I am configuring some new logins for users who have already been using the relevant MySQL servers under other logins. I would like to limit their privileges to the minimum each user needs, based on their input and reviewing the logs of what commands they have been executing. I would therefore like to know exactly what commands are allowed by each grantable privilege.
The specification in MySQL's documentation provides some insight beyond the obvious (e.g. "The SELECT privilege enables you to select rows from tables in a database.") but it seems like the information given there is not exhaustive. For example, I see in the logs that a user with only Select_priv
enabled also used SHOW VARIABLES
and SET
but I don't see any documentation of those commands being included in the SELECT
privilege.
This answer and this question give clues that there is more to the privileges than their names would directly imply.
UPDATE: @Colin 't Hart's comment is informative in that it explains the ability to execute SHOW
and SET
regardless of privileges. So my question should be limited to server side commands. I.e. Are there commands not listed in the specification which can be used by users with a given privilege?
show
andset
are commands of the MySQL client; you can't prevent users from using them.set global
is only allowed if the user hassuper
. See dev.mysql.com/doc/refman/5.1/en/grant.html#grant-privileges – Colin 't Hart Mar 12 '15 at 19:43