pingcap / tidb

TiDB - the open-source, cloud-native, distributed SQL database designed for modern applications.
https://pingcap.com
Apache License 2.0
37.26k stars 5.84k forks source link

Some admin command can be executed without super privilege #51366

Open okJiang opened 8 months ago

okJiang commented 8 months ago

Bug Report

Please answer these questions before submitting your issue. Thanks!

1. Minimal reproduce step (Required)

mysql -utest -h127.0.0.1 -P4000 -p
Enter password:
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 1350565896
Server version: 8.0.11-TiDB-v8.0.0-alpha-253-gd96244d34b TiDB Server (Apache License 2.0) Community Edition, MySQL 8.0 compatible

Copyright (c) 2000, 2021, Oracle and/or its affiliates.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> admin reload expr_pushdown_blacklist;
Query OK, 0 rows affected (0.00 sec)

mysql> admin plugins enable p;
ERROR 1105 (HY000): plugin 'p' not found
-- plugin should exist similar bug

mysql> ADMIN FLUSH bindings;
Query OK, 0 rows affected (0.00 sec)

mysql> ADMIN CAPTURE bindings;
Query OK, 0 rows affected (0.01 sec)

mysql> ADMIN RELOAD bindings;
Query OK, 0 rows affected (0.00 sec)

mysql> show plugins;
Empty set (0.00 sec)

mysql> SHOW GRANTS FOR 'test'@'%';
+----------------------------------+
| Grants for test@%                |
+----------------------------------+
| GRANT USAGE ON *.* TO 'test'@'%' |
+----------------------------------+
1 row in set (0.00 sec)

2. What did you expect to see? (Required)

Error 8121 (HY000): privilege check for 'Super' fail

3. What did you see instead (Required)

Executed successfully

4. What is your TiDB version? (Required)

master

lcwangchao commented 7 months ago

reopen this issue because we have revert the fix PR in #51938 for some problems