I am configuring some new logins for users who have already been using the relevant MySQL servers under other logins. I would like to limit their privileges to the minimum each user needs, based on their input and reviewing the logs of what commands they have been executing. I would therefore like to know exactly what commands are allowed by each grantable privilege.
The specification in MySQL's documentation provides some insight beyond the obvious (e.g. "The SELECT privilege enables you to select rows from tables in a database.") but it seems like the information given there is not exhaustive. For example, I see in the logs that a user with only
Select_priv enabled also used
SHOW VARIABLES and
SET but I don't see any documentation of those commands being included in the
UPDATE: @Colin 't Hart's comment is informative in that it explains the ability to execute
SET regardless of privileges. So my question should be limited to server side commands. I.e. Are there commands not listed in the specification which can be used by users with a given privilege?