Root user lack rights to use tidb_mdl_view

[tangenta]

Bug Report

Please answer these questions before submitting your issue. Thanks!

1. Minimal reproduce step (Required)

mysql> select * from mysql.tidb_mdl_view;
ERROR 1356 (HY000): View 'mysql.tidb_mdl_view' references invalid table(s) or column(s) or function(s) or definer/invoker of view lack rights to use them

mysql> select host, user, select_priv, process_priv from mysql.user;
+------+------+-------------+--------------+
| host | user | select_priv | process_priv |
+------+------+-------------+--------------+
| %    | root | Y           | Y            |
+------+------+-------------+--------------+
1 row in set (0.00 sec)

2. What did you expect to see? (Required)

No error

3. What did you see instead (Required)

ERROR 1356

4. What is your TiDB version? (Required)

4b91fee

[tangenta]

The problem is that privilege check on system table mysql is failed:

tidb/pkg/planner/core/logical_plan_builder.go

Line 5464 in 2d552c0

if !pm.RequestVerificationWithUser(v.db, v.table, v.column, v.privilege, tableInfo.View.Definer) {

When I check the value of tableInfo.View.Definer, it comes to be ''@'', which is not maintained by privilege manager. It will absolutely fail the check.

Since tidb_mdl_view is created during cluster initialization, no user is suitable to be View.Definer. So there is nothing wrong with ''@''.

#48728 changed the definition of tidb_mdl_view. Previously, we joined three system tables from information_schema:

FROM information_schema.ddl_jobs,
    information_schema.cluster_tidb_trx,
    information_schema.cluster_processlist

After #48728, they become

FROM mysql.tidb_ddl_job
    mysql.tidb_mdl_info,
    information_schema.cluster_tidb_trx

RequestVerificationWithUser() skips all checks related to information_schema:

tidb/pkg/privilege/privileges/privileges.go

Lines 202 to 206 in 201f223

	// Skip check for INFORMATION_SCHEMA database.
	// See https://dev.mysql.com/doc/refman/5.7/en/information-schema.html
	if strings.EqualFold(db, "INFORMATION_SCHEMA") {
	return true
	}

When it is changed to mysql, the problem occurs.

[kennedy8312]

/type regression

[seiya-annie]

/found community