关于MySQL绕过授予information_schema中对象时报ERROR 1044 4200 错误

　 短视频，自媒体，达人种草一站处事

这篇文章首要先容了关于MySQL绕过授予information_schema中工具时报ERROR 1044（4200）错误,本文给各人分享办理要领，对各人的进修或事变具有必然的参考小心代价，必要的伴侣可以参考下

这个题目是微信群中网友关于MySQL权限的接头，有这么一个营业需求（下面是他的原话）：

由于MySQL的许多成果都依靠主键，我想用zabbix用户，来监控营业数据库的全部表，是否都成立了主键。

监控的语句是：

FROM  information_schema.tables t1
    LEFT OUTER JOIN information_schema.table_constraints t2
          ON t1.table_schema = t2.table_schema
            AND t1.table_name = t2.table_name
            AND t2.constraint_name IN ( 'PRIMARY' )
WHERE t2.table_name IS NULL
    AND t1.table_schema NOT IN ( 'information_schema', 'myawr', 'mysql',
                  'performance_schema',
                  'slowlog', 'sys', 'test' )
    AND t1.table_type = 'BASE TABLE'

可是我不但愿zabbix用户，能读取营业库的数据。一旦不给zabbix用户读取营业库数据的权限，那么information_schema.TABLES 和 information_schema.TABLE_CONSTRAINTS 就不包括营业库的表信息了，也就统计不出来营业库的表是否有建主键。有没有什么步伐，即让zabbix不能读取营业库数据，又能监控是否营业库的表没有成立主键？

起首，我们要知道一个究竟：information_schema下的视图没法授权给某个用户。如下所示

mysql> GRANT SELECT ON information_schema.TABLES TO test@'%';
ERROR 1044 (42000): Access denied for user 'root'@'localhost' to database 'information_schema'

关于这个题目，可以参考mos上这篇文章：Why Setting Privileges on INFORMATION_SCHEMA does not Work (文档 ID 1941558.1)

APPLIES TO:

MySQL Server - Version 5.6 and later

Information in this document applies to any platform.

GOAL

To determine how MySQL privileges work for INFORMATION_SCHEMA.

SOLUTION

A simple GRANT statement would be something like:

mysql> grant select,execute on information_schema.* to 'dbadm'@'localhost';

ERROR 1044 (42000): Access denied for user 'root'@'localhost' to database 'information_schema'

The error indicates that the super user does not have the privileges to change the information_schema access privileges.

Which seems to go against what is normally the case for the root account which has SUPER privileges.

The reason for this error is that the information_schema database is actually a virtual database that is built when the service is started.

It is made up of tables and views designed to keep track of the server meta-data, that is, details of all the tables, procedures etc. in the database server.

So looking specifically at the above command, there is an attempt to add SELECT and EXECUTE privileges to this specialised database.

The SELECT option is not required however, because all users have the ability to read the tables in the information_schema database, so this is redundant.

The EXECUTE option does not make sense, because you are not allowed to create procedures in this special database.

There is also no capability to modify the tables in terms of INSERT, UPDATE, DELETE etc., so privileges are hard coded instead of managed per user.

那么怎么办理这个授权题目呢？ 直接授权不可，那么我们只能绕过这个题目，间接实现授权。思绪如下：起首建设一个存储进程（用户数据库），此存储进程找出没有主键的表的数目，然后将其授予test用户。

DELIMITER //
CREATEDEFINER=`root`@`localhost` PROCEDURE `moitor_without_primarykey`()

BEGIN
   SELECT COUNT(*)
FROM  information_schema.tables t1
    LEFT OUTER JOIN information_schema.table_constraints t2
          ON t1.table_schema = t2.table_schema
            AND t1.table_name = t2.table_name
            AND t2.constraint_name IN ( 'PRIMARY' )
WHERE t2.table_name IS NULL
    AND t1.table_schema NOT IN ( 'information_schema', 'myawr', 'mysql',
                  'performance_schema',
                  'slowlog', 'sys', 'test' )
    AND t1.table_type = 'BASE TABLE';
END //
DELIMITER ;
 mysql> GRANT EXECUTE ON PROCEDURE moitor_without_primarykey TO

'test'@'%';

Query OK, 0 rows affected (0.02 sec)

此时test就能间接的去查询information_schema下的工具了。

mysql> select current_user();
+----------------+
| current_user() |
+----------------+
|test@%|

（编辑：湖南网）

【声明】本站内容均来自网络，其相关言论仅代表作者个人观点，不代表本站立场。若无意侵犯到您的权利，请及时与联系站长删除相关内容!