Step 0 How to begin and what you need to do before you start?

Size: px

Start display at page:

Download "Step 0 How to begin and what you need to do before you start?"

Britney Dixon
5 years ago
Views:

1 Written and cooked by Janusz R. Getta, School of Computing and Information Technology, University of Wollongong Building 3, room 2120, ext 4339, jrg ËÁÌ½½ Ø Å Ò Ñ ÒØ Ò Ë ÙÖ ØÝ Ê Ô º¾ ÀÓÛ ØÓ Ñ Ò ÓÑÔÐ Ü ÔÖ Ú Ð Table of contents Step 0 How to begin and what you need to do before you start? Step 1 How to grant column privileges? Step 2 How to grant privileges on the fragments of relational tables? Step 3 How to grant global privileges with GRANT OPTION? Step 4 How to retrieve privileges as a database administrator? Step 0 How to begin and what you need to do before you start? A printable copy of this experiment in pdf format is available here ( e9-2.pdf). Logon to your Win 7 system and start VirtualBox. Next, either import your appliance from your USB drive and start imported virtual machine or use one of the brand new virtual machines available on your Win 7 system. Logon to Ubuntu operating system as csit115 user. Start Terminal icon to open Terminal application. We use command line interface to communicate with mysql database server. Next, create a new folder to save SQL scripts used in the present experiment and make the folder as the current folder of csit115 user. Download and uncompress SQL scripts in zip format ( used in this experiment. The scripts should be uncompressed into the folder created earlier. Connect as user csit115 and execute USE csit115; to make a database csit115 a default database for SQL statements issued by the user. While connected as a user csit115 execute a script dbcreate9-2.sql ( dbcreate9-2.sql) to create a sample database. A script dbdrop9-2.sql ( can be used to drop the database. Do not drop the database now. Connect as a user root and create a new user harryp in the following way. CREATE USER harryp IDENTIFIED BY csit115 ; Step 1 How to grant column privileges? Connect as a user csit115. We would like to grant read privileges on the selected columns from a relational table. 1

2 To grant a read privilege on the columns DNAME and CHAIRMAN execute the following statement while connected as a user csit115. GRANT SELECT (DNAME, CHAIRMAN) ON csit115.department TO harryp; To verify the outcomes connect as a user harryp and make a database csit115 a default database for SQL statements. USE csit115; Next, try to retrive all columns from a relational table DEPARTMENT. SELECT * FROM DEPARTMENT; As we may expect the system does not allow a user harryp to access a column BUDGET and it rejects SELECT statement with the following message. ERROR 1142 (42000): SELECT command denied to user localhost for table DEPARTMENT ; Next, try to access only the columns on which read access rights have been granted to harryp. SELECT DNAME, CHAIRMAN FROM DEPARTMENT; DNAME CHAIRMAN OPERATIONS C.J. DATE IT E.F. CODD TRANSPORT G. SPEED ACCOUNTING J.R. SMITH RESEARCH P.J. BLACK SALES W.W. SALESMAN rows in set (0.01 sec) It is possible to grant UPDATE and INSERT operations on selected columns in a relational table. While connected as a user csit115 execute the following statement to grant to a user harryp insertions on the columns DNAME and CHAIRMAN. GRANT INSERT (DNAME, CHAIRMAN) ON csit115.department TO harryp; Next, while connected as a user harryp try to insert a new row to DEPARTMENT table in the following way. INSERT INTO DEPARTMENT VALUES( SPORT, 100.0, Robin Hood ); Of course a user harryp has no rights to insert the values into a column BUDGET and because of that insertion fails. 2

3 To correctly insert the values into DEPARTMENT we use INSERT statement with specification of a schema and we do not provide a value for BUDGET column. It is still all right because BUDGET can be NULL. While connected as a user harryp execute the following statement. INSERT INTO DEPARTMENT (DNAME, CHAIRMAN) VALUES( SPORT, Robin Hood ); To check if the row has been inserted and what has happened to a value of column BUDGET execute the following statement while connected as a user csit115. SELECT * FROM DEPARTMENT; The results are consistent with the expectations DNAME BUDGET CHAIRMAN ACCOUNTING 200 J.R. SMITH IT 500 E.F. CODD OPERATIONS NULL C.J. DATE RESEARCH 300 P.J. BLACK SALES 400 W.W. SALESMAN SPORT NULL Robin Hood TRANSPORT 200 G. SPEED rows in set (0.00 sec) Step 2 How to grant privileges on the fragments of relational tables? It is possible to grant the privileges on the individual columns in a bit different way from the one we used in the previous recipe. A new method can be even used to grant the privileges on the entrire horizontal and/or vertical fragments of the relatinal tables. It is possible to create a relational view and grant the privileges on the view. While connected as a user csit115 create a relational view in the following way. CREATE VIEW EMPVIEW(ENUM, ENAME, MANAGER) AS (SELECT ENUM, ENAME, MANAGER FROM EMPLOYEE); Then, grant a read privilege on the columns included in the view. GRANT SELECT ON csit115.empview TO harryp; Now, while connected as harryp try read the contents of the columns granted by a user csit115. First, try to access the columns directly through a relational table EMPLOYEE. SELECT ENUM, ENAME, MANAGER FROM EMPLOYEE; Quite obvioulsy such attmpt fails because a user harryp has no rights to access the columns in a relational table EMPLOYEE We may argue that if an access to the columns is granted through the columns of a view then it allows to access the same information as an access through the columns of a relational table. In a general case such such 3

4 reasoning for complex relational views can be too time consuming to be done by a database server. Therefore, we can access only data objects such that the privileges on such objects have been directly granted to us. While connected as a user harryp access the same columns as before through a relational view. SELECT ENUM, ENAME, MANAGER FROM EMPVIEW; Now, the results are consistent with our expectations ENUM ENAME MANAGER BONAPARTE D ARC SMITH ALLEN ALLEN ALLEN WARD JONES MARTIN BLAKE CLARK SCOTT HILL LAUDA BERGER KING NULL 7844 TURNER ADAMS JAMES FORD rows in set (0.00 sec); In the next step we show that the same technique can be applied to grant the access right on horizontal, and in a general case on horizontal and/or vertical fragments of relational tables. While connected as a user csit115 create the following view. CREATE VIEW ALLENVIEW AS (SELECT * FROM EMPLOYEE WHERE ENAME = ALLEN ); Next, grant a read privilege on the view to a user harryp. GRANT SELECT ON csit115.allenview TO harryp; After a read privilege on the view has been granted try to access the view as a user harryp. SELECT * 4

5 FROM ALLENVIEW; The results are the following ENUM ENAME MANAGER HIREDATE SALARY COMM DNAME CITY STREET BLDG BLEVEL ALLEN SALES BOSTON ALLEN SALES LOS ANGELES ALLEN SALES LOS ANGELES rows in set (0.00 sec); Finally, we show that is possible to update a relational table through a view that is accessible to use in update mode. We allow to update a column SALARY through a relational view ALLENVIEW. While connected as a user csit115 execute the following statement to grant an update privilege on a column SALARY in a view ALLENVIEW. GRANT UPDATE (SALARY) ON csit115.allenview to harryp; To verify the privilege granted above execute the following statement while connected as a user harryp UPDATE ALLENVIEW SET SALARY = 1.1*SALARY; To verify the results of update execute the following statement as a user csit115. SELECT * FROM EMPLOYEE WHERE ENAME = ALLEN ; ENUM ENAME MANAGER HIREDATE SALARY COMM DNAME CITY STREET BLDG BLEVEL ALLEN SALES BOSTON ALLEN SALES LOS ANGELES ALLEN SALES LOS ANGELES

6 3 rows in set (0.00 sec) Step 3 How to grant global privileges with GRANT OPTION? Global privileges are either adminstrative privileges or the privileges that apply to all databases existing on a given database server. Administrative privileges allow to manage operation of database server. These privileges include among the others creating users, listing the names of databases, shutting down a database server, etc. For example, we can grant CREATE USER privilege to a user harryp. While connected as a user csit115 execute the following statement. GRANT CREATE USER ON *.* TO harryp; The statement fails because a user csit115 has no CREATE user privilege. it can be easily verified by connecting as a user csit115 and trying to create a new user. To grant CREATE USER privilege, connect as a user root and execute the following statement. GRANT CREATE USER ON *.* TO csit115; Now, it is easy to verify the privilege by connecting as a user csit115 and creating a new user. However, and attempt to grant CREATE USER privilege to a user harryp fails again! Why? A user csit115 has CREATE USER privilege now. A problem is that a user csit115 is not allowed to grant such privilege to other users. Posessing a privilege does not mean that granting such privilege to other user is possible. To eliminate the problem a privilege CREATE USER must be granted to a user csit115 with GRANT OPTION. While connected as a user root execute the following statement. GRANT CREATE USER ON *.* TO csit115 WITH GRANT OPTION; Next connect as a user csit115 and execute the following statement again. GRANT CREATE USER ON *.* TO harryp; This time the statement executes all right. It is also possible to connect as a user harryp and to create a new user. Step 4 How to retrieve privileges as a database administrator? A database mysql contains information about all privileges granted to the users. After installation the database is accesible to a user root. The database consists of the following relational tables Tables_in_mysql columns_priv db engine_cost 6

7 event func general_log gtid_executed help_category help_keyword help_relation help_topic innodb_index_stats innodb_table_stats ndb_binlog_index plugin proc procs_priv proxies_priv server_cost servers slave_master_info slave_relay_log_info slave_worker_info slow_log tables_priv time_zone time_zone_leap_second time_zone_name time_zone_transition time_zone_transition_type user Information about global privileges is stored in a relational table user Field Type Null Key Default Extra Host char(60) NO PRI User char(32) NO PRI Select_priv enum( N, Y ) NO N Insert_priv enum( N, Y ) NO N Update_priv enum( N, Y ) NO N Delete_priv enum( N, Y ) NO N Create_priv enum( N, Y ) NO N 7

8 Drop_priv enum( N, Y ) NO N Reload_priv enum( N, Y ) NO N Shutdown_priv enum( N, Y ) NO N Process_priv enum( N, Y ) NO N File_priv enum( N, Y ) NO N Grant_priv enum( N, Y ) NO N References_priv enum( N, Y ) NO N Index_priv enum( N, Y ) NO N Alter_priv enum( N, Y ) NO N Show_db_priv enum( N, Y ) NO N Super_priv enum( N, Y ) NO N Create_tmp_table_priv enum( N, Y ) NO N Lock_tables_priv enum( N, Y ) NO N Execute_priv enum( N, Y ) NO N Repl_slave_priv enum( N, Y ) NO N Repl_client_priv enum( N, Y ) NO N Create_view_priv enum( N, Y ) NO N Show_view_priv enum( N, Y ) NO N Create_routine_priv enum( N, Y ) NO N Alter_routine_priv enum( N, Y ) NO N Create_user_priv enum( N, Y ) NO N Event_priv enum( N, Y ) NO N Trigger_priv enum( N, Y ) NO N Create_tablespace_priv enum( N, Y ) NO N ssl_type enum(, ANY, X509, SPECIFIED ) NO ssl_cipher blob NO NULL 8

9 x509_issuer blob NO NULL x509_subject blob NO NULL max_questions int(11) unsigned NO 0 max_updates int(11) unsigned NO 0 max_connections int(11) unsigned NO 0 max_user_connections int(11) unsigned NO 0 plugin char(64) NO mysql_native_password authentication_string text YES NULL password_expired enum( N, Y ) NO N password_last_changed timestamp YES NULL password_lifetime smallint(5) unsigned YES NULL account_locked enum( N, Y ) NO N Connect as a user root and make a database mysql a default database for SQL statements. Next, to find the names of all users execute the following statement. SELECT User FROM user; The results are the following (it may happen that in your case the results are different because of more/less user accounts created in the system at the moment USER csit115 harryp jamesb mysql.sys root While connected as a user root list global SELECT privileges with the following statement. SELECT Select_priv, User FROM user; Select_priv User 9

10 Y root N mysql.sys N csit115 N jamesb N harryp Information about the database privileges is stored in a relational table db Field Type Null Key Default Extra Host char(60) NO PRI Db char(64) NO PRI User char(32) NO PRI Select_priv enum( N, Y ) NO N Insert_priv enum( N, Y ) NO N Update_priv enum( N, Y ) NO N Delete_priv enum( N, Y ) NO N Create_priv enum( N, Y ) NO N Drop_priv enum( N, Y ) NO N Grant_priv enum( N, Y ) NO N References_priv enum( N, Y ) NO N Index_priv enum( N, Y ) NO N Alter_priv enum( N, Y ) NO N Create_tmp_table_priv enum( N, Y ) NO N Lock_tables_priv enum( N, Y ) NO N Create_view_priv enum( N, Y ) NO N Show_view_priv enum( N, Y ) NO N Create_routine_priv enum( N, Y ) NO N Alter_routine_priv enum( N, Y ) NO N Execute_priv enum( N, Y ) NO N Event_priv enum( N, Y ) NO N Trigger_priv enum( N, Y ) NO N While connected as a user root execute the following statement to find all SELECT privileges on all databases. SELECT Db, Select_Priv, User FROM db; The results are the following Db Select_Priv User sys N mysql.sys csit115 Y csit Information about the table privileges is stored in a relational table tables_priv. 10

11 set( Select, Insert, Update, Delete, Create, Drop, Grant, References, Index, Alter, Create Field Type Null Key Default Extra Host char(60) NO PRI Db char(64) NO PRI User char(32) NO PRI Table_name char(64) NO PRI Grantor char(93) NO MUL Timestamp timestamp NO CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP Table_priv View, Show view, Trigger ) NO Column_priv set( Select, Insert, Update, References ) NO While connected as a user root execute the following statement to find all database names, user names, table names, and table privileges in all databases. SELECT Db, User, Table_name, Table_priv FROM tables_priv; The results are the following Db User Table_name Table_priv sys mysql.sys sys_config Select csit115 harryp DEPARTMENT csit115 harryp csit115 Create csit115 harryp EMPVIEW Select csit115 harryp ALLENVIEW Select Information about the column privileges is stored in a relational table columns_priv

12 Field Type Null Key Default Extra Host char(60) NO PRI Db char(64) NO PRI User char(32) NO PRI Table_name char(64) NO PRI Column_name char(64) NO PRI Timestamp timestamp NO CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP Column_priv set( Select, Insert, Update, References ) NO While connected as a user root execute the following statement to find all database names, user names, table names, column names, and column privileges in all databases. SELECT Db, User, Table_name, Column_name, Column_priv FROM columns_priv; The results are the following Db User Table_name Column_name Column_priv csit115 harryp DEPARTMENT CHAIRMAN Select,Insert csit115 harryp DEPARTMENT DNAME Select,Insert csit115 harryp ALLENVIEW SALARY Update References MySQL 5.7 Reference Manual, CREATE VIEW Statement ( MySQL 5.7 Reference Manual, DROP VIEW Statement ( MySQL 5.7 Reference Manual, Privileges Provided by MySQL ( MySQL 5.7 Reference Manual, The mysql System Database ( 12

Step 0 How to begin and what you need to do before you start?

Step 0 How to begin and what you need to do before you start? Written and cooked by Janusz R. Getta, School of Computing and Information Technology, University of Wollongong Building 3, room 2120, ext 4339, jrg@uow.edu.au, http://www.uow.edu.au/ jrg ËÁÌ½½ Ø Å Ò Ñ