Can I allow a user to CREATE TABLEs, but not CREATE DATABASEs?

--

Dennis K.

Dennis K. wrote:
> Can I allow a user to CREATE TABLEs, but not CREATE DATABASEs?

Apparently not, according to the following excerpt:

"The CREATE and DROP privileges allow you to create new databases and
tables, or to drop (remove) existing databases and tables."
(http://dev.mysql.com/doc/refman/5.0/...-provided.html)

There does not seem to be a distinct SQL privilege for create table
versus create database.

You probably can't enforce it with filesystem-level permissions either,
since the uid of the mysqld process must have write permission to the
data directory.

I don't know any other solution to this requirement.

Regards,
Bill K.

In article <efos7d014c5@enews4.newsguy.com>, Bill Karwin says...
> Dennis K. wrote:
> > Can I allow a user to CREATE TABLEs, but not CREATE DATABASEs?
>
> Apparently not, according to the following excerpt:
>
> "The CREATE and DROP privileges allow you to create new databases and
> tables, or to drop (remove) existing databases and tables."
> (http://dev.mysql.com/doc/refman/5.0/...-provided.html)
>
> There does not seem to be a distinct SQL privilege for create table
> versus create database.
>
> You probably can't enforce it with filesystem-level permissions either,
> since the uid of the mysqld process must have write permission to the
> data directory.
>
> I don't know any other solution to this requirement.

Well, a create permission on a single database would obviously only
allow table creation. But I don't think that's what the OP is looking
for.
--
PleegWat
Remove caps to reply

On Sun, 1 Oct 2006 19:31:23 +0200, PleegWat
<pleegwat@PLEEGWAT.leegwater-68.demon.nl.INVALID> wrote:

>In article <efos7d014c5@enews4.newsguy.com>, Bill Karwin says...
>> Dennis K. wrote:
>> > Can I allow a user to CREATE TABLEs, but not CREATE DATABASEs?
>>
>> Apparently not, according to the following excerpt:
>>
>> "The CREATE and DROP privileges allow you to create new databases and
>> tables, or to drop (remove) existing databases and tables."
>> (http://dev.mysql.com/doc/refman/5.0/...-provided.html)
>>
>> There does not seem to be a distinct SQL privilege for create table
>> versus create database.
>>
>> You probably can't enforce it with filesystem-level permissions either,
>> since the uid of the mysqld process must have write permission to the
>> data directory.
>>
>> I don't know any other solution to this requirement.
>
>Well, a create permission on a single database would obviously only
>allow table creation. But I don't think that's what the OP is looking
>for.

When I go into phpMyAdmin on my ISP the home page says "Create new
database: No Privileges", and I am restricted to only creating tables in
the database that my ISP set up for me. I was just wondering how they
did this.

Maybe I should look at the phpMyAdmin code. I was hoping there was a
simple answer.

--

Dennis K.

Dennis K. wrote:
> On Sun, 1 Oct 2006 19:31:23 +0200, PleegWat
> <pleegwat@PLEEGWAT.leegwater-68.demon.nl.INVALID> wrote:
>
>
>>In article <efos7d014c5@enews4.newsguy.com>, Bill Karwin says...
>>
>>>Dennis K. wrote:
>>>
>>>>Can I allow a user to CREATE TABLEs, but not CREATE DATABASEs?
>>>
>>>Apparently not, according to the following excerpt:
>>>
>>>"The CREATE and DROP privileges allow you to create new databases and
>>>tables, or to drop (remove) existing databases and tables."
>>>(http://dev.mysql.com/doc/refman/5.0/...-provided.html)
>>>
>>>There does not seem to be a distinct SQL privilege for create table
>>>versus create database.
>>>
>>>You probably can't enforce it with filesystem-level permissions either,
>>>since the uid of the mysqld process must have write permission to the
>>>data directory.
>>>
>>>I don't know any other solution to this requirement.
>>
>>Well, a create permission on a single database would obviously only
>>allow table creation. But I don't think that's what the OP is looking
>>for.
>
>
> When I go into phpMyAdmin on my ISP the home page says "Create new
> database: No Privileges", and I am restricted to only creating tables in
> the database that my ISP set up for me. I was just wondering how they
> did this.
>
> Maybe I should look at the phpMyAdmin code. I was hoping there was a
> simple answer.
>

Remove the CREATE privilege from the user, and only allow CREATE
privilege within the database(s).

--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

On Sun, 01 Oct 2006 15:38:01 -0400, Jerry Stuckle
<jstucklex@attglobal.net> wrote:

>Dennis K. wrote:
>> On Sun, 1 Oct 2006 19:31:23 +0200, PleegWat
>> <pleegwat@PLEEGWAT.leegwater-68.demon.nl.INVALID> wrote:
>>
>>
>>>In article <efos7d014c5@enews4.newsguy.com>, Bill Karwin says...
>>>
>>>>Dennis K. wrote:
>>>>
>>>>>Can I allow a user to CREATE TABLEs, but not CREATE DATABASEs?
>>>>
>>>>Apparently not, according to the following excerpt:
>>>>
>>>>"The CREATE and DROP privileges allow you to create new databases and
>>>>tables, or to drop (remove) existing databases and tables."
>>>>(http://dev.mysql.com/doc/refman/5.0/...-provided.html)
>>>>
>>>>There does not seem to be a distinct SQL privilege for create table
>>>>versus create database.
>>>>
>>>>You probably can't enforce it with filesystem-level permissions either,
>>>>since the uid of the mysqld process must have write permission to the
>>>>data directory.
>>>>
>>>>I don't know any other solution to this requirement.
>>>
>>>Well, a create permission on a single database would obviously only
>>>allow table creation. But I don't think that's what the OP is looking
>>>for.
>>
>>
>> When I go into phpMyAdmin on my ISP the home page says "Create new
>> database: No Privileges", and I am restricted to only creating tables in
>> the database that my ISP set up for me. I was just wondering how they
>> did this.
>>
>> Maybe I should look at the phpMyAdmin code. I was hoping there was a
>> simple answer.
>>
>
>Remove the CREATE privilege from the user, and only allow CREATE
>privilege within the database(s).

That seems to be what their doing. No global privileges ... just
privileges within that one db.

Thanks,

--

Dennis K.