Create function misleading error for SUPER privilege and binary logging log_bin_trust_function_creators option
General
Escalation
General
Escalation
Description
Environment
None
AFFECTED CS IDs
CS0035699
Activity
Show:
Details
Details
Assignee
Unassigned
UnassignedReporter

Upstream Bug URL
Needs QA
Yes
Affects versions
Priority
Smart Checklist
Open Smart Checklist
Smart Checklist

Open Smart Checklist
Created May 11, 2023 at 10:02 AM
Updated March 6, 2024 at 9:41 AM
The issue here is even with SUPER privileges, function specified as DETERMINISTIC and binlog_format | ROW creating store function throw an error as below, which is misleading,
ERROR 1419 (HY000): You do not have the SUPER privilege and binary logging is enabled (you *might want to use the less safe log_bin_trust_function_creators variable)*
Reproducible test: PS 8.0.32
As per MySQL doc : https://dev.mysql.com/doc/refman/8.0/en/stored-objects-security.html#stored-objects-security-definer
If you have the
SET_USER_ID
privilege (or the deprecatedSUPER
privilege), you can specify any account as theDEFINER
attribute. If the account does not exist, a warning is generated. Additionally, to set a stored objectDEFINER
attribute to an account that has theSYSTEM_USER
privilege, you must have theSYSTEM_USER
privilege.When creating a function with
SET_USER_ID
privilege, it throws an error as below,ERROR 1419 (HY000): You do not have the SUPER privilege and binary logging is enabled (you *might want to use the less safe log_bin_trust_function_creators variable)*
Example: Function ** taken from https://dev.mysql.com/doc/refman/8.0/en/stored-programs-logging.html
#Let's add SUPER privileges to user
testuser1@% even though the user already has SET_USER_ID privilege.
Still getting the same error,
Here message error message is misleading as user has SUPER privilege but still it says "You do not have the SUPER privilege "
Also, "binary logging is enabled (you *might want to use the less safe log_bin_trust_function_creators variable)" is confusing as the function specified as *DETERMINISTIC and binlog_format | ROW
As per MySQL doc ,
log_bin_trust_function_creators
: This variable applies when binary logging is enabled. It controls whether stored function creators can be trusted not to create stored functions that may cause unsafe events to be written to the binary log. If set to 0 (the default), users are not permitted to create or alter stored functions unless they have theSUPER
privilege in addition to theCREATE ROUTINE
orALTER ROUTINE
privilege. A setting of 0 also enforces the restriction that a function must be declared with theDETERMINISTIC
characteristic, or with theREADS SQL DATA
orNO SQL
characteristic. If the variable is set to 1, MySQL does not enforce these restrictions on stored function creation. This variable also applies to trigger creation.https://dev.mysql.com/doc/refman/8.0/en/stored-programs-logging.html
Because MySQL does not check if a function really is deterministic at creation time, the invocation of a stored function with the
DETERMINISTIC
keyword might carry out an action that is unsafe for statement-based logging, or invoke a function or procedure containing unsafe statements. If this occurs whenbinlog_format=STATEMENT
is set, a warning message is issued. If row-based or mixed binary logging is in use, no warning is issued, and the statement is replicated in row-based format.To relax the preceding conditions on function creation (that you must have the
SUPER
privilege and that a function must be declared deterministic or to not modify data), set the globallog_bin_trust_function_creators
system variable to 1. By default, this variable has a value of 0, but you can change it like this:mysql> SET GLOBAL log_bin_trust_function_creators = 1;
Setting log_bin_trust_function_creators=1; fixes the issue, but it's not what the expected by MySQL document explains.
The issue here is even with SUPER privileges, function specified as DETERMINISTIC and binlog_format | ROW creating store function throw an error as below, which is misleading,
ERROR 1419 (HY000): You do not have the SUPER privilege and binary logging is enabled (you *might want to use the less safe log_bin_trust_function_creators variable)*