Question: Grant EVENT Privilege for Mysql User/Database

[Kurieuo]

When assigning a user to a database, I notice that cPanel doesn't support EVENT privilege -- at least it's not displaying as a selectable checkbox.

My question is whether there is a security issue around granting an EVENT privilege for MySQL user on a database?

If there isn't a security issue, why doesn't cPanel show this privilege -- i.e., do I need to configure something for it to show up?

Many thanks.

 

[Jeff Shotnik]

See - MySQL :: MySQL 5.1 Reference Manual :: 19.4.6 The Event Scheduler and MySQL Privileges

I've never seen the privilege turn into a security issue as the event query is ran as the mysql database user, not root or mysql. You do need to manually grant the event privilege as the default is 'N'.

 

[Kurieuo]

See - MySQL :: MySQL 5.1 Reference Manual :: 19.4.6 The Event Scheduler and MySQL Privileges

I've never seen the privilege turn into a security issue as the event query is ran as the mysql database user, not root or mysql. You do need to manually grant the event privilege as the default is 'N'.

Thanks Jeff,

Also received a response from cPanel support, who said:

It does note that events must be turned on explicitly in /etc/my.cnf (with event_scheduler = 1). It also notes that the events privilege could be easily abused due to there being no way to limit how frequently a scheduled event can be run. At this point in time, it's not supported.​

Will be submitting this as a feature request so privilege can just be set for a mysql user when adding them to a database.

 

[Kurieuo]

If anyone wants this feature automatically included, please vote for it to be included here: Grant "EVENT" MySQL privilege for user/schema | cPanel Feature Requests