Revoke PROXY privilege on seeded user role changes - #110
Merged
Conversation
When resetting a seeded user's privileges, also revoke the PROXY grant that the admin role issues. Uses REVOKE IF EXISTS (MySQL 8.0+) for idempotency. Switches REVOKE ALL PRIVILEGES ON *.* to the explicit REVOKE ALL PRIVILEGES, GRANT OPTION FROM form. Adds a revoke step at the start of grant_admin_privs so any accumulated grants are cleared before admin privileges are re-applied. Adds integration tests covering admin-to-minimal downgrade and idempotent revoke of a non-existent PROXY grant.
cf-foundation-community-automation
Bot
moved this to Inbox
in Foundational Infrastructure Working Group
kimago
approved these changes
May 5, 2026
kimago
left a comment
kimago
left a comment
Member
There was a problem hiding this comment.
Approving:
- new integration tests fail on main, pass on branch
- new integ test "redeploys" across distinct containers -- but with the persistent disk retaining the "admin" user's config for modification, validating the privilege downgrade.
- noted removal of redundant DeferCleanup/RemoveContainer cleanup
github-project-automation
Bot
moved this from Inbox
to Pending Merge | Prioritized
in Foundational Infrastructure Working Group
github-project-automation
Bot
moved this from Pending Merge | Prioritized
to Done
in Foundational Infrastructure Working Group
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Feature or Bug Description
This change revokes the PROXY privilege from a
seeded_usersmanaged user when redeploying pxc-release and downgrading the role of a seeded user fromadminto a lesser privileged role. Previously the user would retain the adminPROXYprivilege.Additionally, adjusted the REVOKE ALL PRIVILEGES syntax to use the MySQL v8.0+ variant:
This makes is more obvious that all privileges are being revoked. This is functionality identical to the older
REVOKE ALL PRIVILEGES ON *.* FROM ...form, and merely updated for clarity.A change was also made to admin grants to revoke previous privileges before adjusting a new admin user's grant. This avoids a corner case where redeploying a less role to an admin role retained unnecessary grants (which would be covered by the admin role anyway). This aligns the admin privilege grants with other types of roles in the
seeded_usersfeature.Motivation
This addresses an observation that PROXY privilege was retained on an unprivileged after a redeploy that demoted a user that was previously deployed with
role: adminuser.None of these issues were problematic in practice. The PROXY privilege on the anonymous user without a GRANT OPTION confers no special privilege escalation. The REVOKE ALL syntax change is aesthetic. Admin users retaining less privileged per-object (e.g. database) grants were not given any additional privileges.
This change is purely around security hygiene and cleaning up the implementation.