(8.4)PXC-5291: User without super can create trigger even without log_bin_… - #2324
Open
jaideepkarande wants to merge 1 commit into
Open
(8.4)PXC-5291: User without super can create trigger even without log_bin_…#2324jaideepkarande wants to merge 1 commit into
jaideepkarande wants to merge 1 commit into
Conversation
Contributor
Author
|
https://pxc.cd.percona.com/view/8.0%20parallel%20MTR/job/pxc-8.x-pipeline-parallel-mtr/855/consoleFull |
jaideepkarande
marked this pull request as ready for review
July 16, 2026 06:17
kamil-holubicki
left a comment
kamil-holubicki
left a comment
Contributor
There was a problem hiding this comment.
Please consider refactoring it according to suggestions in PR #2325
jaideepkarande
force-pushed
the
PXC-5291-8.4
branch
from
September 1, 2026 08:39
abe7395 to
94cad9a
Compare
Contributor
Author
…trust_function_creators enabled https://perconadev.atlassian.net/browse/PXC-5291 Problem: The PXC-4765 change combined trigger DEFINER validation with the log_bin_trust_function_creators check and allowed either SUPER or SET_ANY_DEFINER to satisfy both. Consequently, a user holding only SET_ANY_DEFINER could create a trigger with log_bin_trust_function_creators=0, diverging from PS and PXC 8.4.7, which reject the statement with ER_BINLOG_CREATE_ROUTINE_NEED_SUPER. While fixing this, an additional issue was found where early validation covered a differing DEFINER but not a nonexistent one. A SET_ANY_DEFINER user could therefore pass the pre-TOI check, after which the origin rejected the trigger during creation while appliers accepted it, causing node inconsistency and possible eviction. Resolution: Replace the combined privilege test with two independent checks: * Use check_valid_definer() before TOI to validate differing and nonexistent DEFINER accounts, including the SYSTEM_USER rule. * Keep the binlog-safety check separate and require SUPER when log_bin_trust_function_creators=0. This check continues to apply with emulated binlogging because Galera replicates the trigger body.
jaideepkarande
force-pushed
the
PXC-5291-8.4
branch
from
September 1, 2026 09:18
94cad9a to
6d7fbef
Compare
jaideepkarande
commented
Sep 1, 2026
Contributor
Author
There was a problem hiding this comment.
I will re-add it for upstream compatibility.
And add sql_authorization.h inside WITH_WSREP, if issue is raised by pipelines.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
…trust_function_creators enabled
https://perconadev.atlassian.net/browse/PXC-5291
The PXC-4765 change folded the trigger DEFINER-mismatch check and the binlog-safety (log_bin_trust_function_creators) check into a single privilege test that accepted SUPER or SET_ANY_DEFINER. As a result a user holding only SET_ANY_DEFINER could create a trigger while log_bin_trust_function_creators = 0, diverging from PS and PXC 8.4.7 which reject it with ER_BINLOG_CREATE_ROUTINE_NEED_SUPER.
Split the two checks in Sql_cmd_create_trigger::execute(): the DEFINER-mismatch check keeps SUPER or SET_ANY_DEFINER, while the binlog-safety check now requires SUPER only. SET_ANY_DEFINER no longer bypasses the binlog-safety gate.