fix: name SUPER as the only grant that lifts the trigger denial - #142
Merged
Conversation
BINLOG ADMIN does not lift error 1419 on any MariaDB version, so the grant this page recommended first leaves the reader exactly where they started. Verified on 10.11.19, 11.3.2 and 11.8.9: only SUPER or the global flag works. MySQL stopped requiring SUPER for trigger DDL in 8.0.22, so scope the section to MariaDB rather than sending MySQL 8 readers after a privilege they hold no need for. Verified on 8.0.46 and 8.4.11 with binary logging on. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Companion to rommapp/romm#4490, which adds a startup guard for this failure and links readers to this page.
The grant this page recommends does not work.
install/databases.mdofferedGRANT BINLOG ADMIN ON *.* TO 'romm-user'@'%'; -- MariaDB 10.5+as the first remedy for error 1419. That privilege leaves the denial fully in place: MariaDB's check for trigger DDL under binary logging still testsSUPERspecifically, and 10.5's finer-grained split never carved this one out.Measured on throwaway containers started with
--log-bin --log-bin-trust-function-creators=0, with a normal application user:GRANT BINLOG ADMINGRANT SUPERERROR 1419ERROR 1419ERROR 1419So the page now offers
SUPERalone.The MySQL framing was also wrong. The section said MySQL refuses trigger DDL under binary logging and singled out MySQL 8's binlog-on-by-default as a reason readers would hit this. MySQL dropped the
SUPERrequirement for trigger DDL in 8.0.22, so those readers are not affected at all:SUPERuser runningDROP TRIGGER IF EXISTSThe section is now scoped to MariaDB, with one sentence saying MySQL 8.0.22+ is not affected.
The
SET GLOBAL log_bin_trust_function_creators = 1remedy and themy.cnfguidance are unchanged; both were already correct.Verification:
mkdocs build --strictpasses. Locally I had to disable thesocialplugin for the run, since this machine has nolibcairo; that plugin is untouched by the change and CI builds it with cairo installed.AI assistance disclosure: written with Claude Code (Claude Opus 5), including the container testing above. I reviewed the result.
🤖 Generated with Claude Code