MySQL Bugs: #103559: Docu bug in Privilege Changes

Bug #103559	Docu bug in Privilege Changes
Submitted:	3 May 2021 14:40	Modified:	6 May 2021 12:07
Reporter:	Oli Sennhauser	Email Updates:
Status:	Closed	Impact on me:	None
Category:	MySQL Server: Documentation	Severity:	S3 (Non-critical)
Version:	8.0	OS:	Any (n.a.)
Assigned to:		CPU Architecture:	Any (n.a.)
Tags:	documentation, flush privileges

Description:
Documentation states here:
https://dev.mysql.com/doc/refman/8.0/en/privilege-changes.html

Global privileges and passwords are unaffected for a connected client. These changes take effect only in sessions for subsequent connections.

This contradicts my practical experiments:

How to repeat:
Application connection:

SQL> set global join_buffer_size=1024*1024;
ERROR 1227 (42000): Access denied; you need (at least one of) the SUPER or SYSTEM_VARIABLES_ADMIN privilege(s) for this operation

Then do in a root connection:

SQL> grant SYSTEM_VARIABLES_ADMIN on *.* to app;

Then in the SAME application connection:

SQL> set global join_buffer_size=1024*1024;
Query OK, 0 rows affected (0.00 sec)

Then in a root connection:

SQL> revoke SYSTEM_VARIABLES_ADMIN on *.* from app;

Then in the SAME application connection:

SQL> set global join_buffer_size=1024*1024;
ERROR 1227 (42000): Access denied; you need (at least one of) the SUPER or SYSTEM_VARIABLES_ADMIN privilege(s) for this operation

So I would say with my limited knowledge of English that the docu does not tell the reality...?

Suggested fix:
Fix the documentation. Probably global privileges and passwords are handled differently or it is a new 8.0 behaviour?

The text needs to be updated for MySQL 8.0.

If you update your example to instead GRANT SUPER to app, the change is not immediately applied.

It should read something like:

Global privileges and passwords are usually unaffected for a connected client, and will take effect only in sessions for subsequent connections. The exception to this, is that changes to dynamic privileges apply immediately.

Hello Oli,

Thank you for the report and feedback.

regards,
Umesh

Posted by developer:
 
Updated using wording similar to that suggested by Morgan.