Bug #100677 show variables like 'partial_revokes' reports incorrect output after the restart
Submitted: 28 Aug 2020 13:19 Modified: 28 Sep 2020 18:45
Reporter: Rahul Sisondia Email Updates:
Status: Closed Impact on me:
None 
Category:MySQL Server: Security: Privileges Severity:S3 (Non-critical)
Version:8.0.16 OS:Any
Assigned to: CPU Architecture:Any

[28 Aug 2020 13:19] Rahul Sisondia
Description:
According to the following functional requirement in WL#12098 : 

 FR2-14.1: --partial-revokes system variable must be turned ON automatically
              with appropriate warning in the log if there exists at least
              one restriction_list in the user_attributes column.
 

That means if there exists at least one restriction and, during server restart we set the 'partial_revokes' variable OFF. The following should always show the output as ON since there exists a partial revokes but it shows the output as OFF.

show variables like 'partial_revokes';

How to repeat:
SET @@global.partial_revokes = ON;
CREATE USER foo;
GRANT INSERT ON *.* to foo;
REVOKE INSERT ON mysql.* FROM foo;
--echo # After server restart @@partial_revokes must be turned ON
--echo # with a warning in server log.
--echo
--echo # Restart server.
--exec echo "wait" > $MYSQLTEST_VARDIR/tmp/mysqld.1.expect
--shutdown_server
--source include/wait_until_disconnected.inc
# Remove the server log file so that we find the expected warning only once.
perl;
my $filetodelete = "$ENV{'MYSQLTEST_VARDIR'}/log/mysqld.1.err";
while (-e $filetodelete) {
  unlink $filetodelete;
  sleep 1;
}
EOF
--exec echo "restart:--partial_revokes=OFF" > $MYSQLTEST_VARDIR/tmp/mysqld.1.expect
--enable_reconnect
--source include/wait_until_connected_again.inc
--let $assert_file=$MYSQLTEST_VARDIR/log/mysqld.1.err
--let $assert_select=.* \[Warning\] \[[^]]*\] \[[^]]*\] At least one partial revoke .* Turning ON the system variable .*
--let $assert_text= Found the expected warning line in the server log.
--let $assert_count=1
--source include/assert_grep.inc
SHOW GRANTS FOR foo;
SHOW VARIABLES LIKE 'partial_revokes';      <--------------must be ON------------
DROP USER foo;

Suggested fix:
if there exists at least one restriction in the server the variable must always show the value as ON.
[28 Sep 2020 18:45] Paul DuBois
Posted by developer:
 
Fixed in 8.0.23.

SHOW VARIABLES could report an incorrect value for the
partial_revokes system variable.