I have a MySQL user (rundeck) that is being used as part of a deployment process. Its purpose is to create a new database, create a new user, and grant permissions to the new user for the new database. The problem is that I can't seem to find a granular permission for the user that allows granting permissions without also exposing the data in the database. If I run with any permissions other than GRANT and ALL, I get the following output:
mysql> GRANT ALL ON `mydatabase`.* TO ''@'192.168.101.%';
ERROR 1044 (42000): Access denied for user 'rundeck'@'hostname.com' to database 'mydatabase'
I really would like to restrict the rundeck user from accessing the data, but can't get GRANT to work without also using ALL. If I use both together, it works perfectly, unsurprisingly. We suspect that the
mydatabase.* may be the element requiring additional permissions. Can anyone suggest a group of permissions that will allow a user to grant permissions to a database that they cannot access the data to?
SHOW GRANTS output from working configuration:
GRANT ALL PRIVILEGES ON . TO 'rundeck'@'hostname.com' IDENTIFIED BY PASSWORD 'passhash' WITH GRANT OPTION
SHOW GRANTS output from non-working configuration:
GRANT CREATE, DROP, RELOAD, SHOW DATABASES, CREATE USER ON . TO 'rundeck'@'hostname.com' IDENTIFIED BY PASSWORD 'passhash' WITH GRANT OPTION