skills.rest
mariadb-corporation
mariadb-corporationOFFICIAL
Explore all skills by this author →
WebsiteGitHub

mariadb-grant

Guides writing and reviewing MariaDB GRANT statements covering privileges, roles, proxy grants, and TLS options.

28|115|Updated Jan 28, 2025
Search Tags:#SQL#access control#database security#roles#grant#mariadb#privileges
One-click install
npx skills add https://github.com/mariadb-corporation/mariadb-docs --skill mariadb-grant-mariadb-corporation
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: mariadb-grant
Source: https://github.com/mariadb-corporation/mariadb-docs/tree/main/agent-skills/granular/statements/mariadb-grant
Command: npx skills add https://github.com/mariadb-corporation/mariadb-docs --skill mariadb-grant-mariadb-corporation

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? LLMs frequently generate GRANT statements based on generic or MySQL-centric assumptions that break on MariaDB: implicit account creation rules, the renamed BINLOG MONITOR privilege, the SUPER privilege split, single-active-role semantics, and MariaDB-only privileges like DELETE HISTORY and READ_ONLY ADMIN. This Skill supplies the MariaDB-specific delta so generated privilege and role designs are correct. ## Core Features & Use Cases - Privilege catalog corrections: Documents MariaDB-only privileges (BINLOG MONITOR, DELETE HISTORY, SET USER, FEDERATED ADMIN, READ_ONLY ADMIN) and the SUPER privilege split so narrow privileges replace blanket SUPER grants. - Account creation and scope rules: Explains implicit user creation via GRANT with IDENTIFIED BY, the default NO_AUTO_CREATE_USER sql_mode, privilege scope levels (global, database, table, column, routine), and most-specific-pattern wildcard resolution. - Roles, proxy, and limits: Covers GRANT role TO user/role with WITH ADMIN OPTION, SET ROLE single-active-role semantics, GRANT PROXY requirements, resource limits, and REQUIRE TLS options. - Use Case: When asked to grant binlog monitoring access, the agent writes GRANT BINLOG MONITOR ON . instead of the legacy REPLICATION CLIENT alias, and avoids granting SUPER for tasks covered by narrower privileges. ## Quick Start Ask the AI to write or review a MariaDB GRANT statement, for example granting read-only access plus binlog monitoring to a new reporting user on MariaDB 11.8.

Frequently Asked Questions about mariadb-grant

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I grant privileges to a user in MariaDB?▼

Use GRANT priv ON scope TO 'user'@'host', choosing a scope like *.*, db.*, db.table, or FUNCTION/PROCEDURE. In MariaDB, adding IDENTIFIED BY implicitly creates the account if it does not exist, but without authentication info the default NO_AUTO_CREATE_USER sql_mode makes the statement error.

How do MariaDB roles work with GRANT?▼

Grant privileges to a role with ordinary GRANT statements, then assign it via GRANT role TO user, optionally WITH ADMIN OPTION. The role's privileges only apply after the user runs SET ROLE, and MariaDB allows only one active role per session.

Does MariaDB GRANT automatically create users?▼

Yes, GRANT ... TO newuser IDENTIFIED BY 'pw' implicitly creates the account when authentication info is supplied. However, the NO_AUTO_CREATE_USER sql_mode is on by default, so GRANT without IDENTIFIED BY or VIA errors instead of creating a passwordless account.

What privileges replace SUPER in MariaDB?▼

Since 10.5.2, SUPER was split into narrower privileges: SET USER, FEDERATED ADMIN, CONNECTION ADMIN, REPLICATION SLAVE ADMIN, BINLOG ADMIN, BINLOG REPLAY, SLAVE MONITOR, BINLOG MONITOR, and REPLICATION MASTER ADMIN. READ_ONLY ADMIN was later removed from SUPER entirely, so prefer the narrow privilege over blanket SUPER.

Why does GRANT REPLICATION CLIENT still work in MariaDB?▼

REPLICATION CLIENT remains as a compatibility alias but was renamed to BINLOG MONITOR in MariaDB 10.5.2. The parser maps REPLICATION CLIENT directly to the BINLOG_MONITOR_ACL privilege, so both forms grant the same binlog-status monitoring access.

Can I grant privileges to all users at once in MariaDB?▼

Yes, since MariaDB 10.11 you can use GRANT ... TO PUBLIC to grant privileges to every account, present and future. SHOW GRANTS displays a user's PUBLIC-inherited grants, and SHOW GRANTS FOR PUBLIC isolates just the PUBLIC grants.

Related Skills

Explore More Software Engineering Skills→
Impertio-StudioImpertio-Studio
2

mariadb-core-security-model

Harden MariaDB security configurations for user management and privilege assignments.

Official
Advanced
aliyunaliyun
17

hologres-privileges

Manage Hologres privileges using PostgreSQL GRANT/REVOKE syntax.

Official
Advanced
fatihkanfatihkan
7

sc-privilege-escalation

Validate role-based access controls and admin endpoint protections for privilege escalation risks.

Community
Advanced
Impertio-StudioImpertio-Studio

postgres-core-security-model

Manage PostgreSQL role attributes, predefined roles, and default privileges.

Official
Advanced