MDEV-31535: Add privilege-based fast path for SHOW DATABASES listing#5457
Open
itzanway wants to merge 1 commit into
Open
MDEV-31535: Add privilege-based fast path for SHOW DATABASES listing#5457itzanway wants to merge 1 commit into
itzanway wants to merge 1 commit into
Conversation
For users without global database-listing privileges, build the database list from in-memory ACL tables instead of scanning the data directory when grants are exact-name only. Mirror acl_get_all3()/check_grant_db() grantee handling (user, active role, PUBLIC), scope the optimization to SCHEMATA, preserve find_files() ordering, and add MTR coverage.
Contributor
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
For users without global database-listing privileges, avoid a full data-directory
scan when building the database list for
SHOW DATABASESandINFORMATION_SCHEMA.SCHEMATA.Instead of always calling
find_files()inmake_db_list(), restricted userscan now use a new helper
get_acl_databases_for_user()that builds the listfrom in-memory privilege tables (
acl_dbs,column_priv_hash).Problem
make_db_list()currently scans the entire data directory viafind_files(),even for users who only have privileges on a small, known set of databases.
This is unnecessary work or restricted users and does not scale well on
installations with many databases.
Solution
Add
get_acl_databases_for_user()insql/sql_acl.cc.mysql.dband table/column-level grants.priv_user, active role, andPUBLIC(mirrorsacl_get_all3())priv_userand active role (mirrorscheck_grant_db())sctx->host/sctx->ipfor host matching.Gate the fast path in
make_db_list()(sql/sql_show.cc) when:fill_schema_schemata()(SHOW DATABASES / SCHEMATA only)%or_wildcards)If any applicable grant contains a wildcard, decline the fast path and fall
back to the existing
find_files()scan.Preserve existing output ordering by applying the same sort used by
find_files()(Discovered_table_list::sort()/sort_desc()in debugbuilds).
On fast-path decline, restore the caller's database list to its entry size
so partial results are not duplicated by the fallback scan.