Skip to content

DM: Improve MariaDB permission handling #12404

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dveeden wants to merge 1 commit into
base: master
Choose a base branch
from
+105 −384
Open

DM: Improve MariaDB permission handling #12404

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion dm/checker/checker.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -304,6 +304,7 @@ func (c *Checker) Init(ctx context.Context) (err error) {
c.checkList = append(c.checkList, checker.NewTargetPrivilegeChecker(
c.instances[0].targetDB.DB,
c.instances[0].targetDBInfo,
c.instances[0].targetDB.Version,
))
}
// sourceID -> DB
Expand Down Expand Up @@ -334,6 +335,7 @@ func (c *Checker) Init(ctx context.Context) (err error) {
c.checkList = append(c.checkList, checker.NewSourceDumpPrivilegeChecker(
instance.sourceDB.DB,
instance.sourceDBinfo,
instance.sourceDB.Version,
info.sourceID2SourceTables[sourceID],
exportCfg.Consistency,
c.dumpWholeInstance,
Expand Down Expand Up @@ -364,7 +366,7 @@ func (c *Checker) Init(ctx context.Context) (err error) {
c.checkList = append(c.checkList, checker.NewMySQLBinlogRowImageChecker(instance.sourceDB.DB, instance.sourceDBinfo))
}
if _, ok := c.checkingItems[config.ReplicationPrivilegeChecking]; ok {
c.checkList = append(c.checkList, checker.NewSourceReplicationPrivilegeChecker(instance.sourceDB.DB, instance.sourceDBinfo))
c.checkList = append(c.checkList, checker.NewSourceReplicationPrivilegeChecker(instance.sourceDB.DB, instance.sourceDBinfo, instance.sourceDB.Version))
}
if _, ok := c.checkingItems[config.OnlineDDLChecking]; c.onlineDDL != nil && ok {
c.checkList = append(c.checkList, checker.NewOnlineDDLChecker(instance.sourceDB.DB, info.sourceID2InterestedDB[i], c.onlineDDL, instance.baList))
Expand Down
2 changes: 1 addition & 1 deletion dm/pkg/checker/conn_checker.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,7 +94,7 @@ func (c *connNumberChecker) check(ctx context.Context, checkerName string, neede
markCheckError(result, err)
return result
}
err2 := verifyPrivilegesWithResult(result, grants, neededPriv)
err2 := verifyPrivilegesWithResult(result, grants, neededPriv, c.toCheckDB.Version)
if err2 != nil {
// no enough privilege to check the user's connection number
result.State = StateWarning
Expand Down
37 changes: 25 additions & 12 deletions dm/pkg/checker/privilege.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,12 +54,14 @@ type SourceDumpPrivilegeChecker struct {
checkTables []filter.Table
consistency string
dumpWholeInstance bool
version string
}

// NewSourceDumpPrivilegeChecker returns a RealChecker.
func NewSourceDumpPrivilegeChecker(
db *sql.DB,
dbinfo *dbutil.DBConfig,
version string,
checkTables []filter.Table,
consistency string,
dumpWholeInstance bool,
Expand All @@ -70,6 +72,7 @@ func NewSourceDumpPrivilegeChecker(
checkTables: checkTables,
consistency: consistency,
dumpWholeInstance: dumpWholeInstance,
version: version,
}
}

Expand Down Expand Up @@ -107,7 +110,7 @@ func (pc *SourceDumpPrivilegeChecker) Check(ctx context.Context) *Result {
dumpRequiredPrivs[mysql.LockTablesPriv] = priv{needGlobal: true}
}

err2 := verifyPrivilegesWithResult(result, grants, dumpRequiredPrivs)
err2 := verifyPrivilegesWithResult(result, grants, dumpRequiredPrivs, pc.version)
if err2 != nil {
result.Errors = append(result.Errors, err2)
result.Instruction = "Please grant the required privileges to the account."
Expand All @@ -126,13 +129,14 @@ func (pc *SourceDumpPrivilegeChecker) Name() string {

// SourceReplicatePrivilegeChecker checks replication privileges of source DB.
type SourceReplicatePrivilegeChecker struct {
db *sql.DB
dbinfo *dbutil.DBConfig
db *sql.DB
dbinfo *dbutil.DBConfig
version string
}

// NewSourceReplicationPrivilegeChecker returns a RealChecker.
func NewSourceReplicationPrivilegeChecker(db *sql.DB, dbinfo *dbutil.DBConfig) RealChecker {
return &SourceReplicatePrivilegeChecker{db: db, dbinfo: dbinfo}
func NewSourceReplicationPrivilegeChecker(db *sql.DB, dbinfo *dbutil.DBConfig, version string) RealChecker {
return &SourceReplicatePrivilegeChecker{db: db, dbinfo: dbinfo, version: version}
}

// Check implements the RealChecker interface.
Expand All @@ -154,7 +158,7 @@ func (pc *SourceReplicatePrivilegeChecker) Check(ctx context.Context) *Result {
mysql.ReplicationSlavePriv: {needGlobal: true},
mysql.ReplicationClientPriv: {needGlobal: true},
}
err2 := verifyPrivilegesWithResult(result, grants, replRequiredPrivs)
err2 := verifyPrivilegesWithResult(result, grants, replRequiredPrivs, pc.version)
if err2 != nil {
result.Errors = append(result.Errors, err2)
result.State = StateFailure
Expand All @@ -169,12 +173,13 @@ func (pc *SourceReplicatePrivilegeChecker) Name() string {
}

type TargetPrivilegeChecker struct {
db *sql.DB
dbinfo *dbutil.DBConfig
db *sql.DB
dbinfo *dbutil.DBConfig
version string
}

func NewTargetPrivilegeChecker(db *sql.DB, dbinfo *dbutil.DBConfig) RealChecker {
return &TargetPrivilegeChecker{db: db, dbinfo: dbinfo}
func NewTargetPrivilegeChecker(db *sql.DB, dbinfo *dbutil.DBConfig, version string) RealChecker {
return &TargetPrivilegeChecker{db: db, dbinfo: dbinfo, version: version}
}

func (t *TargetPrivilegeChecker) Name() string {
Expand Down Expand Up @@ -203,7 +208,7 @@ func (t *TargetPrivilegeChecker) Check(ctx context.Context) *Result {
mysql.DropPriv: {needGlobal: true},
mysql.IndexPriv: {needGlobal: true},
}
err2 := verifyPrivilegesWithResult(result, grants, replRequiredPrivs)
err2 := verifyPrivilegesWithResult(result, grants, replRequiredPrivs, t.version)
if err2 != nil {
result.Errors = append(result.Errors, err2)
// because we cannot be very precisely sure about which table
Expand All @@ -217,8 +222,9 @@ func verifyPrivilegesWithResult(
result *Result,
grants []string,
requiredPriv map[mysql.PrivilegeType]priv,
version string,
) *Error {
lackedPriv, err := VerifyPrivileges(grants, requiredPriv)
lackedPriv, err := VerifyPrivileges(grants, requiredPriv, version)
if err != nil {
// nolint
return NewError(err.Error())
Expand Down Expand Up @@ -284,12 +290,19 @@ func LackedPrivilegesAsStr(lackPriv map[mysql.PrivilegeType]priv) string {
func VerifyPrivileges(
grants []string,
lackPrivs map[mysql.PrivilegeType]priv,
version string,
) (map[mysql.PrivilegeType]priv, error) {
if len(grants) == 0 {
return nil, errors.New("there is no such grant defined for current user on host '%%'")
}

p := parser.New()

// Support for BINLOG MONITOR and other MariaDB things
if strings.Contains(version, "MariaDB") {
p.SetMariaDB(true)
}

for _, grant := range grants {
if len(lackPrivs) == 0 {
break
Expand Down
8 changes: 4 additions & 4 deletions dm/pkg/conn/basedb.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -201,7 +201,7 @@ type BaseDB struct {
doNotClose bool

// SELECT VERSION()
version string
Version string
}

// NewBaseDB returns *BaseDB object for test.
Expand All @@ -213,7 +213,7 @@ func NewBaseDB(db *sql.DB, scope terror.ErrScope, version string, doFuncInClose
Retry: &retry.FiniteRetryStrategy{},
Scope: scope,
doFuncInClose: doFuncInClose,
version: version,
Version: version,
}
}

Expand Down Expand Up @@ -385,15 +385,15 @@ func (d *BaseDB) needsModernTerminology() bool {
// - https://mariadb.com/docs/server/reference/sql-statements/administrative-sql-statements/show/show-replica-hosts
//
// Old syntax is still accepted.
if strings.Contains(d.version, "MariaDB") {
if strings.Contains(d.Version, "MariaDB") {
return false
}

// https://dev.mysql.com/doc/relnotes/mysql/8.4/en/news-8-4-0.html#mysqld-8-4-0-deprecation-removal
// MySQL 8.4 removed `SHOW MASTER STATUS`.
minVer := semver.New("8.4.0")

v, err := semver.NewVersion(d.version)
v, err := semver.NewVersion(d.Version)
if err != nil {
return false
}
Expand Down
4 changes: 2 additions & 2 deletions dm/pkg/conn/basedb_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -121,7 +121,7 @@ func TestNeedsModernTerminology(t *testing.T) {
}

for _, tc := range cases {
b.version = tc.version
require.Equal(t, tc.modern, b.needsModernTerminology(), b.version)
b.Version = tc.version
require.Equal(t, tc.modern, b.needsModernTerminology(), b.Version)
}
}
49 changes: 28 additions & 21 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ require (
github.com/go-oauth2/oauth2/v4 v4.5.4
github.com/go-ozzo/ozzo-validation/v4 v4.3.0
github.com/go-sql-driver/mysql v1.7.1
github.com/goccy/go-json v0.10.2
github.com/goccy/go-json v0.10.4
github.com/gogo/gateway v1.1.0
github.com/gogo/protobuf v1.3.2
github.com/golang-jwt/jwt/v5 v5.3.0
Expand Down Expand Up @@ -68,15 +68,15 @@ require (
github.com/modern-go/reflect2 v1.0.2
github.com/olekukonko/tablewriter v0.0.5
github.com/phayes/freeport v0.0.0-20180830031419-95f893ade6f2
github.com/pierrec/lz4/v4 v4.1.18
github.com/pierrec/lz4/v4 v4.1.21
github.com/pingcap/check v0.0.0-20211026125417-57bd13f7b5f0
github.com/pingcap/errors v0.11.5-0.20250523034308-74f78ae071ee
github.com/pingcap/failpoint v0.0.0-20240528011301-b51a646c7c86
github.com/pingcap/kvproto v0.0.0-20250915095348-efd5134a6d6c
github.com/pingcap/kvproto v0.0.0-20251109100001-1907922fbd18
github.com/pingcap/log v1.1.1-0.20250917021125-19901e015dc9
github.com/pingcap/tidb v1.1.0-beta.0.20250925123346-8ea80e6b2b42
github.com/pingcap/tidb v1.1.0-beta.0.20251122130147-eeee02deea7f
github.com/pingcap/tidb-dashboard v0.0.0-20240326110213-9768844ff5d7
github.com/pingcap/tidb/pkg/parser v0.0.0-20250925154222-93731f04705d
github.com/pingcap/tidb/pkg/parser v0.0.0-20251122130147-eeee02deea7f
github.com/prometheus/client_golang v1.22.0
github.com/prometheus/client_model v0.6.2
github.com/r3labs/diff v1.1.0
Expand All @@ -91,7 +91,7 @@ require (
github.com/stretchr/testify v1.10.0
github.com/syndtr/goleveldb v1.0.1-0.20210305035536-64b5b1c73954
github.com/thanhpk/randstr v1.0.6
github.com/tikv/client-go/v2 v2.0.8-0.20250917111308-6cbd7e4f9761
github.com/tikv/client-go/v2 v2.0.8-0.20251112113123-1264c1278595
github.com/tikv/pd v1.1.0-beta.0.20240407022249-7179657d129b
github.com/tikv/pd/client v0.0.0-20250703091733-dfd345b89500
github.com/tinylib/msgp v1.1.6
Expand All @@ -111,7 +111,7 @@ require (
go.uber.org/mock v0.5.2
go.uber.org/multierr v1.11.0
go.uber.org/ratelimit v0.2.0
go.uber.org/zap v1.27.0
go.uber.org/zap v1.27.1
golang.org/x/exp v0.0.0-20240909161429-701f63a606c0
golang.org/x/net v0.42.0
golang.org/x/oauth2 v0.30.0
Expand All @@ -120,7 +120,7 @@ require (
golang.org/x/text v0.29.0
golang.org/x/time v0.12.0
google.golang.org/genproto/googleapis/api v0.0.0-20240401170217-c3f982113cda
google.golang.org/genproto/googleapis/rpc v0.0.0-20240515191416-fc5f0ca64291
google.golang.org/genproto/googleapis/rpc v0.0.0-20250425173222-7b384671a197
google.golang.org/grpc v1.64.0
google.golang.org/protobuf v1.36.6
gopkg.in/yaml.v2 v2.4.0
Expand All @@ -145,8 +145,8 @@ require (
github.com/alibabacloud-go/tea-xml v1.1.3 // indirect
github.com/aliyun/alibabacloud-oss-go-sdk-v2 v1.2.3 // indirect
github.com/aliyun/credentials-go v1.4.7 // indirect
github.com/andybalholm/brotli v1.0.5 // indirect
github.com/apache/arrow/go/v12 v12.0.1 // indirect
github.com/andybalholm/brotli v1.1.1 // indirect
github.com/apache/arrow-go/v18 v18.0.0 // indirect
github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.0 // indirect
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.14 // indirect
Expand Down Expand Up @@ -179,36 +179,37 @@ require (
github.com/go-logr/logr v1.4.1 // indirect
github.com/go-logr/stdr v1.2.2 // indirect
github.com/go-resty/resty/v2 v2.11.0 // indirect
github.com/goccy/go-reflect v1.2.0 // indirect
github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
github.com/google/flatbuffers v2.0.8+incompatible // indirect
github.com/google/flatbuffers v24.3.25+incompatible // indirect
github.com/google/gofuzz v1.2.0 // indirect
github.com/google/s2a-go v0.1.7 // indirect
github.com/hamba/avro/v2 v2.22.2-0.20240625062549-66aad10411d9 // indirect
github.com/hamba/avro/v2 v2.27.0 // indirect
github.com/influxdata/tdigest v0.0.1 // indirect
github.com/jellydator/ttlcache/v3 v3.0.1 // indirect
github.com/jfcg/sixb v1.3.8 // indirect
github.com/jfcg/sorty/v2 v2.1.0 // indirect
github.com/joomcode/errorx v1.0.1 // indirect
github.com/klauspost/asmfmt v1.3.2 // indirect
github.com/klauspost/cpuid/v2 v2.2.7 // indirect
github.com/klauspost/cpuid/v2 v2.2.9 // indirect
github.com/ks3sdklib/aws-sdk-go v1.2.9 // indirect
github.com/kylelemons/godebug v1.1.0 // indirect
github.com/minio/asm2plan9s v0.0.0-20200509001527-cdd76441f9d8 // indirect
github.com/minio/c2goasm v0.0.0-20190812172519-36a3d3bbc4f3 // indirect
github.com/mitchellh/mapstructure v1.5.0 // indirect
github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 // indirect
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
github.com/ncruces/go-strftime v0.1.9 // indirect
github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037 // indirect
github.com/oasdiff/yaml3 v0.0.0-20250309153720-d2182401db90 // indirect
github.com/perimeterx/marshmallow v1.1.5 // indirect
github.com/pingcap/metering_sdk v0.0.0-20250918015914-468cd6feb1dc // indirect
github.com/pingcap/metering_sdk v0.0.0-20251110022152-dac449ac5389 // indirect
github.com/qri-io/jsonpointer v0.1.1 // indirect
github.com/qri-io/jsonschema v0.2.1 // indirect
github.com/robfig/cron/v3 v3.0.1 // indirect
github.com/segmentio/asm v1.2.0 // indirect
github.com/segmentio/fasthash v1.0.3 // indirect
github.com/sergi/go-diff v1.3.1 // indirect
github.com/spf13/afero v1.14.0 // indirect
github.com/tidwall/btree v1.7.0 // indirect
github.com/tidwall/buntdb v1.3.0 // indirect
github.com/tidwall/gjson v1.14.4 // indirect
Expand All @@ -225,7 +226,7 @@ require (
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.22.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.22.0 // indirect
golang.org/x/arch v0.3.0 // indirect
golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
google.golang.org/genproto v0.0.0-20240401170217-c3f982113cda // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/ini.v1 v1.67.0 // indirect
Expand Down Expand Up @@ -253,7 +254,7 @@ require (
github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d // indirect
github.com/aliyun/alibaba-cloud-sdk-go v1.61.1581 // indirect
github.com/andres-erbsen/clock v0.0.0-20160526145045-9e14626cd129 // indirect
github.com/apache/thrift v0.16.0 // indirect
github.com/apache/thrift v0.21.0 // indirect
github.com/ardielle/ardielle-go v1.5.2 // indirect
github.com/aws/aws-sdk-go-v2/service/glue v1.58.1
github.com/beorn7/perks v1.0.1 // indirect
Expand Down Expand Up @@ -353,7 +354,7 @@ require (
github.com/pingcap/fn v1.0.0 // indirect
github.com/pingcap/goleveldb v0.0.0-20191226122134-f82aafb29989 // indirect
github.com/pingcap/sysutil v1.0.1-0.20240311050922-ae81ee01f3a5
github.com/pingcap/tipb v0.0.0-20250829062436-85a019a5df23 // indirect
github.com/pingcap/tipb v0.0.0-20250928030846-9fd33ded6f2c // indirect
github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
github.com/pkg/errors v0.9.1 // indirect
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
Expand Down Expand Up @@ -392,7 +393,6 @@ require (
github.com/xdg-go/stringprep v1.0.4 // indirect
github.com/xdg/stringprep v1.0.3 // indirect
github.com/xiang90/probing v0.0.0-20221125231312-a49e3df8f510 // indirect
github.com/xitongsys/parquet-go v1.6.3-0.20240520233950-75e935fc3e17 // indirect
github.com/yusufpapurcu/wmi v1.2.4 // indirect
go.etcd.io/bbolt v1.3.10 // indirect
go.etcd.io/etcd/client/v2 v2.305.15 // indirect
Expand All @@ -411,10 +411,10 @@ require (
gopkg.in/mgo.v2 v2.0.0-20190816093944-a6b53ec6cb22 // indirect
gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
modernc.org/libc v1.37.1 // indirect
modernc.org/libc v1.41.0 // indirect
modernc.org/mathutil v1.7.1 // indirect
modernc.org/memory v1.7.2 // indirect
modernc.org/sqlite v1.27.0 // indirect
modernc.org/sqlite v1.29.6 // indirect
sigs.k8s.io/yaml v1.4.0 // indirect
sourcegraph.com/sourcegraph/appdash v0.0.0-20190731080439-ebfcffb1b5c0 // indirect
sourcegraph.com/sourcegraph/appdash-data v0.0.0-20151005221446-73f23eafcf67 // indirect
Expand Down Expand Up @@ -443,3 +443,10 @@ replace golang.org/x/text => golang.org/x/text v0.28.0

// tls10server=1
godebug tlsrsakex=1

replace github.com/pingcap/tidb/pkg/parser => /home/dvaneeden/dev/pingcap/tidb/pkg/parser

replace github.com/pingcap/tidb => /home/dvaneeden/dev/pingcap/tidb
Comment on lines +447 to +449
Copy link
Contributor

@D3Hunter D3Hunter Dec 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

please fix this

Copy link
Contributor Author

@dveeden dveeden Dec 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Once the commit in pingcap/tidb that's needed for this PR to function is merged I will do that. This is mentioned in the description and this is the reason for the hold label.


// copy from TiDB
replace github.com/apache/arrow-go/v18 => github.com/joechenrh/arrow-go/v18 v18.0.0-20250911101656-62c34c9a3b82
Loading