MySQL 授权系统对存储例程的处理如下:The MySQL grant system takes stored routines into account as follows:
创建存储例程需要
CREATE ROUTINE权限。TheCREATE ROUTINEprivilege is needed to create stored routines.修改或删除存储例程需要
ALTER ROUTINE权限。如果需要,这个权限会自动授予例程的创建者,当例程被删除时,这个权限也会从创建者那里撤销。TheALTER ROUTINEprivilege is needed to alter or drop stored routines. This privilege is granted automatically to the creator of a routine if necessary, and dropped from the creator when the routine is dropped.执行存储例程需要
EXECUTE权限。然而,如果需要,这个权限会自动授予例程的创建者(当例程被删除时,该权限也会从创建者处撤销)。此外,例程的默认SQL SECURITY特性是DEFINER,这使得有权访问与该例程相关的数据库的用户能够执行该例程。TheEXECUTEprivilege is required to execute stored routines. However, this privilege is granted automatically to the creator of a routine if necessary (and dropped from the creator when the routine is dropped). Also, the defaultSQL SECURITYcharacteristic for a routine isDEFINER, which enables users who have access to the database with which the routine is associated to execute the routine.如果
automatic_sp_privileges系统变量为 0,则EXECUTE和ALTER ROUTINE权限不会自动授予给例程创建者,也不会自动从其移除。If theautomatic_sp_privilegessystem variable is 0, theEXECUTEandALTER ROUTINEprivileges are not automatically granted to and dropped from the routine creator.例程的创建者是用于执行
CREATE语句的账户。这可能与例程定义中作为DEFINER指定的账户不同。The creator of a routine is the account used to execute theCREATEstatement for it. This might not be the same as the account named as theDEFINERin the routine definition.被指定为例程
DEFINER的帐户可以查看所有例程属性,包括其定义。因此,该帐户可以完全访问例程输出,包括通过以下方式生成的输出:The account named as a routineDEFINERcan see all routine properties, including its definition. The account thus has full access to the routine output as produced by:信息模式中的
ROUTINES表的内容。The contents of the Information SchemaROUTINEStable.SHOW CREATE FUNCTION和SHOW CREATE PROCEDURE语句。TheSHOW CREATE FUNCTIONandSHOW CREATE PROCEDUREstatements.SHOW FUNCTION CODE和SHOW PROCEDURE CODE语句。TheSHOW FUNCTION CODEandSHOW PROCEDURE CODEstatements.SHOW FUNCTION STATUS和SHOW PROCEDURE STATUS语句。TheSHOW FUNCTION STATUSandSHOW PROCEDURE STATUSstatements.
对于非例程
DEFINER的帐户,访问例程属性取决于授予该帐户的权限:For an account other than the account named as the routineDEFINER, access to routine properties depends on the privileges granted to the account:拥有
SHOW_ROUTINE权限或全局SELECT权限,账户可以查看所有例程属性,包括其定义。With theSHOW_ROUTINEprivilege or the globalSELECTprivilege, the account can see all routine properties, including its definition.在包含该例程的范围内被授予
CREATE ROUTINE、ALTER ROUTINE或EXECUTE权限时,账户可以查看除定义之外的所有例程属性。With theCREATE ROUTINE,ALTER ROUTINEorEXECUTEprivilege granted at a scope that includes the routine, the account can see all routine properties except its definition.