fix: Database_observability: grant check only require SELECT *.* on perf_schema#5294
Conversation
| if strings.Contains(up, "SHOW VIEW") { | ||
| req["SHOW VIEW"] = true | ||
| } |
There was a problem hiding this comment.
Maybe for a followup: would be cool to show on which objects SHOW VIEW is granted (e.g. *.* vs payments.* or something else), as it helps debug why e.g. a specific schema is not reported.
| } | ||
| } | ||
|
|
||
| r.result = req["PROCESS"] && req["REPLICATION CLIENT"] && req["SELECT"] && req["SHOW VIEW"] |
There was a problem hiding this comment.
Could we add to r.result the list of expected vs missing grants?
There was a problem hiding this comment.
r.result is a boolean whether the check passed or failed.
r.value can be used to send details of the check.
This comment seems similar to #5294 (comment) in which we attach more information about which grant is missing?
There was a problem hiding this comment.
r.resultis a boolean whether the check passed or failed.
r.valuecan be used to send details of the check.
Sorry I confused the two fields. But yeah, basically I was thinking of attaching more info like I mentioned in the other comment.
matthewnolf
force-pushed
the
mn/db-o11y-mysql/status-permissions-fix
branch
from
e8b9891 to
d89ceee
Compare
2 participants
Brief description of Pull Request
This change fixes the MySQL health_check for permissions being overly restrictive. For
SELECTpermissions, we only needperformance_schema.*- not*.*. This updates the logic to more thoroughly check forperformance_schemaaccess.Pull Request Details
Issue(s) fixed by this Pull Request
Notes to the Reviewer
PR Checklist