Create function misleading error for SUPER privilege and binary logging log_bin_trust_function_creators option

Description

The issue here is even with SUPER privileges, function specified as DETERMINISTIC  and binlog_format | ROW   creating store function throw an error as below, which is misleading, 

ERROR 1419 (HY000): You do not have the SUPER privilege and binary logging is enabled (you *might want to use the less safe log_bin_trust_function_creators variable)*

 

Reproducible test:  PS 8.0.32

As per MySQL doc : https://dev.mysql.com/doc/refman/8.0/en/stored-objects-security.html#stored-objects-security-definer

The following rules determine which accounts you can specify as the DEFINER attribute for a stored object:

  • If you have the SET_USER_ID privilege (or the deprecated SUPER privilege), you can specify any account as the DEFINER attribute. If the account does not exist, a warning is generated. Additionally, to set a stored object DEFINER attribute to an account that has the SYSTEM_USER privilege, you must have the SYSTEM_USER privilege.

When creating a function with SET_USER_ID privilege, it throws an error as below, 

ERROR 1419 (HY000): You do not have the SUPER privilege and binary logging is enabled (you *might want to use the less safe log_bin_trust_function_creators variable)*

 

Example:  Function ** taken from https://dev.mysql.com/doc/refman/8.0/en/stored-programs-logging.html

 

 

 

 

#Let's add SUPER privileges to user  testuser1@% even though the user already has SET_USER_ID privilege. 

 

Still getting the same error, 

  Here message error message is misleading as user has SUPER privilege but still it says "You do not have the SUPER privilege "

Also, "binary logging is enabled (you *might want to use the less safe log_bin_trust_function_creators variable)"  is confusing as the function specified as *DETERMINISTIC  and binlog_format | ROW  

As per MySQL doc ,

log_bin_trust_function_creators : This variable applies when binary logging is enabled. It controls whether stored function creators can be trusted not to create stored functions that may cause unsafe events to be written to the binary log. If set to 0 (the default), users are not permitted to create or alter stored functions unless they have the SUPER privilege in addition to the CREATE ROUTINE or ALTER ROUTINE privilege. A setting of 0 also enforces the restriction that a function must be declared with the DETERMINISTIC characteristic, or with the READS SQL DATA or NO SQL characteristic. If the variable is set to 1, MySQL does not enforce these restrictions on stored function creation. This variable also applies to trigger creation.

 

https://dev.mysql.com/doc/refman/8.0/en/stored-programs-logging.html

  • Because MySQL does not check if a function really is deterministic at creation time, the invocation of a stored function with the DETERMINISTIC keyword might carry out an action that is unsafe for statement-based logging, or invoke a function or procedure containing unsafe statements. If this occurs when binlog_format=STATEMENT is set, a warning message is issued. If row-based or mixed binary logging is in use, no warning is issued, and the statement is replicated in row-based format.

  • To relax the preceding conditions on function creation (that you must have the SUPER privilege and that a function must be declared deterministic or to not modify data), set the global log_bin_trust_function_creators system variable to 1. By default, this variable has a value of 0, but you can change it like this:
    mysql> SET GLOBAL log_bin_trust_function_creators = 1;

Setting log_bin_trust_function_creators=1; fixes the issue, but it's not what the expected by MySQL document explains.

 

 

The issue here is even with SUPER privileges, function specified as DETERMINISTIC  and binlog_format | ROW   creating store function throw an error as below, which is misleading, 

ERROR 1419 (HY000): You do not have the SUPER privilege and binary logging is enabled (you *might want to use the less safe log_bin_trust_function_creators variable)*

 

Environment

None

AFFECTED CS IDs

CS0035699

Activity

Show:

Details

Assignee

Reporter

Needs QA

Yes

Affects versions

Priority

Smart Checklist

Created May 11, 2023 at 10:02 AM
Updated March 6, 2024 at 9:41 AM