153

I have a mysql user, whom I want to grant all the READ permission on a db schema.

One way is this :

GRANT SELECT, SHOW_VIEW  ON test.* TO 'readuser'@'%';

Is there a way to group all read operations in grant ?

2
  • 1
    The privilege is SHOW VIEW, not SHOW_VIEW, but you don't need to grant this to a user unless you want them to be able to SHOW CREATE VIEW on the views... they can select from the views with the only the SELECT privilege. What do you mean by "group all read operations in grant"? Commented Nov 18, 2013 at 0:09
  • If there is any single privilege that stands for ALL READ operations on database. I understand that they are providing fine grained access, but a convenient high level abstraction would have helped us . Commented Nov 18, 2013 at 23:41

8 Answers 8

229

If there is any single privilege that stands for ALL READ operations on database.

It depends on how you define "all read."

"Reading" from tables and views is the SELECT privilege. If that's what you mean by "all read" then yes:

GRANT SELECT ON *.* TO 'username'@'host_or_wildcard' IDENTIFIED BY 'password';

However, it sounds like you mean an ability to "see" everything, to "look but not touch." So, here are the other kinds of reading that come to mind:

"Reading" the definition of views is the SHOW VIEW privilege.

"Reading" the list of currently-executing queries by other users is the PROCESS privilege.

"Reading" the current replication state is the REPLICATION CLIENT privilege.

Note that any or all of these might expose more information than you intend to expose, depending on the nature of the user in question.

If that's the reading you want to do, you can combine any of those (or any other of the available privileges) in a single GRANT statement.

GRANT SELECT, SHOW VIEW, PROCESS, REPLICATION CLIENT ON *.* TO ...

However, there is no single privilege that grants some subset of other privileges, which is what it sounds like you are asking.

If you are doing things manually and looking for an easier way to go about this without needing to remember the exact grant you typically make for a certain class of user, you can look up the statement to regenerate a comparable user's grants, and change it around to create a new user with similar privileges:

mysql> SHOW GRANTS FOR 'not_leet'@'localhost';
+------------------------------------------------------------------------------------------------------------------------------------+
| Grants for not_leet@localhost                                                                                                      |
+------------------------------------------------------------------------------------------------------------------------------------+
| GRANT SELECT, REPLICATION CLIENT ON *.* TO 'not_leet'@'localhost' IDENTIFIED BY PASSWORD '*xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx' |
+------------------------------------------------------------------------------------------------------------------------------------+
1 row in set (0.00 sec)

Changing 'not_leet' and 'localhost' to match the new user you want to add, along with the password, will result in a reusable GRANT statement to create a new user.

Of, if you want a single operation to set up and grant the limited set of privileges to users, and perhaps remove any unmerited privileges, that can be done by creating a stored procedure that encapsulates everything that you want to do. Within the body of the procedure, you'd build the GRANT statement with dynamic SQL and/or directly manipulate the grant tables themselves.

In this recent question on Database Administrators, the poster wanted the ability for an unprivileged user to modify other users, which of course is not something that can normally be done -- a user that can modify other users is, pretty much by definition, not an unprivileged user -- however -- stored procedures provided a good solution in that case, because they run with the security context of their DEFINER user, allowing anybody with EXECUTE privilege on the procedure to temporarily assume escalated privileges to allow them to do the specific things the procedure accomplishes.

7
  • 2
    Thanks. Apart from great answer I also liked your password. :) Commented Jan 9, 2015 at 3:22
  • 3
    Worth noting: PROCESS and REPLICATION CLIENT are "global" privilege types, so the syntax will fail when defined with a "per database" exclusion. GRANT PROCESS ON mydb.* would be invalid, but GRANT PROCESS ON *.* would be OK.
    – Bee Kay
    Commented Nov 29, 2016 at 23:21
  • GRANT SELECT ON db_name.* TO 'demo'@'%' WITH GRANT OPTION;
    – Musa
    Commented Aug 16, 2017 at 7:02
  • 1
    What about SHOW DATABASES?
    – Marinos An
    Commented Nov 25, 2020 at 16:00
  • 1
    @MarinosAn executing SHOW DATABASES is always allowed for all users; however, the only database returned is information_schema unless the user has any permissions on any other (or all other) databases, in which case those are also included in the list. Commented Nov 27, 2020 at 12:51
24

Note for MySQL 8 it's different

You need to do it in two steps:

CREATE USER 'readonly_user'@'localhost' IDENTIFIED BY 'some_strong_password';
GRANT SELECT, SHOW VIEW ON *.* TO 'readonly_user'@'localhost';
flush privileges;
1
  • 1
    This is the only solution that worked for me. It seems that the other solutions are outdated as you said. Thank you for providing this updated solution. Commented Aug 26, 2020 at 17:51
22
GRANT SELECT ON *.* TO 'user'@'localhost' IDENTIFIED BY 'password';

This will create a user with SELECT privilege for all database including Views.

0
18

Various permissions that you can grant to a user are

ALL PRIVILEGES- This would allow a MySQL user all access to a designated database (or if no database is selected, across the system)
CREATE- allows them to create new tables or databases
DROP- allows them to them to delete tables or databases
DELETE- allows them to delete rows from tables
INSERT- allows them to insert rows into tables
SELECT- allows them to use the Select command to read through databases
UPDATE- allow them to update table rows
GRANT OPTION- allows them to grant or remove other users' privileges

To provide a specific user with a permission, you can use this framework:

GRANT [type of permission] ON [database name].[table name] TO ‘[username]’@'localhost’;

I found this article very helpful

1
  • If the user is even remote access then you should replace localhost with %. So you will have: GRANT [type of permission] ON [database name].[table name] TO ‘[username]’@'%’ IDENTIFIED BY '[password]'; Commented Jan 27, 2021 at 12:02
6

Even user has got answer and @Michael - sqlbot has covered mostly points very well in his post but one point is missing, so just trying to cover it.

If you want to provide read permission to a simple user (Not admin kind of)-

GRANT SELECT, EXECUTE ON DB_NAME.* TO 'user'@'localhost' IDENTIFIED BY 'PASSWORD';

Note: EXECUTE is required here, so that user can read data if there is a stored procedure which produce a report (have few select statements).

Replace localhost with specific IP from which user will connect to DB.

Additional Read Permissions are-

  • SHOW VIEW : If you want to show view schema.
  • REPLICATION CLIENT : If user need to check replication/slave status. But need to give permission on all DB.
  • PROCESS : If user need to check running process. Will work with all DB only.
3

A step by step guide I found here.

To create a read-only database user account for MySQL

At a UNIX prompt, run the MySQL command-line program, and log in as an administrator by typing the following command:

mysql -u root -p

Type the password for the root account. At the mysql prompt, do one of the following steps:

To give the user access to the database from any host, type the following command:

grant select on database_name.* to 'read-only_user_name'@'%' identified by 'password';

If the collector will be installed on the same host as the database, type the following command:

grant select on database_name.* to 'read-only_user_name' identified by 'password';

This command gives the user read-only access to the database from the local host only. If you know the host name or IP address of the host that the collector is will be installed on, type the following command:

grant select on database_name.* to 'read-only_user_name'@'host_name or IP_address' identified by 'password';

The host name must be resolvable by DNS or by the local hosts file. At the mysql prompt, type the following command:

flush privileges;

Type quit.

The following is a list of example commands and confirmation messages:

mysql> grant select on dbname.* to 'readonlyuser'@'%' identified 
by 'pogo$23';
Query OK, 0 rows affected (0.11 sec)
mysql> flush privileges;
Query OK, 0 rows affected (0.00 sec)
mysql> quit
0

If you want the view to be read only after granting the read permission you can use the ALGORITHM = TEMPTABLE in you view DDL definition.

0

solution: here's some useful cookbook for creating a readonly user on mysql.

# 1. connect as an admin on database / cluster
mysql -u root -h  mydb.123456789012.us-east-1.rds.amazonaws.com

# 2. create user protected with strong password with global access ('%') or local access ('localhost')
mysql> CREATE USER 'ro_user'@'%' IDENTIFIED BY 'abcd1234%^&#';

# 3. grant SELECT privileges for relevant user
mysql> GRANT SELECT ON *.* TO 'ro_user'@'%' WITH GRANT OPTION;

# 4. reload grant tables on database
mysql> FLUSH PRIVILEGES;

# 5. verify grant are placed as expected
mysql> show grants for 'ro_user'@'%';

// output:
// +------------------------------------------------------+
// | Grants for ro_user@%                                   |
// +------------------------------------------------------+
// | GRANT SELECT ON *.* TO 'ro_user'@'%' WITH GRANT OPTION |
// +------------------------------------------------------+
// 1 row in set (0.00 sec)

mysql> exit

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.