{"action":"created","issue":{"url":"https://api.github.com/repos/cf-tm-bot/services/issues/90","repository_url":"https://api.github.com/repos/cf-tm-bot/services","labels_url":"https://api.github.com/repos/cf-tm-bot/services/issues/90/labels{/name}","comments_url":"https://api.github.com/repos/cf-tm-bot/services/issues/90/comments","events_url":"https://api.github.com/repos/cf-tm-bot/services/issues/90/events","html_url":"https://github.com/cf-tm-bot/services/issues/90","id":180717934,"number":90,"title":"Preseeded users should not be able to lock tables - Story Id: 131576399","user":{"login":"cf-tm-bot","id":20690070,"avatar_url":"https://avatars.githubusercontent.com/u/20690070?v=3","gravatar_id":"","url":"https://api.github.com/users/cf-tm-bot","html_url":"https://github.com/cf-tm-bot","followers_url":"https://api.github.com/users/cf-tm-bot/followers","following_url":"https://api.github.com/users/cf-tm-bot/following{/other_user}","gists_url":"https://api.github.com/users/cf-tm-bot/gists{/gist_id}","starred_url":"https://api.github.com/users/cf-tm-bot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cf-tm-bot/subscriptions","organizations_url":"https://api.github.com/users/cf-tm-bot/orgs","repos_url":"https://api.github.com/users/cf-tm-bot/repos","events_url":"https://api.github.com/users/cf-tm-bot/events{/privacy}","received_events_url":"https://api.github.com/users/cf-tm-bot/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/cf-tm-bot/services/labels/accepted","name":"accepted","color":"4e8200"},{"url":"https://api.github.com/repos/cf-tm-bot/services/labels/cf-mysql-release%20v32","name":"cf-mysql-release v32","color":"ededed"},{"url":"https://api.github.com/repos/cf-tm-bot/services/labels/feature","name":"feature","color":"ededed"}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2016-10-03T18:57:25Z","updated_at":"2016-10-21T22:57:16Z","closed_at":"2016-10-21T22:57:10Z","body":"In #130471563, we discovered that we can proactively deny user attempts to lock tables, which is technically unsupported by Galera.\n\nAny user that is defined in the manifest as a user for a \"seeded database\" should not be granted `lock` table privileges.\n\n___ \n#### Acceptance Criteria;\n1. I can add a user/password/db entry to the `cf_mysql.mysql.preseeded_database` property and deploy. Then if I use that user, trying to `LOCK TABLE` is rejected at the mysql level\n\n---\n\nMirrors: [story 131576399](https://www.pivotaltracker.com/story/show/131576399) submitted on Oct 3, 2016 UTC\n- **Requester**: Morgan Fine\n- **Owners**: Chris Hendrix\n- **Estimate**: 1.0"},"comment":{"url":"https://api.github.com/repos/cf-tm-bot/services/issues/comments/255484519","html_url":"https://github.com/cf-tm-bot/services/issues/90#issuecomment-255484519","issue_url":"https://api.github.com/repos/cf-tm-bot/services/issues/90","id":255484519,"user":{"login":"cf-tm-bot","id":20690070,"avatar_url":"https://avatars.githubusercontent.com/u/20690070?v=3","gravatar_id":"","url":"https://api.github.com/users/cf-tm-bot","html_url":"https://github.com/cf-tm-bot","followers_url":"https://api.github.com/users/cf-tm-bot/followers","following_url":"https://api.github.com/users/cf-tm-bot/following{/other_user}","gists_url":"https://api.github.com/users/cf-tm-bot/gists{/gist_id}","starred_url":"https://api.github.com/users/cf-tm-bot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cf-tm-bot/subscriptions","organizations_url":"https://api.github.com/users/cf-tm-bot/orgs","repos_url":"https://api.github.com/users/cf-tm-bot/repos","events_url":"https://api.github.com/users/cf-tm-bot/events{/privacy}","received_events_url":"https://api.github.com/users/cf-tm-bot/received_events","type":"User","site_admin":false},"created_at":"2016-10-21T22:57:16Z","updated_at":"2016-10-21T22:57:16Z","body":"Marco Nicosia [commented](https://www.pivotaltracker.com/n/projects/969486/stories/131576399/comments/153395517) on Oct 21, 2016, 9.16 PM UTC:\n\nI changed Primo's manifest and re-deployed:\n\n```\nproperties:\n  cf_mysql:\n    mysql:\n      seeded_databases:\n      - name: accept1\n        username: chow\n        password: hound\n```\n\nResult:\n```\n$ mysql -uchow -p\nEnter password:\n\nMariaDB [(none)]> use accept1;\nDatabase changed\nMariaDB [accept1]> create table fruit (id int, owner varchar(20));\nQuery OK, 0 rows affected (0.02 sec)\n\nMariaDB [accept1]> insert into fruit values (1, \"marco\");\nQuery OK, 1 row affected (0.00 sec)\n\nMariaDB [accept1]> LOCK TABLES fruit WRITE;\nERROR 1044 (42000): Access denied for user 'chow'@'%' to database 'accept1'\n```\n\n**Accepting.**\n\n\n<!--\nComment Id: 153395517\n-->"}}
{"actor":{"display_login":"cf-tm-bot"}}