2

I'm trying to figure out a "safe" way of allowing a non-SUPER user to execute a specific command requiring SUPER privileges, i.e. SET SESSION binlog_format = 'MIXED'. I don't want to grant the user SUPER privileges for security reasons. Can this be accomplished using a stored procedure or any other method?

1

You can have stored procedures execute as the definer instead of the invoker:

CREATE DEFINER = 'admin'@'localhost' PROCEDURE p1()
SQL SECURITY DEFINER
BEGIN
  UPDATE t1 SET counter = counter + 1;
END;

See: Access Control for Stored Programs and Views

  • Definer context is actually the default in MySQL unless SQL SECURITY INVOKER is specified, but, yes, this is a common and viable approach. – Michael - sqlbot Jul 15 '14 at 23:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.