28

there are lot of recommendations over the Internet on how to enable SUPER privileges in case if someone hit the following error:

"ERROR 1419 (HY000): You do not have the SUPER Privilege and Binary Logging is Enabled"

But I wasn't be able to find WHY MySQL disables these privileges when binary logging option is on.

Are there some issues with replication if I use e.g. triggers which modify DB or something else? Whether it's safe and, if no, what kind of issues and under which circumstances I can hit if I will return SUPER privileges back? I think there should be some rationale behind this restriction but don't understand which one.

Does anybody have an answer on this?

Thank you.

1

4 Answers 4

40

Here is some detailed explaination I had found in documentation. Hopefully this could help you to understand.

The CREATE FUNCTION and INSERT statements are written to the binary log, so the slave will execute them. Because the slave SQL thread has full privileges, it will execute the dangerous statement. Thus, the function invocation has different effects on the master and slave and is not replication-safe.

To guard against this danger for servers that have binary logging enabled, stored function creators must have the SUPER privilege, in addition to the usual CREATE ROUTINE privilege that is required. Similarly, to use ALTER FUNCTION, you must have the SUPER privilege in addition to the ALTER ROUTINE privilege. Without the SUPER privilege, an error will occur:

ERROR 1419 (HY000): You do not have the SUPER privilege and
binary logging is enabled (you *might* want to use the less safe
log_bin_trust_function_creators variable)

If you do not want to require function creators to have the SUPER privilege (for example, if all users with the CREATE ROUTINE privilege on your system are experienced application developers), set the global log_bin_trust_function_creators system variable to 1. You can also set this variable by using the --log-bin-trust-function-creators=1 option when starting the server. If binary logging is not enabled, log_bin_trust_function_creators does not apply. SUPER is not required for function creation unless, as described previously, the DEFINER value in the function definition requires it.

Source: https://dev.mysql.com/doc/refman/8.0/en/stored-programs-logging.html

4
  • 2
    If I understand this correctly, the issue can arise in case if some user has no privileges over other databases and can't modify them (on master), while slave will do this unconditionally (since has all the privileges) and it can be the source of an attack. Seems this restriction isn't too relevant if MySQL cluster isn't customer facing and all data passes security checks and cleanups before inserted in the DB. Is this statement correct or no? Thank you. May 31, 2019 at 7:17
  • 2
    If I understand this correctly, ...... it can be the source of an attack. - correct Seems this restriction... or no? - If during this process any stored procedure is being called and update/insert data take place could be considered as unsafe and nondeterministic. And If a function that performs updates is nondeterministic, it is not repeatable. This can have two undesirable effects: 1) It will make a slave different from the master. 2) Restored data will be different from the original data. I've not tried this in lab. May 31, 2019 at 7:50
  • 2
    Thanks, Vikash, you helped me a lot. May 31, 2019 at 8:04
  • 1
    Glad to hear :) May 31, 2019 at 8:06
20

Hi if anybody came here to find a solution and if you are using Linux

  1. systemctl stop mysqld
  2. Add log_bin_trust_function_creators = 1 to my.cnf under /etc
  3. systemctl start mysqld
1
  • 11
    Depending on your system, you may need to put it in the /etc/mysql/mysql.conf.d/mysqld.cnf file under the [mysqld] section instead. I have mysql provided by apt package mysql-server and putting this line in my.cnf did not work for me. Possibly because the my.cnf file by default only includes other config file and is missing the mysqld section on its own. Dec 3, 2021 at 10:03
2

Is you are using AWS RDS, such as MariaDB.

Set a Parameter Groups a name and description, using those Familly (MariaDB)

And set the Parameter Value "log_bin_trust_function_creators" to 1.

Save and Reboot the instance RDS.

2
  • More details and a few lines of code might make your answer more understandable. :)
    – rfellons
    Aug 22 at 10:49
  • 1
    AWS Console -> RDS -> Parameter Groups -> Create New Parameter Group, Select new parameter group -> Edit. Then in group Edit, Filter parameters by log_bin_trust_function_creators and set it to 1, Navigate to database instances -> Modify instance -> Database options: DB parameter group -> change to new group -> Continue, Apply changes
    – Oliver
    Aug 31 at 6:56
1

Building on Bawantha's answer and Adam Ježek's comment, a clean way to fix the problem is to create a file named 60-trust-function-creators.cnf with

# Fix 'ERROR 1419 (HY000): You do not have the SUPER privilege and binary logging is enabled'

[mysqld]
log_bin_trust_function_creators = 1

Depending on your system, this file would go under /etc/mysql/mysql.conf.d/, /etc/mysql/mariadb.conf.d/, or something similar.

The file doesn't have to be that specific name. It can be XX-whatever-your-want.cnf, where 50 < XX < 100.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.