xuelong
3dd5731751
- move the relational data center to MySQL and a standalone workbench\n- add Interface Center API credentials, policies, logs, and DBeaver SSH guidance\n- harden authentication and deployment while retiring unused management surfaces
15 lines
1017 B
Bash
Executable File
15 lines
1017 B
Bash
Executable File
#!/bin/sh
|
|
set -eu
|
|
|
|
# The database code is the physical MySQL database name, so project databases
|
|
# do not share a technical prefix. Grant the non-administrative DDL/DML set
|
|
# globally, then use MySQL partial revokes to exclude the mutable mysql schema
|
|
# and sys views. information_schema and performance_schema are server-managed
|
|
# read-only schemas, and the SQL console also blocks every system schema. The
|
|
# dedicated platform_control database remains available to the service.
|
|
mysql --protocol=socket -uroot -p"${MYSQL_ROOT_PASSWORD}" -e \
|
|
"GRANT CREATE, DROP, ALTER, INDEX, REFERENCES, SELECT, INSERT, UPDATE, DELETE, CREATE VIEW, SHOW VIEW, TRIGGER ON *.* TO '${MYSQL_USER}'@'%';
|
|
REVOKE CREATE, DROP, ALTER, INDEX, REFERENCES, SELECT, INSERT, UPDATE, DELETE, CREATE VIEW, SHOW VIEW, TRIGGER ON \`mysql\`.* FROM '${MYSQL_USER}'@'%';
|
|
REVOKE CREATE, DROP, ALTER, INDEX, REFERENCES, SELECT, INSERT, UPDATE, DELETE, CREATE VIEW, SHOW VIEW, TRIGGER ON \`sys\`.* FROM '${MYSQL_USER}'@'%';
|
|
FLUSH PRIVILEGES;"
|