executor: forbid user to drop important system table #7471

tiancaiamao · 2018-08-23T08:12:35Z

What problem does this PR solve?

If a user drop some important tables by mistake, such as mysql.user, it's difficult to recover.
In the worst case, the whole cluster fails to bootstrap, we should prevent that.

What is changed and how it works?

Forbid user to drop important system tables.

Check List

Tests

Unit test

Side effects

It's harder to drop those tables.

Should we also protect the statistic tables? @lamxTyler
@zimulala @shenli

If a user drop some important tables by mistake, such as mysql.user, it's difficult to recover. In the worst case, the whole cluster fails to bootstrap, we should prevent that.

winkyao · 2018-08-23T09:23:29Z

executor/ddl.go

@@ -198,6 +230,14 @@ func (e *DDLExec) executeDropTable(s *ast.DropTableStmt) error {
 			return errors.Trace(err)
 		}

+		// Protect important system table from been dropped by a mistake.
+		// I can hardly find a case that a user really need to do this.
+		if isSystemTable(tn.Schema.L, tn.Name.L) {


What about forbidding drop any tables in database mysql? It can avoid we add some important table in mysql, and forget to modify the systemTables map.

What's your opinion? @shenli @lamxTyler

I suggest protecting all the tables in the mysql database.

winkyao · 2018-08-23T09:24:49Z

executor/ddl.go

+	// Protect important system table from been dropped by a mistake.
+	// I can hardly find a case that a user really need to do this.
+	if dbName.L == "mysql" {
+		if !privileges.SkipWithGrant {


Why we need to consider the privileges.SkipWithGrant?

I know it's a rare case, but how about that we really want to do it?

We need a "backdoor".

shenli · 2018-08-23T09:36:58Z

executor/ddl.go

@@ -198,6 +230,14 @@ func (e *DDLExec) executeDropTable(s *ast.DropTableStmt) error {
 			return errors.Trace(err)
 		}

+		// Protect important system table from been dropped by a mistake.
+		// I can hardly find a case that a user really need to do this.
+		if isSystemTable(tn.Schema.L, tn.Name.L) {


I suggest protecting all the tables in the mysql database.

shenli · 2018-08-23T09:37:37Z

executor/ddl.go

@@ -154,8 +155,19 @@ func (e *DDLExec) executeCreateIndex(s *ast.CreateIndexStmt) error {
 	return errors.Trace(err)
 }

+var errForbidDrop = errors.New("Hey, drop system database/table, are you sure?")


Please make the error message more seriously.

zimulala · 2018-08-23T11:53:56Z

executor/ddl.go

+	"gc_delete_range_done": {},
+}
+
+func isSystemTable(schema, table string) bool {


Could we put it to infoschema.go? I think it is like "IsMemoryDB", we can put these together.

This function is removed, we forbid dropping tables in "mysql" database.

jackysp

If we forbid drop all the tables in the database "mysql", I think the user will blame that he cannot drop the table which he created in the database "mysql", except using skip_grand_table which requires to restart the tidb server.

tiancaiamao · 2018-08-23T12:40:11Z

A sane person will not drop system tables.
A sane person will not create table on "mysql" database
This change tries to prevent some insane person from breaking the system, it has very small affect on a sane person.

morgo · 2018-08-24T01:21:18Z

I think this will break mysqldump restores. Here is an example of what mysqldump with --all-databases from 5.7 produces:

--
-- Table structure for table `user`
--

DROP TABLE IF EXISTS `user`;
/*!40101 SET @saved_cs_client     = @@character_set_client */;
/*!40101 SET character_set_client = utf8 */;
CREATE TABLE `user` (
  `Host` char(60) COLLATE utf8_bin NOT NULL DEFAULT '',
  `User` char(32) COLLATE utf8_bin NOT NULL DEFAULT '',
  `Select_priv` enum('N','Y') CHARACTER SET utf8 NOT NULL DEFAULT 'N',
  `Insert_priv` enum('N','Y') CHARACTER SET utf8 NOT NULL DEFAULT 'N',
..

jackysp · 2018-08-24T02:55:20Z

"A sane person will not create table on "mysql" database" ? Maybe s/sane/genius/ will be all right :-)

shenli · 2018-08-26T03:38:42Z

@morgo Some tables in the mysql database are critical to TiDB. For example tidb, 'gc_*'. Users should never touch these tables.

@tiancaiamao User, '*_Priv' tables are not so critical. We could save the cluster even they are dropped. I think we could relax the protection for them.

tiancaiamao · 2018-08-27T05:32:51Z

PTAL @shenli @jackysp

winkyao

LGTM

tiancaiamao · 2018-08-28T08:10:24Z

PTAL @shenli

jackysp

LGTM

tiancaiamao · 2018-08-28T09:23:41Z

/run-all-tests

tiancaiamao · 2018-08-29T03:14:29Z

PTAL @shenli

shenli · 2018-08-29T13:59:37Z

executor/ddl.go

+		// Protect important system table from been dropped by a mistake.
+		// I can hardly find a case that a user really need to do this.
+		if isSystemTable(tn.Schema.L, tn.Name.L) {
+			return errors.Trace(errForbidDrop)


Add the system table name in the error message.

shenli · 2018-08-29T14:01:02Z

executor/ddl.go

@@ -179,6 +188,22 @@ func (e *DDLExec) executeDropDatabase(s *ast.DropDatabaseStmt) error {
 	return errors.Trace(err)
 }

+var systemTables = map[string]struct{}{


Add a comment for this map. Explain why we prevent users from dropping them.

tiancaiamao · 2018-08-29T14:49:35Z

PTAL @shenli
/run-all-tests

shenli

LGTM

tiancaiamao added 2 commits August 23, 2018 16:02

executor: forbid user to drop important system table

3c9d354

If a user drop some important tables by mistake, such as mysql.user, it's difficult to recover. In the worst case, the whole cluster fails to bootstrap, we should prevent that.

fix CI

a7fd95c

winkyao reviewed Aug 23, 2018

View reviewed changes

shenli reviewed Aug 23, 2018

View reviewed changes

zimulala reviewed Aug 23, 2018

View reviewed changes

tiancaiamao added 2 commits August 23, 2018 19:56

address comment

8bbeac7

Merge branch 'master' into forbit-drop-system-table

ad05169

jackysp reviewed Aug 23, 2018

View reviewed changes

shenli added component/privilege type/enhancement The issue or PR belongs to an enhancement. labels Aug 26, 2018

address comment

a9f82e6

winkyao reviewed Aug 27, 2018

View reviewed changes

tiancaiamao added the status/LGT1 Indicates that a PR has LGTM 1. label Aug 27, 2018

jackysp reviewed Aug 28, 2018

View reviewed changes

jackysp added status/LGT2 Indicates that a PR has LGTM 2. require-LGT3 Indicates that the PR requires three LGTM. and removed status/LGT1 Indicates that a PR has LGTM 1. labels Aug 28, 2018

tiancaiamao added the status/all tests passed label Aug 28, 2018

shenli reviewed Aug 29, 2018

View reviewed changes

address comment

a0a844e

Merge branch 'master' into forbit-drop-system-table

d872685

tiancaiamao force-pushed the forbit-drop-system-table branch from 8005880 to d872685 Compare August 29, 2018 14:41

update comment

27b89fd

shenli approved these changes Aug 29, 2018

View reviewed changes

shenli added status/LGT3 The PR has already had 3 LGTM. and removed status/LGT2 Indicates that a PR has LGTM 2. labels Aug 29, 2018

jackysp merged commit 55af7e1 into pingcap:master Aug 29, 2018

tiancaiamao deleted the forbit-drop-system-table branch August 29, 2018 16:10

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

executor: forbid user to drop important system table #7471

executor: forbid user to drop important system table #7471

tiancaiamao commented Aug 23, 2018 •

edited

Loading

winkyao Aug 23, 2018

tiancaiamao Aug 23, 2018

shenli Aug 23, 2018

winkyao Aug 23, 2018

tiancaiamao Aug 23, 2018

tiancaiamao Aug 23, 2018

shenli Aug 23, 2018

shenli Aug 23, 2018

zimulala Aug 23, 2018

tiancaiamao Aug 23, 2018

jackysp left a comment

tiancaiamao commented Aug 23, 2018

morgo commented Aug 24, 2018

jackysp commented Aug 24, 2018

shenli commented Aug 26, 2018

tiancaiamao commented Aug 27, 2018

winkyao left a comment

tiancaiamao commented Aug 28, 2018

jackysp left a comment

tiancaiamao commented Aug 28, 2018

tiancaiamao commented Aug 29, 2018

shenli Aug 29, 2018

shenli Aug 29, 2018

tiancaiamao commented Aug 29, 2018

shenli left a comment

executor: forbid user to drop important system table #7471

executor: forbid user to drop important system table #7471

Conversation

tiancaiamao commented Aug 23, 2018 • edited Loading

What problem does this PR solve?

What is changed and how it works?

Check List

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jackysp left a comment

Choose a reason for hiding this comment

tiancaiamao commented Aug 23, 2018

morgo commented Aug 24, 2018

jackysp commented Aug 24, 2018

shenli commented Aug 26, 2018

tiancaiamao commented Aug 27, 2018

winkyao left a comment

Choose a reason for hiding this comment

tiancaiamao commented Aug 28, 2018

jackysp left a comment

Choose a reason for hiding this comment

tiancaiamao commented Aug 28, 2018

tiancaiamao commented Aug 29, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tiancaiamao commented Aug 29, 2018

shenli left a comment

Choose a reason for hiding this comment

tiancaiamao commented Aug 23, 2018 •

edited

Loading