這個(gè)問(wèn)題是微信群中網(wǎng)友關(guān)于MySQL權(quán)限的討論，有這么一個(gè)業(yè)務(wù)需求（下面是他的原話(huà)）：

因?yàn)镸ySQL的很多功能都依賴(lài)主鍵，我想用zabbix用戶(hù)，來(lái)監(jiān)控業(yè)務(wù)數(shù)據(jù)庫(kù)的所有表，是否都建立了主鍵。

監(jiān)控的語(yǔ)句是：

FROM  information_schema.tables t1 
    LEFT OUTER JOIN information_schema.table_constraints t2 
          ON t1.table_schema = t2.table_schema 
            AND t1.table_name = t2.table_name 
            AND t2.constraint_name IN ( 'PRIMARY' ) 
WHERE t2.table_name IS NULL 
    AND t1.table_schema NOT IN ( 'information_schema', 'myawr', 'mysql', 
                  'performance_schema', 
                  'slowlog', 'sys', 'test' ) 
    AND t1.table_type = 'BASE TABLE' 

但是我不希望zabbix用戶(hù)，能讀取業(yè)務(wù)庫(kù)的數(shù)據(jù)。一旦不給zabbix用戶(hù)讀取業(yè)務(wù)庫(kù)數(shù)據(jù)的權(quán)限，那么information_schema.TABLES 和 information_schema.TABLE_CONSTRAINTS 就不包含業(yè)務(wù)庫(kù)的表信息了，也就統(tǒng)計(jì)不出來(lái)業(yè)務(wù)庫(kù)的表是否有建主鍵。有沒(méi)有什么辦法，即讓zabbix不能讀取業(yè)務(wù)庫(kù)數(shù)據(jù)，又能監(jiān)控是否業(yè)務(wù)庫(kù)的表沒(méi)有建立主鍵？

首先，我們要知道一個(gè)事實(shí)：information_schema下的視圖沒(méi)法授權(quán)給某個(gè)用戶(hù)。如下所示

mysql> GRANT SELECT ON information_schema.TABLES TO test@'%';
ERROR 1044 (42000): Access denied for user 'root'@'localhost' to database 'information_schema'

關(guān)于這個(gè)問(wèn)題，可以參考mos上這篇文章：Why Setting Privileges on INFORMATION_SCHEMA does not Work (文檔 ID 1941558.1)

APPLIES TO:

MySQL Server - Version 5.6 and later

Information in this document applies to any platform.

GOAL

To determine how MySQL privileges work for INFORMATION_SCHEMA.

SOLUTION

A simple GRANT statement would be something like:

mysql> grant select,execute on information_schema.* to 'dbadm'@'localhost';

ERROR 1044 (42000): Access denied for user 'root'@'localhost' to database 'information_schema'

The error indicates that the super user does not have the privileges to change the information_schema access privileges.

Which seems to go against what is normally the case for the root account which has SUPER privileges.

The reason for this error is that the information_schema database is actually a virtual database that is built when the service is started.

It is made up of tables and views designed to keep track of the server meta-data, that is, details of all the tables, procedures etc. in the database server.

So looking specifically at the above command, there is an attempt to add SELECT and EXECUTE privileges to this specialised database.

The SELECT option is not required however, because all users have the ability to read the tables in the information_schema database, so this is redundant.

The EXECUTE option does not make sense, because you are not allowed to create procedures in this special database.

There is also no capability to modify the tables in terms of INSERT, UPDATE, DELETE etc., so privileges are hard coded instead of managed per user.

那么怎么解決這個(gè)授權(quán)問(wèn)題呢？ 直接授權(quán)不行，那么我們只能繞過(guò)這個(gè)問(wèn)題，間接實(shí)現(xiàn)授權(quán)。思路如下：首先創(chuàng)建一個(gè)存儲(chǔ)過(guò)程（用戶(hù)數(shù)據(jù)庫(kù)），此存儲(chǔ)過(guò)程找出沒(méi)有主鍵的表的數(shù)量，然后將其授予test用戶(hù)。

DELIMITER //
CREATE DEFINER=`root`@`localhost` PROCEDURE `moitor_without_primarykey`()
BEGIN
   SELECT COUNT(*) 
FROM  information_schema.tables t1 
    LEFT OUTER JOIN information_schema.table_constraints t2 
          ON t1.table_schema = t2.table_schema 
            AND t1.table_name = t2.table_name 
            AND t2.constraint_name IN ( 'PRIMARY' ) 
WHERE t2.table_name IS NULL 
    AND t1.table_schema NOT IN ( 'information_schema', 'myawr', 'mysql', 
                  'performance_schema', 
                  'slowlog', 'sys', 'test' ) 
    AND t1.table_type = 'BASE TABLE';
END //
DELIMITER ;
 
 
mysql> GRANT EXECUTE ON PROCEDURE moitor_without_primarykey TO 'test'@'%';
Query OK, 0 rows affected (0.02 sec)

此時(shí)test就能間接的去查詢(xún)information_schema下的對(duì)象了。

mysql> select current_user();
+----------------+
| current_user() |
+----------------+
| test@%     |
+----------------+
1 row in set (0.00 sec)
 
mysql> call moitor_without_primarykey;
+----------+
| COUNT(*) |
+----------+
|    6 |
+----------+
1 row in set (0.02 sec)
 
Query OK, 0 rows affected (0.02 sec)

查看test用戶(hù)的權(quán)限。

mysql> show grants for test@'%';
+-------------------------------------------------------------------------------+
| Grants for test@%                               |
+-------------------------------------------------------------------------------+
| GRANT USAGE ON *.* TO `test`@`%`                       |
| GRANT EXECUTE ON PROCEDURE `zabbix`.`moitor_without_primarykey` TO `test`@`%` |
+-------------------------------------------------------------------------------+
2 rows in set (0.00 sec)

到此這篇關(guān)于關(guān)于MySQL繞過(guò)授予information_schema中對(duì)象時(shí)報(bào)ERROR 1044（4200）錯(cuò)誤的文章就介紹到這了,更多相關(guān)mysql ERROR 1044（4200）內(nèi)容請(qǐng)搜索腳本之家以前的文章或繼續(xù)瀏覽下面的相關(guān)文章希望大家以后多多支持腳本之家！

最新評(píng)論