MYSQL / Mariadb REVOKE 'SET' Privilege for session variable

user_18090926 0
Viewed 88

I've looked around a lot but haven't been able to find a way to do this. I'd like to be able to prevent (REVOKE) MySQL / Mariadb users to modify system variables for their session. Is there really no way to do this? For instance I have set the 'max_statement_time' to 300s globally but any user can go in and change it to 1000s (for their session). I'd like to know if this is preventable.

From the MySQL documentation:

"setting session runtime values normally requires no special privileges and can be done by any user to affect the current session."

Thanks.

mariadb mysql
1 Answers

Correct. If a client can connect and execute SQL queries, then they can set session variables without any specific privilege to do so.

But if you can't trust your developers this far, then you are in trouble because they can cause mischief in many other ways as well.

MySQL 8.0.14 introduces a privilege SESSION_VARIABLES_ADMIN, but this only applies to certain administrative variables for example binlog_format. Most session variables still require no privilege to set.

Reference: System Variable Privileges

I have no idea if MariaDB has any solution, because I don't use MariaDB.

Bill_Karwin_208600
Related