mysql> show databases; +--------------------+ | Database | +--------------------+ | information_schema | | mysql | | test | +--------------------+
mysql> use mysql Database changed mysql> show tables; +---------------------------+ | Tables_in_mysql | +---------------------------+ | columns_priv | | db | | event | | func | | general_log | | help_category | | help_keyword | | help_relation | | help_topic | | host | | ndb_binlog_index | | plugin | | proc | | procs_priv | | servers | | slow_log | | tables_priv | | time_zone | | time_zone_leap_second | | time_zone_name | | time_zone_transition | | time_zone_transition_type | | user | +---------------------------+ 23 rows in set (0.00 sec)
mysql> create user allen identified by 'allen' ; Query OK, 0 rows affected (0.39 sec) <span style="font-family: 微软雅黑;"> </span>
mysql> select user,host,super_priv from user; +------+-----------------------+------------+ | user | host | super_priv | +------+-----------------------+------------+ | root | localhost | Y | | root | localhost.localdomain | Y | | root | 127.0.0.1 | Y | | | localhost | N | | | localhost.localdomain | N | | allen | % | N | +------+-----------------------+------------+ 6 rows in set (0.00 sec) mysql>
mysql> drop user allen; Query OK, 0 rows affected (0.00 sec) mysql> select user,host,super_priv from user; +------+-----------------------+------------+ | user | host | super_priv | +------+-----------------------+------------+ | root | localhost | Y | | root | localhost.localdomain | Y | | root | 127.0.0.1 | Y | | | localhost | N | | | localhost.localdomain | N | +------+-----------------------+------------+ 5 rows in set (0.00 sec)
[root@localhost ~]# mysql -u allen -p -h 172.27.35.8 Enter password: Welcome to the MySQL monitor. Commands end with ; or \g. ...... mysql> mysql> show databases; +--------------------+ | Database | +--------------------+ | information_schema | | db_users | | mysql | | test | +--------------------+ 4 rows in set (0.00 sec) mysql> usse db_users; ERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'usse db_users' at line 1发现用户allen无法使用db_users数据库，退出登陆后使用root用户给allen赋予所有权限。
mysql> grant all privileges on *.* to allen@localhost;
[root@localhost ~]# mysql -u allen -p -h 172.27.35.8 Enter password: Welcome to the MySQL monitor. Commands end with ; or \g. ...... mysql> use db_users; Reading table information for completion of table and column names You can turn off this feature to get a quicker startup with -A Database changed mysql>
[root@localhost ~]# mysql -u allen -p -h 172.27.35.8 Enter password: Welcome to the MySQL monitor. Commands end with ; or \g. ...... mysql> create user allen_test1 identified by 'allen_test'; Query OK, 0 rows affected (0.00 sec) mysql> grant select on *.* to allen_test1@localhost; ERROR 1045 (28000): Access denied for user 'allen'@'%' (using password: YES) mysql>
[root@localhost ~]# mysql -u root -p Enter password: ...... mysql> grant all privileges on *.* to allen@'%' with grant option; Query OK, 0 rows affected (0.00 sec) mysql> flush privileges; Query OK, 0 rows affected (0.00 sec) mysql> quit [root@localhost ~]# mysql -u allen -p -h 172.27.35.8 Enter password: ...... mysql> grant select on *.* to allen_test1@localhost; Query OK, 0 rows affected (0.00 sec)发现现在allen用户给allen_test授权成功。
[root@localhost ~]# mysql -u root -p Enter password: ...... mysql> grant all privileges on db_users.* to allen_test2@'%' identified by 'allen'; Query OK, 0 rows affected (0.01 sec) mysql> flush privileges; Query OK, 0 rows affected (0.00 sec) mysql> quit Bye然后使用allen_test2用户登录：
[root@localhost ~]# mysql -u allen_test2 -p -h 192.168.65.30
Enter password:
Welcome to the MySQL monitor. Commands end with ; or \g.
......
mysql> use db_users;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
Database changed
mysql> create table tb_test(name varchar(32), sex bool);
Query OK, 0 rows affected (0.06 sec)
mysql> insert into tb_test values ('allen', 1);
Query OK, 1 row affected (0.00 sec)
mysql> create database db_test;
ERROR 1044 (42000): Access denied for user 'allen_test2'@'%' to database 'db_test'
mysql> 可以看到，如果执行db_users数据库内操作是可以的，但创建一个新的数据库就会出错。说明数据库级权限已经生效 。[root@localhost ~]# mysql -uroot -p Enter password: Welcome to the MySQL monitor. Commands end with ; or \g. mysql> grant select on db_users.* to allen_test3@'%' identified by 'allen'; Query OK, 0 rows affected (0.00 sec) mysql> flush privileges; Query OK, 0 rows affected (0.00 sec) mysql> quit Bye使用用户allen_test3用户登录：
[root@localhost ~]# mysql -u allen_test3 -p -h 192.168.65.30
Enter password:
Welcome to the MySQL monitor. Commands end with ; or \g.
mysql> select * from tb_test;
+-------+------+
| name | sex |
+-------+------+
| allen | 1 |
+-------+------+
1 row in set (0.00 sec)
mysql> insert into tb_test values ('Lily', 0);
ERROR 1142 (42000): INSERT command denied to user 'allen_test3'@'192.168.65.30' for table 'tb_test'
mysql> 可见执行查询操作是可以的，但是执行插入操作出错。[root@localhost ~]# mysql -u root -p Enter password: Welcome to the MySQL monitor. Commands end with ; or \g. mysql> grant select,update(sex) on db_users.tb_test to allen_test4@'%' identified by 'allen'; Query OK, 0 rows affected (0.01 sec) mysql> flush privileges; Query OK, 0 rows affected (0.01 sec) mysql> quit Byeallen_test4用户登录验证权限授予是否成功：
[root@localhost ~]# mysql -u allen_test4 -p -h 192.168.65.26 Enter password: ...... mysql> use db_users; Reading table information for completion of table and column names You can turn off this feature to get a quicker startup with -A Database changed mysql> select * from tb_test; +-------+------+ | name | sex | +-------+------+ | allen | 1 | +-------+------+ 1 row in set (0.00 sec) mysql> update tb_test set sex=0 where name='allen'; Query OK, 1 row affected (0.01 sec) Rows matched: 1 Changed: 1 Warnings: 0 mysql> select * from tb_test; +-------+------+ | name | sex | +-------+------+ | allen | 0 | +-------+------+ 1 row in set (0.00 sec) mysql> update tb_test set name='allen_new'; ERROR 1143 (42000): UPDATE command denied to user 'allen_test4'@'192.168.65.26' for column 'name' in table 'tb_test' mysql>可以看到select权限没有问题，也可以对sex字段进行更新操作。但是更新name字段报错，因为没有授予其权限。
[root@localhost ~]# mysql -u root -p Enter password: Welcome to the MySQL monitor. Commands end with ; or \g. ...... mysql> show grants; +----------------------------------------------------------------------------------------------------------------------------------------+ | Grants for root@localhost | +----------------------------------------------------------------------------------------------------------------------------------------+ | GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' IDENTIFIED BY PASSWORD '*6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9' WITH GRANT OPTION | +----------------------------------------------------------------------------------------------------------------------------------------+ 1 row in set (0.00 sec) mysql> show grants for allen_test4; +------------------------------------------------------------------------------------------------------------+ | Grants for allen_test4@% | +------------------------------------------------------------------------------------------------------------+ | GRANT USAGE ON *.* TO 'allen_test4'@'%' IDENTIFIED BY PASSWORD '*C94FD2FCBF408CBBFAAB9C07FF4221D265AFB18F' | | GRANT SELECT, UPDATE (sex) ON `db_users`.`tb_test` TO 'allen_test4'@'%' | +------------------------------------------------------------------------------------------------------------+ 2 rows in set (0.00 sec)和grant相反的操作时使用revoke操作，revoke作用是回收或者取消权限。
mysql> show grants for allen_test2; +------------------------------------------------------------------------------------------------------------+ | Grants for allen_test2@% | +------------------------------------------------------------------------------------------------------------+ | GRANT USAGE ON *.* TO 'allen_test2'@'%' IDENTIFIED BY PASSWORD '*C94FD2FCBF408CBBFAAB9C07FF4221D265AFB18F' | | GRANT ALL PRIVILEGES ON `db_users`.* TO 'allen_test2'@'%' | +------------------------------------------------------------------------------------------------------------+ 2 rows in set (0.00 sec) mysql> revoke all privileges, grant option from allen_test2; Query OK, 0 rows affected (0.00 sec) mysql> show grants for allen_test2; +------------------------------------------------------------------------------------------------------------+ | Grants for allen_test2@% | +------------------------------------------------------------------------------------------------------------+ | GRANT USAGE ON *.* TO 'allen_test2'@'%' IDENTIFIED BY PASSWORD '*C94FD2FCBF408CBBFAAB9C07FF4221D265AFB18F' | +------------------------------------------------------------------------------------------------------------+ 1 row in set (0.01 sec) mysql>
mysql> show grants for allen_test3; +------------------------------------------------------------------------------------------------------------+ | Grants for allen_test3@% | +------------------------------------------------------------------------------------------------------------+ | GRANT USAGE ON *.* TO 'allen_test3'@'%' IDENTIFIED BY PASSWORD '*C94FD2FCBF408CBBFAAB9C07FF4221D265AFB18F' | | GRANT SELECT ON `db_users`.* TO 'allen_test3'@'%' | +------------------------------------------------------------------------------------------------------------+ 2 rows in set (0.00 sec) mysql>执行撤销后权限如下：
mysql> revoke select on db_users.* from allen_test3; Query OK, 0 rows affected (0.00 sec) mysql> show grants for allen_test3; +------------------------------------------------------------------------------------------------------------+ | Grants for allen_test3@% | +------------------------------------------------------------------------------------------------------------+ | GRANT USAGE ON *.* TO 'allen_test3'@'%' IDENTIFIED BY PASSWORD '*C94FD2FCBF408CBBFAAB9C07FF4221D265AFB18F' | +------------------------------------------------------------------------------------------------------------+ 1 row in set (0.01 sec) mysql>3.撤销某字段权限，例如allen_test4权限如下：
mysql> show grants for allen_test4; +------------------------------------------------------------------------------------------------------------+ | Grants for allen_test4@% | +------------------------------------------------------------------------------------------------------------+ | GRANT USAGE ON *.* TO 'allen_test4'@'%' IDENTIFIED BY PASSWORD '*C94FD2FCBF408CBBFAAB9C07FF4221D265AFB18F' | | GRANT SELECT, UPDATE (sex) ON `db_users`.`tb_test` TO 'allen_test4'@'%' | +------------------------------------------------------------------------------------------------------------+ 2 rows in set (0.00 sec)可见用户allen_test4拥有select和update 字段sex的权限，现在撤销update的sex字段，如下：
mysql> revoke update(sex) on db_users.tb_test from allen_test4; Query OK, 0 rows affected (0.00 sec) mysql> show grants for allen_test4; +------------------------------------------------------------------------------------------------------------+ | Grants for allen_test4@% | +------------------------------------------------------------------------------------------------------------+ | GRANT USAGE ON *.* TO 'allen_test4'@'%' IDENTIFIED BY PASSWORD '*C94FD2FCBF408CBBFAAB9C07FF4221D265AFB18F' | | GRANT SELECT ON `db_users`.`tb_test` TO 'allen_test4'@'%' | +------------------------------------------------------------------------------------------------------------+ 2 rows in set (0.00 sec) mysql>最后附上查看所有用户的sql语句：
mysql> use mysql; Reading table information for completion of table and column names You can turn off this feature to get a quicker startup with -A Database changed mysql> select user from user; +-------------+ | user | +-------------+ | allen_test2 | | allen_test3 | | allen_test4 | | root | | | | root | | | | root | +-------------+权限管理就到此为止了。
原文地址：http://blog.csdn.net/shallnet/article/details/46484507
