Skip to content

MDEV-38601 require FEDERATED ADMIN for SHOW CREATE SERVER - #4743

Merged
gkodinov merged 1 commit into
MariaDB:11.8from
MooSayed1:MDEV-38601-show-create-server-priv
Mar 25, 2026
Merged

MDEV-38601 require FEDERATED ADMIN for SHOW CREATE SERVER#4743
gkodinov merged 1 commit into
MariaDB:11.8from
MooSayed1:MDEV-38601-show-create-server-priv

Conversation

@MooSayed1

Copy link
Copy Markdown
Contributor

The Jira issue number for this PR is: MDEV-38601

Description

SHOW CREATE SERVER did not require any privilege — any authenticated user
could run it and see full server connection details including passwords stored
in mysql.servers.

-- Any user could run this without FEDERATED ADMIN:
SHOW CREATE SERVER srv;
-- Returns: CREATE SERVER `srv` ... OPTIONS (USER 'remote_user', PASSWORD 'secret', ...)

CREATE SERVER, ALTER SERVER, and DROP SERVER all correctly require
FEDERATED ADMIN privilege, but SHOW CREATE SERVER (introduced in MDEV-15696,
MariaDB 11.7) was missing the equivalent check.

The root cause is in sql/sql_parse.cc: the SQLCOM_SHOW_CREATE_SERVER case
had no check_global_access() call before dispatching to
mysql_show_create_server().

The fix: add check_global_access(thd, PRIV_STMT_CREATE_SERVER) at the top
of the SQLCOM_SHOW_CREATE_SERVER case, matching the identical pattern used
by SQLCOM_CREATE_SERVER, SQLCOM_ALTER_SERVER, and SQLCOM_DROP_SERVER.

Release Notes

SHOW CREATE SERVER now requires the FEDERATED ADMIN privilege.
Users without this privilege receive ERROR 42000: Access denied; you need (at least one of) the FEDERATED ADMIN privilege(s).

How can this PR be tested?

./mtr main.grant_server

The test creates a server as root, then verifies that an unprivileged user
receives ER_SPECIFIC_ACCESS_DENIED_ERROR on SHOW CREATE SERVER, and that
the same user succeeds after being granted FEDERATED ADMIN.

Basing the PR against the correct MariaDB version

This is a bug fix. SHOW CREATE SERVER was introduced in 11.7, and the
earliest affected maintained branch is 11.8, so this PR targets upstream/11.8.

PR quality check

  • I checked the CODING_STANDARDS.md file and my PR conforms to this where appropriate.
  • For any trivial modifications to the PR, I am ok with the reviewer making the changes themselves.

@gkodinov gkodinov added the External Contribution All PRs from entities outside of MariaDB Foundation, Corporation, Codership agreements. label Mar 6, 2026

@gkodinov gkodinov left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for your contribution! This is a preliminary review.

In addition to the below, please make sure your commit has a commit message complying with CODING_STANDARDS.md.

Comment thread mysql-test/main/grant_server.result Outdated
Comment thread sql/sql_parse.cc Outdated
@mariadb-YuchenPei
mariadb-YuchenPei self-requested a review March 10, 2026 00:14
Comment thread mysql-test/main/grant_server.test Outdated
@MooSayed1
MooSayed1 force-pushed the MDEV-38601-show-create-server-priv branch from cb14e9d to 2b8feba Compare March 18, 2026 18:08
@MooSayed1

Copy link
Copy Markdown
Contributor Author

@gkodinov @mariadb-YuchenPei Thank you for the review and srry for the delay was focusing at proposal and other stuff.

@mariadb-YuchenPei mariadb-YuchenPei left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good now. Passing to @vuvova for a final review.

Comment thread mysql-test/main/grant_server.test
@MooSayed1
MooSayed1 force-pushed the MDEV-38601-show-create-server-priv branch from 2b8feba to 069640d Compare March 19, 2026 00:02
Comment thread mysql-test/main/grant_server.test Outdated
Comment thread mysql-test/main/grant_server.test Outdated
@MooSayed1
MooSayed1 force-pushed the MDEV-38601-show-create-server-priv branch from 069640d to 7626422 Compare March 23, 2026 01:33
@MooSayed1
MooSayed1 requested a review from vuvova March 23, 2026 01:34
@vuvova
vuvova force-pushed the MDEV-38601-show-create-server-priv branch from 7626422 to ed340dc Compare March 23, 2026 20:18

@gkodinov gkodinov left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please add a commit message to your commit!

@MooSayed1
MooSayed1 force-pushed the MDEV-38601-show-create-server-priv branch from ed340dc to 894d823 Compare March 24, 2026 14:20
@MooSayed1

Copy link
Copy Markdown
Contributor Author

@gkodinov Done. Thank you all for your effort in reviewing and guiding.

@MooSayed1
MooSayed1 requested a review from gkodinov March 24, 2026 14:25

@gkodinov gkodinov left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Thank you for your work on this!

SHOW CREATE SERVER was accessible to any user with a global
privilege, without requiring FEDERATED ADMIN. Add a privilege
check before mysql_show_create_server() so that only users
with FEDERATED ADMIN can view server definitions.
@gkodinov
gkodinov force-pushed the MDEV-38601-show-create-server-priv branch from 894d823 to 911ad7e Compare March 25, 2026 08:29
@gkodinov
gkodinov enabled auto-merge (rebase) March 25, 2026 08:29
@gkodinov
gkodinov merged commit 206074e into MariaDB:11.8 Mar 25, 2026
17 of 19 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

External Contribution All PRs from entities outside of MariaDB Foundation, Corporation, Codership agreements.

Development

Successfully merging this pull request may close these issues.

4 participants