util/sem: add tidb_audit_redact_log to invisible sysvars

[morgo]

What problem does this PR solve?

Issue Number: close #33711

Problem Summary:

When SEM is enabled, it shouldn't be possible to change the audit log redaction setting. This prevents an administrator from covering their tracks. In TiDB cloud, we will only support without redaction (full statements).

What is changed and how it works?

See above.

Check List

Tests

• Unit test
• Integration test
• Manual test (add detailed scripts or steps below)

Start a TiDB server without SEM and the audit plugin. Set redaction to OFF (default is on):

tidb> show variables like 'tidb_audit%';
+-------------------------+----------+
| Variable_name           | Value    |
+-------------------------+----------+
| tidb_audit_log_max_size | 52428800 |
| tidb_audit_redact_log   | ON       |
+-------------------------+----------+
2 rows in set (0.00 sec)

tidb> set global tidb_audit_redact_log = off;
Query OK, 0 rows affected (0.00 sec)

Enable SEM. Start TiDB Again:

tidb> show variables like 'tidb_audit%';
+-------------------------+----------+
| Variable_name           | Value    |
+-------------------------+----------+
| tidb_audit_log_max_size | 52428800 |
+-------------------------+----------+
1 row in set (0.00 sec)

tidb> set global tidb_audit_redact_log = off;
ERROR 1227 (42000): Access denied; you need (at least one of) the RESTRICTED_VARIABLES_ADMIN privilege(s) for this operation

Confirm that the log is written unredacted:

[2022/04/05 18:53:34.909 -06:00] [INFO] [logger.go:76] [ID=16492064140] [TIMESTAMP=2022/04/05 18:53:34.909 -06:00] [EVENT_CLASS=GENERAL] [EVENT_SUBCLASS=] [STATUS_CODE=0] [COST_TIME=0] [HOST=127.0.0.1] [CLIENT_IP=127.0.0.1] [USER=root] [DATABASES="[]"] [TABLES="[]"] [SQL_TEXT=] [ROWS=0] [CONNECTION_ID=403] [CLIENT_PORT=42146] [PID=2699953] [COMMAND=Query] [SQL_STATEMENTS=]
[2022/04/05 18:53:34.910 -06:00] [INFO] [logger.go:76] [ID=16492064141] [TIMESTAMP=2022/04/05 18:53:34.910 -06:00] [EVENT_CLASS=GENERAL] [EVENT_SUBCLASS=] [STATUS_CODE=0] [COST_TIME=0] [HOST=127.0.0.1] [CLIENT_IP=127.0.0.1] [USER=root] [DATABASES="[]"] [TABLES="[]"] [SQL_TEXT="show variables like 'tidb_audit%'"] [ROWS=0] [CONNECTION_ID=403] [CLIENT_PORT=42146] [PID=2699953] [COMMAND=Query] [SQL_STATEMENTS=Show]
[2022/04/05 18:53:36.521 -06:00] [INFO] [logger.go:76] [ID=16492064160] [TIMESTAMP=2022/04/05 18:53:36.521 -06:00] [EVENT_CLASS=GENERAL] [EVENT_SUBCLASS=] [STATUS_CODE=0] [COST_TIME=0] [HOST=127.0.0.1] [CLIENT_IP=127.0.0.1] [USER=root] [DATABASES="[]"] [TABLES="[]"] [SQL_TEXT="show variables like 'tidb_audit%'"] [ROWS=0] [CONNECTION_ID=403] [CLIENT_PORT=42146] [PID=2699953] [COMMAND=Query] [SQL_STATEMENTS=Show]

• No code

Side effects

• Performance regression: Consumes more CPU
• Performance regression: Consumes more Memory
• Breaking backward compatibility

Documentation

• Affects user behaviors
• Contains syntax changes
• Contains variable changes
• Contains experimental features
• Changes MySQL compatibility

Release note

When Security Enhanced Mode (SEM) is enabled, TiDB no longer permits changes to the tidb_audit_redact_log system variable.

[ti-chi-bot]

[REVIEW NOTIFICATION]

This pull request has been approved by:

• bb7133
• zimulala

To complete the pull request process, please ask the reviewers in the list to review by filling /cc @reviewer in the comment.
After your PR has acquired the required number of LGTMs, you can assign this pull request to the committer in the list by filling /assign @committer in the comment to help you merge this pull request.

The full list of commands accepted by this bot can be found here.

Reviewer can indicate their review by submitting an approval review.
Reviewer can cancel approval by submitting a request changes review.

[sre-bot]

Code Coverage Details: https://codecov.io/github/pingcap/tidb/commit/33812ea857feaaa6b67db5cbd31963abdfbabb4f

[zimulala]

LGTM

[bb7133]

LGTM

[bb7133]

/merge

[ti-chi-bot]

This pull request has been accepted and is ready to merge.

Commit hash: 4e8fc11

[sre-bot]

TiDB MergeCI notify

✅ Well Done! New fixed [2] after this pr merged.

CI Name	Result	Duration	Compare with Parent commit
idc-jenkins-ci-tidb/code-coverage	✅ Lines coverage: 63.47%	13 min	Fixed
idc-jenkins-ci-tidb/common-test	✅ all 12 tests passed	6 min 11 sec	Fixed
idc-jenkins-ci-tidb/integration-br-test	🟢 all 29 tests passed	46 min	Existing passed
idc-jenkins-ci/integration-cdc-test	🟢 all 34 tests passed	38 min	Existing passed
idc-jenkins-ci-tidb/integration-common-test	🟢 all 11 tests passed	10 min	Existing passed
idc-jenkins-ci-tidb/tics-test	🟢 all 1 tests passed	7 min 9 sec	Existing passed
idc-jenkins-ci-tidb/integration-ddl-test	🟢 all 6 tests passed	6 min 59 sec	Existing passed
idc-jenkins-ci-tidb/sqllogic-test-2	🟢 all 28 tests passed	6 min 9 sec	Existing passed
idc-jenkins-ci-tidb/sqllogic-test-1	🟢 all 26 tests passed	5 min 50 sec	Existing passed
idc-jenkins-ci-tidb/integration-copr-test	🟢 all 1 tests passed	5 min 40 sec	Existing passed
idc-jenkins-ci-tidb/integration-compatibility-test	🟢 all 1 tests passed	4 min 44 sec	Existing passed
idc-jenkins-ci-tidb/mybatis-test	🟢 all 1 tests passed	3 min 56 sec	Existing passed
idc-jenkins-ci-tidb/plugin-test	🟢 build success, plugin test success	4min	Existing passed