How secure to grant "reload" privileges to a normal user in MySql

deepakdeore2004 · 10-15-2010, 06:24 AM

Hi,

One user in my company wants to run some flush cache queries on a MySql database, it needs "reload" privileges of Administration,

how secure is to give this rights to a normal user ?

Thanks,
Deepak

eyerobot · 10-15-2010, 06:39 AM

I'm not an expert, But it seems to me, That this may give them the ability to use an sql injection exploit,Or some other means of causing problems, And then reload the database, Thus enabling the damage.

Steel fences may be ugly, But they do work.
Or maybe i'm paranoid.

unixfool · 10-20-2010, 08:42 AM

The reference guide states the following (for FLUSH):

Quote:

The FLUSH statement clears or reloads various internal caches used by MySQL. To execute FLUSH, you must have the RELOAD privilege.

Looks like you're going to have to give him this privilege, as there's an apparent need. Needs sometimes override security aspects, but it is smart to justify why. It is up to you to see that he justifies his need properly.

Then again, I may be overlooking something...I'm not strong in databases.

Oh, and BTW, this IS MySQL, right?