Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

executor,infoschema: check privilege for 'show processlist' #7858

Merged
merged 4 commits into from Oct 10, 2018

Conversation

Projects
None yet
4 participants
@tiancaiamao
Copy link
Contributor

tiancaiamao commented Oct 10, 2018

What problem does this PR solve?

"show processlist" requires the PROCESS privilege.
Otherwise, the user can see only his own threads.

What is changed and how it works?

Add check for PROCESS privilege.

Check List

Tests

  • Manual test (add detailed scripts or steps below)

As the util.SessionManager is mocked, its ShowProcessList can't work.
I test manually to check the changes in this PR works.

mysql -h 127.0.0.1 -u root -P 4000
create user noprivs;

// open another terminal
mysql  -h 127.0.0.1 -u noprivs -P 4000
mysql> show processlist;                                                                                                                                                                      +------+---------+-----------+------+---------+------+-------+------------------+------+
| Id   | User    | Host      | db   | Command | Time | State | Info             | Mem  |
+------+---------+-----------+------+---------+------+-------+------------------+------+
|    6 | noprivs | 127.0.0.1 |      | Query   |    0 | 2     | show processlist |    0 |
+------+---------+-----------+------+---------+------+-------+------------------+------+
1 row in set (0.01 sec)

// back to previous terminal
mysql> show processlist;
+------+---------+-----------+------+---------+------+-------+------------------+------+
| Id   | User    | Host      | db   | Command | Time | State | Info             | Mem  |
+------+---------+-----------+------+---------+------+-------+------------------+------+
|    5 | root    | 127.0.0.1 |      | Query   |    0 | 2     | show processlist |    0 |
|    6 | noprivs | 127.0.0.1 |      | Sleep   |   27 | 2     |                  |    0 |
+------+---------+-----------+------+---------+------+-------+------------------+------+
2 rows in set (0.00 sec)

@jackysp @lysu

tiancaiamao added some commits Oct 10, 2018

executor: check privilege for 'show processlist'
"show processlist" requires the PROCESS privilege.
Otherwise, the user can see only his own threads.
@imtbkcat

This comment has been minimized.

Copy link
Contributor

imtbkcat commented Oct 10, 2018

/run-all-tests

@eurekaka
Copy link
Contributor

eurekaka left a comment

LGTM

@eurekaka

This comment has been minimized.

Copy link
Contributor

eurekaka commented Oct 10, 2018

/run-all-tests

@imtbkcat
Copy link
Contributor

imtbkcat left a comment

LGTM

@shenli shenli merged commit 38f2fe0 into pingcap:master Oct 10, 2018

11 checks passed

ci/circleci Your tests passed on CircleCI!
Details
continuous-integration/travis-ci/pr The Travis CI build passed
Details
jenkins-ci-tidb/build Jenkins job succeeded.
Details
jenkins-ci-tidb/common-test Jenkins job succeeded.
Details
jenkins-ci-tidb/integration-common-test Jenkins job succeeded.
Details
jenkins-ci-tidb/integration-compatibility-test Jenkins job succeeded.
Details
jenkins-ci-tidb/integration-ddl-test Jenkins job succeeded.
Details
jenkins-ci-tidb/mybatis-test Jenkins job succeeded.
Details
jenkins-ci-tidb/sqllogic-test Jenkins job succeeded.
Details
jenkins-ci-tidb/unit-test Jenkins job succeeded.
Details
license/cla Contributor License Agreement is signed.
Details

dbjoa added a commit to cloud-pi/tidb that referenced this pull request Oct 11, 2018

executor,infoschema: check privilege for 'show processlist' (pingcap#…
…7858)

"show processlist" requires the PROCESS privilege.
Otherwise, the user can see only his own threads.

@tiancaiamao tiancaiamao deleted the tiancaiamao:processlist-priv branch Oct 11, 2018

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.