into t1 values (1);
36+
truncate t1;
37+
drop table t1;
38+
connection slave;
39+
set global server_audit_logging=off;
40+
uninstall plugin server_audit;
41+
Warnings:
42+
Warning 1620 Plugin is busy and will be uninstalled on shutdown
43+
truncate mysql.server_audit_filters;
44+
truncate mysql.server_audit_users;
45+
TIME,HOSTNAME,,,0,0,AUDIT_CONFIG,,file_path=server_audit.log,0
46+
TIME,HOSTNAME,,,0,0,AUDIT_CONFIG,,rotate_size=1000000,0
47+
TIME,HOSTNAME,,,0,0,AUDIT_CONFIG,,file_rotations=9,0
48+
TIME,HOSTNAME,root,localhost,ID,0,AUDIT_CONFIG,test,logging=ON,0
49+
TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'set global server_audit_logging=on',0
50+
TIME,HOSTNAME,<replication_slave>,,ID,ID,CREATE,test,t1,
51+
TIME,HOSTNAME,<replication_slave>,,ID,ID,WRITE,test,t1,
52+
TIME,HOSTNAME,<replication_slave>,,ID,ID,CREATE,test,t1,
53+
TIME,HOSTNAME,<replication_slave>,,ID,ID,DROP,test,t1,
54+
TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'select master_pos_wait(\'master-bin.#', POS, 300, \'\')',0
55+
TIME,HOSTNAME,root,localhost,ID,0,AUDIT_CONFIG,test,logging=OFF,0
56+
TIME,HOSTNAME,,,0,0,AUDIT_CONFIG,,file_path=server_audit.log,0
57+
TIME,HOSTNAME,,,0,0,AUDIT_CONFIG,,rotate_size=1000000,0
58+
TIME,HOSTNAME,,,0,0,AUDIT_CONFIG,,file_rotations=9,0
59+
TIME,HOSTNAME,root,localhost,ID,0,AUDIT_CONFIG,test,logging=ON,0
60+
TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'set global server_audit_logging=on',0
61+
TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'select master_pos_wait(\'master-bin.#', POS, 300, \'\')',0
62+
TIME,HOSTNAME,root,localhost,ID,0,AUDIT_CONFIG,test,logging=OFF,0
63+
connection master;
64+
include/rpl_end.inc

‎mysql-test/suite/rpl/t/rpl_auditing.test

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
if (!$SERVER_AUDIT2_SO) {
2+
skip No SERVER_AUDIT2 plugin;
3+
}
4+
5+
source include/master-slave.inc;
6+
7+
--disable_warnings
8+
drop table if exists t1;
9+
sync_slave_with_master;
10+
reset master;
11+
--enable_warnings
12+
13+
--disable_warnings
14+
CREATE TABLE IF NOT EXISTS mysql.server_audit_filters (
15+
filtername char(80) COLLATE utf8_bin NOT NULL DEFAULT '',
16+
rule longtext CHARACTER SET utf8mb4 COLLATE utf8mb4_bin NOT NULL DEFAULT 'true' CHECK (json_valid(rule)),
17+
CONSTRAINT c_filtername UNIQUE (filtername)
18+
) ENGINE=Aria;
19+
20+
CREATE TABLE IF NOT EXISTS mysql.server_audit_users (host char(60) COLLATE utf8_bin NOT NULL DEFAULT '',
21+
user char(80) COLLATE utf8_bin NOT NULL DEFAULT '',
22+
filtername char(80) NOT NULL DEFAULT '',
23+
CONSTRAINT c_host_user UNIQUE (host, user)
24+
) ENGINE=Aria;
25+
--enable_warnings
26+
27+
INSERT INTO mysql.server_audit_filters VALUES ('ignore_sys', '{"ignore_tables" : "mysql.*"}');
28+
INSERT INTO mysql.server_audit_users VALUES ('%','<replication_slave>','ignore_sys');
29+
INSERT INTO mysql.server_audit_users VALUES ('%','root','ignore_sys');
30+
31+
install plugin server_audit soname 'server_audit2';
32+
set global server_audit_logging=on;
33+
34+
# this is done to make test deterministic
35+
# so the above 'set' command is always logged before the 'create table t1'
36+
-- disable_query_log
37+
-- disable_result_log
38+
select * from mysql.server_audit_filters;
39+
select * from mysql.server_audit_users;
40+
-- enable_result_log
41+
-- enable_query_log
42+
43+
connection master;
44+
create table t1 (a int);
45+
insert into t1 values (1);
46+
truncate t1;
47+
drop table t1;
48+
sync_slave_with_master;
49+
50+
set global server_audit_logging=off;
51+
52+
truncate mysql.server_audit_filters;
53+
truncate mysql.server_audit_users;
54+
INSERT INTO mysql.server_audit_filters VALUES ('no_logging','false');
55+
INSERT INTO mysql.server_audit_users VALUES ('%','<replication_slave>','no_logging');
56+
57+
set global server_audit_logging=on;
58+
59+
connection master;
60+
create table t1 (a int);
61+
insert into t1 values (1);
62+
truncate t1;
63+
drop table t1;
64+
sync_slave_with_master;
65+
66+
set global server_audit_logging=off;
67+
uninstall plugin server_audit;
68+
truncate mysql.server_audit_filters;
69+
truncate mysql.server_audit_users;
70+
let $MYSQLD_DATADIR= `SELECT @@datadir`;
71+
# replace the timestamp and the hostname with constant values
72+
--replace_regex /[0-9]* [0-9][0-9]:[0-9][0-9]:[0-9][0-9]\,[^,]*\,/TIME,HOSTNAME,/ /\,[1-9][0-9]*\,/,1,/ /\,[1-9][0-9]*/,ID/ /000001\\', [0-9]*,/#', POS,/
73+
cat_file $MYSQLD_DATADIR/server_audit.log;
74+
remove_file $MYSQLD_DATADIR/server_audit.log;
75+
76+
connection master;
77+
--source include/rpl_end.inc

‎sql/mysqld.cc

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -297,7 +297,8 @@ static TYPELIB tc_heuristic_recover_typelib=
297297
};
298298

299299
const char *first_keyword= "first";
300-
const char *my_localhost= "localhost", *delayed_user= "DELAYED";
300+
const char *my_localhost= "localhost",
301+
*delayed_user= "delayed", *slave_user= "<replication_slave>";
301302

302303
bool opt_large_files= sizeof(my_off_t) > 4;
303304
static my_bool opt_autocommit; ///< for --autocommit command-line option

‎sql/mysqld.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -264,7 +264,7 @@ extern time_t server_start_time, flush_status_time;
264264
extern char *opt_mysql_tmpdir, mysql_charsets_dir[];
265265
extern size_t mysql_unpacked_real_data_home_len;
266266
extern MYSQL_PLUGIN_IMPORT MY_TMPDIR mysql_tmpdir_list;
267-
extern const char *first_keyword, *delayed_user;
267+
extern const char *first_keyword, *delayed_user, *slave_user;
268268
extern MYSQL_PLUGIN_IMPORT const char *my_localhost;
269269
extern MYSQL_PLUGIN_IMPORT const char **errmesg; /* Error messages */
270270
extern const char *myisam_recover_options_str;

‎sql/slave.cc

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3511,6 +3511,7 @@ static int init_slave_thread(THD* thd, Master_info *mi,
35113511
}
35123512

35133513
thd->security_ctx->skip_grants();
3514+
thd->security_ctx->user=(char*) slave_user;
35143515
thd->slave_thread= 1;
35153516
thd->connection_name= mi->connection_name;
35163517
thd->variables.sql_log_slow= !MY_TEST(thd->variables.log_slow_disabled_statements & LOG_SLOW_DISABLE_SLAVE);

‎sql/sql_acl.cc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7532,7 +7532,7 @@ static bool can_grant_role(THD *thd, ACL_ROLE *role)
75327532
{
75337533
Security_context *sctx= thd->security_ctx;
75347534

7535-
if (!sctx->user) // replication
7535+
if (!sctx->is_user_defined()) // galera
75367536
return true;
75377537

75387538
ACL_USER *grantee= find_user_exact(sctx->priv_host, sctx->priv_user);

‎sql/sql_class.cc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4504,7 +4504,7 @@ void Security_context::destroy()
45044504
my_free((char*) host);
45054505
host= NULL;
45064506
}
4507-
if (user != delayed_user)
4507+
if (is_user_defined())
45084508
{
45094509
my_free((char*) user);
45104510
user= NULL;

‎sql/sql_class.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1506,6 +1506,8 @@ class Security_context {
15061506
*/
15071507
bool check_access(const privilege_t want_access, bool match_any = false);
15081508
bool is_priv_user(const char *user, const char *host);
1509+
bool is_user_defined() const
1510+
{ return user && user != delayed_user && user != slave_user; };
15091511
};
15101512

15111513

‎sql/sql_show.cc

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2776,9 +2776,10 @@ static my_bool list_callback(THD *tmp, list_callback_arg *arg)
27762776

27772777
thd_info->thread_id=tmp->thread_id;
27782778
thd_info->os_thread_id=tmp->os_thread_id;
2779-
thd_info->user= arg->thd->strdup(tmp_sctx->user ? tmp_sctx->user :
2780-
(tmp->system_thread ?
2781-
"system user" : "unauthenticated user"));
2779+
thd_info->user= arg->thd->strdup(tmp_sctx->user && tmp_sctx->user != slave_user ?
2780+
tmp_sctx->user :
2781+
(tmp->system_thread ?
2782+
"system user" : "unauthenticated user"));
27822783
if (tmp->peer_port && (tmp_sctx->host || tmp_sctx->ip) &&
27832784
arg->thd->security_ctx->host_or_ip[0])
27842785
{
@@ -3225,7 +3226,7 @@ static my_bool processlist_callback(THD *tmp, processlist_callback_arg *arg)
32253226
/* ID */
32263227
arg->table->field[0]->store((longlong) tmp->thread_id, TRUE);
32273228
/* USER */
3228-
val= tmp_sctx->user ? tmp_sctx->user :
3229+
val= tmp_sctx->user && tmp_sctx->user != slave_user ? tmp_sctx->user :
32293230
(tmp->system_thread ? "system user" : "unauthenticated user");
32303231
arg->table->field[1]->store(val, strlen(val), cs);
32313232
/* HOST */

0 commit comments

Comments
 (0)