Discretionary Acess Control

Outline

User management

  • Creating a new user
      CREATE USER jamesb IDENTIFIED BY 'mi6';
  • Dropping a user
      DROP USER jamesb;
  • Altering a user
      ALTER USER jamesb IDENTIFIED BY 'cia';
  • Listing the users
       SELECT USER FROM mysql.user;
      +-----------+
      | user      |
      +-----------+
      | csit115   |
      | mysql.sys |
      | root      |
      +-----------+
      
In HTML view press 'p' to see the lecture notes
TOP         Created by Janusz R. Getta, CSIT115 Data Management and Security, Autumn 2023

Discretionary Acess Control

Outline

Database management

  • Creating a new database
      	      
      CREATE DATABASE university;
  • Dropping a database
      	      
      DROP DATABASE university;
  • Accessing a database
      
      use university;
      SELECT * FROM COURSE;
      
      SELECT * FROM university.COURSE;
In HTML view press 'p' to see the lecture notes
TOP         Created by Janusz R. Getta, CSIT115 Data Management and Security, Autumn 2023

Database management

  • Listing all databases
       
      show databases;
      
      +--------------------+
      | Database           |
      +--------------------+
      | information_schema |
      | csit115            |
      | mysql              |
      | ...                |
      +--------------------+
In HTML view press 'p' to see the lecture notes
TOP         Created by Janusz R. Getta, CSIT115 Data Management and Security, Autumn 2023

Discretionary Acess Control

Outline

Privileges

  • A privilege is a right to perform an operation on a database or to access in a read or write mode a data object stored in a database
  • MySQL distinguish the following groups of privileges
    • Administrative (global) privileges enable the users to manage operation of the MySQL server
    • Administrative privileges are global because they are not specific to a particular database
    •  
      SHOW DATABASES, SHUTDOWN, PROCESS, CREATE USER, …
In HTML view press 'p' to see the lecture notes
TOP         Created by Janusz R. Getta, CSIT115 Data Management and Security, Autumn 2023

Privileges

  • MySQL distinguishes the following groups of privileges
    • Database privileges apply to a database and to all objects within it
    • Database privileges can be granted for the specific databases, or globally, so that they apply to all databases
    •  
      CREATE, ALTER, DROP, SELECT, UPDATE, INSERT …
In HTML view press 'p' to see the lecture notes
TOP         Created by Janusz R. Getta, CSIT115 Data Management and Security, Autumn 2023

Privileges

  • MySQL distinguish the following groups of privileges
    • Table privileges apply to a relational table and its columns
    • Table privileges can be granted for the specific relational tables, or globally so that they apply to all tables in a given database
    •  
      CREATE, ALTER, DROP, SELECT, UPDATE, INSERT …
  • A special privilege named USAGE is a synonym for no privileges granted to a user
  • Information about user account privileges is stored in the user, db, tables_priv, columns_priv, and procs_priv tables in the mysql database
  • To list all privileges we use a statement
       
      show privileges;
In HTML view press 'p' to see the lecture notes
TOP         Created by Janusz R. Getta, CSIT115 Data Management and Security, Autumn 2023

Privileges

  • MySQL distinguish the following groups of privileges
    • Column privileges apply to the columns in relational tables
    • Column privilege must be followed by the column or columns, enclosed within parentheses
    •  
      INSERT, REFERENCES, SELECT, UPDATE
  • Column privileges are stored in mysql.columns_priv table
In HTML view press 'p' to see the lecture notes
TOP         Created by Janusz R. Getta, CSIT115 Data Management and Security, Autumn 2023

Privileges

  • SQL statements GRANT and REVOKE can be used to assign/revoke the privileges to/from the database users
       
      GRANT privilege-type ON privilege-level TO  user[WITH GRANT OPTION];
       
      REVOKE privilege-type ON privilege-level FROM user;
      
      REVOKE ALL PRIVILEGES FROM user;
      
      REVOKE GRANT OPTION FROM user;
  • Available privilege-types
      
      ALL,ALTER,ALTER ROUTINE,CREATE,CREATE ROUTINE,CREATE TABLESPACE,
      CREATE TEMPORARY TABLES,CREATE USER,CREATE VIEW,DELETE,DROP,EVENT,EXECUTE,
      FILE,GRANT OPTION,INDEX,INSERT,LOCK TABLES,PROCESS,PROXY,REFERENCES,RELOAD,
      REPLICATION CLIENT,REPLICATION SLAVE,SELECT,SHOW DATABASES,SHOW VIEW,
      SHUTDOWN,SUPER,TRIGGER,UPDATE,USAGE
In HTML view press 'p' to see the lecture notes
TOP         Created by Janusz R. Getta, CSIT115 Data Management and Security, Autumn 2023

Privileges

  • The following privilege-levels are available: global privileges, database privileges, table privileges, column privileges
  • Global privileges are administrative privileges or apply to all databases on a given server
  • Global privileges are denoted by *.*
       
      GRANT SELECT ON *.* TO James;
       
      GRANT ALL ON *.* TO Harry;
       
      GRANT USAGE ON *.* TO Robin;
       
      GRANT CREATE USER ON *.* TO James;
       
      GRANT SHOW DATABASES ON *.* TO James;
In HTML view press 'p' to see the lecture notes
TOP         Created by Janusz R. Getta, CSIT115 Data Management and Security, Autumn 2023

Privileges

  • The following privileges can be granted only globally
      CREATE TABLESPACE,CREATE USER,FILE,PROCESS,RELOAD,
      REPLICATION CLIENT,REPLICATION SLAVE,SHOW DATABASES,SHUTDOWN,SUPER
  • Global privileges are stored in mysql.user table or in information_schema.user_privileges table
In HTML view press 'p' to see the lecture notes
TOP         Created by Janusz R. Getta, CSIT115 Data Management and Security, Autumn 2023

Privileges

  • The following privilege-levels are available: global privileges, database privileges, table privileges, column privileges
  • Database privileges are privileges that apply to all objects in a given database
  • Database privileges are denoted by database-name.*
       
      GRANT SELECT ON csit115.* TO James;
       
      GRANT ALL ON university.* TO Harry;
       
      GRANT INSERT, UPDATE, DELETE on csit115.* TO Robin;
       
      GRANT GRANT OPTION on csit115.* TO Robin;
In HTML view press 'p' to see the lecture notes
TOP         Created by Janusz R. Getta, CSIT115 Data Management and Security, Autumn 2023

Privileges

  • The following privileges are allowed at a database level
       
      CREATE,DROP,EVENT,GRANT OPTION,LOCK TABLES,REFERENCES
  • Database privileges are stored in mysql.db table or in information_schema.schema_privileges table
In HTML view press 'p' to see the lecture notes
TOP         Created by Janusz R. Getta, CSIT115 Data Management and Security, Autumn 2023

Privileges

  • The following privilege-levels are available: global privileges, database privileges, table privileges, column privileges
  • Table privileges are privileges that apply to apply to all columns in a given table
  • Table privileges are denoted by database-name.table-name
       
      GRANT SELECT ON csit115.DRIVER TO James;
       
      GRANT ALL ON university.COURSE TO Harry;
       
      GRANT INSERT, UPDATE, DELETE on csit115.ORDERS TO Robin;
       
      GRANT GRANT OPTION on csit115.DRIVER TO Robin;
In HTML view press 'p' to see the lecture notes
TOP         Created by Janusz R. Getta, CSIT115 Data Management and Security, Autumn 2023

Privileges

  • The permissible privileges at the table level are the following
       
      ALTER,CREATE VIEW,CREATE,DELETE,DROP,GRANT OPTION,INDEX,INSERT,
      REFERENCES,SELECT,SHOW VIEW,TRIGGER,UPDATE
  • Table privileges are stored in mysql.tables_priv table or in information_schema.table_privileges table
In HTML view press 'p' to see the lecture notes
TOP         Created by Janusz R. Getta, CSIT115 Data Management and Security, Autumn 2023

Privileges

  • The following privilege-levels are available: global privileges, database privileges, table privileges, column privileges
  • Column privileges are privileges that apply to apply to selected columns in a given table
  • Column privileges are denoted by
    (column-1, ... , column-n) ON database-name.table-name
       
      GRANT SELECT (LNUM) ON csit115.DRIVER TO James;
       
      
      GRANT INSERT (sname, level) ON university.SKILL TO Harry;
       
      
      GRANT UPDATE(ordernum), REFERENCES (ordernum) on csit115.ORDERS TO Robin;
In HTML view press 'p' to see the lecture notes
TOP         Created by Janusz R. Getta, CSIT115 Data Management and Security, Autumn 2023

Privileges

  • The permissible privileges at the column level are the following
      INSERT,REFERENCES,SELECT,UPDATE
  • Column privileges are stored in mysql.columns_priv table or in information_schema.column_privileges table
In HTML view press 'p' to see the lecture notes
TOP         Created by Janusz R. Getta, CSIT115 Data Management and Security, Autumn 2023

Discretionary Acess Control

Outline

Roles

  • A role is a named group of privileges
  • Roles are very useful when a group of privileges must be granted to a continuously increasing group of users
  • For example, assume, that user James must be granted a read privilege on a relational table ITEM and a write privilege on a relational table ORDERS
       GRANT SELECT ON ITEM TO James;
       
      GRANT INSERT, UPDATE, DELETE ON ORDERS TO James;
  • Now, assume that the same privileges must be granted to a user Kate
  • Then, we have to repeat both GRANT statements
      GRANT SELECT ON ITEM TO Kate;
       
      GRANT INSERT, UPDATE, DELETE ON ORDERS TO Kate;
In HTML view press 'p' to see the lecture notes
TOP         Created by Janusz R. Getta, CSIT115 Data Management and Security, Autumn 2023

Roles

  • If the same privileges must be granted to another 100 users then we have to repeat GRANT statements 200 times
  • Instead, we can create a role CUSTOMER and grant it both privileges
      CREATE ROLE CUSTOMER;
      GRANT SELECT ON ITEM TO CUSTOMER;
      GRANT INSERT, UPDATE, DELETE ON ORDERS TO CUSTOMER;
  • And then grant a role CUSTOMER to James and Kate
      GRANT CUSTOMER TO James;
      GRANT CUSTOMER TO Kate;
  • Next 100 users can be granted in the same way a single role CUSTOMER
  • A concept of a role allows for simplification of discretionary access control
  • Any modification to a role CUSTOMER also affects the privileges of the users who have been granted a role CUSTOMER
In HTML view press 'p' to see the lecture notes
TOP         Created by Janusz R. Getta, CSIT115 Data Management and Security, Autumn 2023

Roles

  • A role can be granted to another role creating a hierarchy of privileges
  • For example, assume that role FREQUENT_CUSTOMER must possess all privileges of a role CUSTOMER and additionally a write privilege on a relational table DISCOUNT
           
      CREATE ROLE FREQUENT_CUSTOMER;
       	      
      GRANT INSERT, UPDATE, DELETE ON DISCOUNT TO FREQUENT_CUSTOMER;
       	      
      GRANT CUSTOMER TO FREQUENT_CUSTOMER;
  • Grant a role FREQUENT_CUSTOMER to a user Harry
           
      GRANT FREQUENT_CUSTOMER TO Harry;
  • Any modifications to a role CUSTOMER will be inherited by a role FREQUENT_CUSTOMER
In HTML view press 'p' to see the lecture notes
TOP         Created by Janusz R. Getta, CSIT115 Data Management and Security, Autumn 2023

Discretionary Acess Control

Outline

Applications

  • Immediately after installation of the system there is one user root with no password and with all privileges granted
  • A user root connects without a password and sets up a new password
      
      mysql -u root
      
      ALTER USER root IDENTIFIED BY 'root';
  • A user root creates a new user jamesb
      
      CREATE USER jamesb IDENTIFIED BY 'jamesb';
In HTML view press 'p' to see the lecture notes
TOP         Created by Janusz R. Getta, CSIT115 Data Management and Security, Autumn 2023

Applications

  • User jamesb has no privileges
      
      SELECT user, select_priv, insert_priv, update_priv, delete_priv 
      FROM mysql.user 
      WHERE user='jamesb';
      
      +--------+-------------+-------------+-------------+-------------+
      | user   | select_priv | insert_priv | update_priv | delete_priv |
      +--------+-------------+-------------+-------------+-------------+
      | jamesb | N           | N           | N           | N           |
      +--------+-------------+-------------+-------------+-------------+
In HTML view press 'p' to see the lecture notes
TOP         Created by Janusz R. Getta, CSIT115 Data Management and Security, Autumn 2023

Applications

  • A user root grants all privileges to a user jamesb on all databases without GRANT OPTION
      
      GRANT ALL ON *.* to jamesb;
  • User jamesb has all privileges but he/she cannot grant any privileges
      
      SELECT select_priv, insert_priv, update_priv, delete_priv, grant_priv 
      FROM mysql.user 
      WHERE user='jamesb';
      
      +--------+-------------+-------------+-------------+-------------+------------+
      | user   | select_priv | insert_priv | update_priv | delete_priv | grant_priv |
      +--------+-------------+-------------+-------------+-------------+------------+
      | jamesb | Y           | Y           | Y           | Y           | N          |
      +--------+-------------+-------------+-------------+-------------+------------+
In HTML view press 'p' to see the lecture notes
TOP         Created by Janusz R. Getta, CSIT115 Data Management and Security, Autumn 2023

Applications

  • A user root creates a database mi6
      
      CREATE DATABASE mi6;
  • A user jamesb connects to a database mi6 and makes it a default database
      
      mysql -u jamesb -p -v -c
      use mi6;
  • A user jamesb creates the relational tables DEPARTMENT and COURSE
  • A user jamesb has all privileges on the tables created
  • A user root has all privileges on the tables created by a user jamesb
In HTML view press 'p' to see the lecture notes
TOP         Created by Janusz R. Getta, CSIT115 Data Management and Security, Autumn 2023

Applications

  • A user root tests some privileges on the tables created by a user jamesb
      
      SELECT * FROM mi6.DEPARTMENT;
      
      DELETE FROM mi6.COURSE;
  • A user root creates a new user harryp
      
      CREATE USER harryp IDENTIFIED BY 'harryp';
  • A user root grants to a user harryp a privilege SELECT (read) on all tables in a database mi6
      
      GRANT SELECT ON mi6.* TO harryp;
In HTML view press 'p' to see the lecture notes
TOP         Created by Janusz R. Getta, CSIT115 Data Management and Security, Autumn 2023

Applications

  • A user harryp has a privilege SELECT on a database mi6
      
      SELECT user, db, select_priv, insert_priv, delete_priv, update_priv 
      FROM mysql.db
      WHERE user='harryp';
      
      +--------+-----+-------------+-------------+-------------+-------------+
      | user   | db  | select_priv | insert_priv | update_priv | delete_priv |
      +--------+-----+-------------+-------------+-------------+-------------+
      | harryp | mi6 | Y           | N           | N           | N           |
      +--------+-----+-------------+-------------+-------------+-------------+
  • A user root grants to a user harryp the privileges INSERT, UPDATE, and DELETE (write) on all tables in a database csit115
      
      GRANT INSERT, UPDATE, DELETE ON csit115.* TO harryp;
In HTML view press 'p' to see the lecture notes
TOP         Created by Janusz R. Getta, CSIT115 Data Management and Security, Autumn 2023

Applications

  • A user harryp has INSERT, UPDATE, and DELETE (write) privileges on all tables in a database csit115;
      
      SELECT user, db, select_priv, insert_priv, delete_priv, update_priv 
      FROM mysql.db 
      WHERE user='harryp';
      
      +--------+---------+-------------+-------------+-------------+-------------+
      | user   | db      | select_priv | insert_priv | update_priv | delete_priv |
      +--------+---------+-------------+-------------+-------------+-------------+
      | harryp | mi6     | Y           | N           | N           | N           |
      | harryp | csit115 | N           | Y           | Y           | Y           |
      +--------+---------+-------------+-------------+-------------+-------------+
In HTML view press 'p' to see the lecture notes
TOP         Created by Janusz R. Getta, CSIT115 Data Management and Security, Autumn 2023

Applications

  • A user root grants to a user jamesb the privileges UPDATE and DELETE on a table DEPARTMENT in a database csit115;
      
      GRANT UPDATE, DELETE ON csit115.DEPARTMENT TO jamesb;
      
      SELECT user, db, table_name, table_priv 
      FROM mysql.tables_priv 
      WHERE user='jamesb';
      
      +--------+---------+------------+---------------+
      | user   | db      | table_name | table_priv    |
      +--------+---------+------------+---------------+
      | jamesb | csit115 | DEPARTMENT | Update,Delete |
      +--------+---------+------------+---------------+
In HTML view press 'p' to see the lecture notes
TOP         Created by Janusz R. Getta, CSIT115 Data Management and Security, Autumn 2023

Applications

  • A user root grants to a user jamesb a privilege REFERENCES on a column DNAME in DEPARTMENT table in a database csit115;
      
      GRANT REFERENCES (DNAME) ON csit115.DEPARTMENT TO jamesb;
      
      SELECT user, db, table_name, column_name, column_priv 
      FROM mysql.columns_priv 
      WHERE user='jamesb';
      
      +--------+---------+------------+-------------+-------------+
      | user   | db      | table_name | column_name | column_priv |
      +--------+---------+------------+-------------+-------------+
      | jamesb | csit115 | DEPARTMENT | DNAME       | References  |
      +--------+---------+------------+-------------+-------------+
In HTML view press 'p' to see the lecture notes
TOP         Created by Janusz R. Getta, CSIT115 Data Management and Security, Autumn 2023

Applications

  • A user csit115 creates a relational view ITDEPT in a database csit115
      
      CREATE VIEW ITDEPT(DNAME, BUDGET, CHAIRMAN) 
      AS (SELECT *
          FROM DEPARTMENT
          WHERE DNAME='IT');
  • A user root grants to a user jamesb a privilege INSERT on a view ITDEPT in a database csit115;
      
      GRANT INSERT ON csit115.ITDEPT TO jamesb;
In HTML view press 'p' to see the lecture notes
TOP         Created by Janusz R. Getta, CSIT115 Data Management and Security, Autumn 2023

Applications

  • A user jamesb has a privilege INSERT on a view ITDEPT in a database csit115;
      
      SELECT user, db, table_name, table_priv 
      FROM mysql.tables_priv 
      WHERE user='jamesb';
      
      +--------+---------+------------+---------------+
      | user   | db      | table_name | table_priv    |
      +--------+---------+------------+---------------+
      | jamesb | csit115 | DEPARTMENT | Update,Delete |
      | jamesb | csit115 | ITDEPT     | Insert        |
      +--------+---------+------------+---------------+
In HTML view press 'p' to see the lecture notes
TOP         Created by Janusz R. Getta, CSIT115 Data Management and Security, Autumn 2023

References

TOP         Created by Janusz R. Getta, CSIT115 Data Management and Security, Autumn 2023