Description\n-----------\n\nThe GRANT statement allows you to grant privileges or roles to accounts. To use GRANT, you must have the GRANT OPTION privilege, and you must have the privileges that you are granting.\n\nUse the REVOKE statement to revoke privileges granted with the GRANT statement.\n\nUse the SHOW GRANTS statement to determine what privileges an account has.\n\nAccount Names\n\nFor GRANT statements, account names are specified as the username argument in the same way as they are for CREATE USER statements. See account names from the CREATE USER page for details on how account names are specified.\n\nImplicit Account Creation\n\nThe GRANT statement also allows you to implicitly create accounts in some cases.\n\nIf the account does not yet exist, then GRANT can implicitly create it. To implicitly create an account with GRANT, a user is required to have the same privileges that would be required to explicitly create the account with the CREATE USER statement.\n\nIf the NO_AUTO_CREATE_USER SQL_MODE is set, then accounts can only be created if authentication information is specified, or with a CREATE USER statement. If no authentication information is provided, GRANT will produce an error when the specified account does not exist, for example:\n\n``sql\nSHOW VARIABLES LIKE '%sql_mode%' ;\n`\n\n<pre><code><strong>+---------------+--------------------------------------------+\n</strong>| Variable_name | Value                                      |\n+---------------+--------------------------------------------+\n| sql_mode      | NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION |\n+---------------+--------------------------------------------+\n</code></pre>\n\n`sql\nGRANT USAGE ON . TO 'user123'@'%' IDENTIFIED BY '';\n`\n\n`\nERROR 1133 (28000): Can't find any matching row in the user table\n`\n\n`sql\nGRANT USAGE ON . TO 'user123'@'%' \n  IDENTIFIED VIA PAM using 'mariadb' require ssl ;\nQuery OK, 0 rows affected (0.00 sec)\n`\n\n`sql\nSELECT host, user FROM mysql.user WHERE user='user123' ;\n`\n\n`\n+------+----------+\n| host | user     |\n+------+----------+\n| %    | user123 |\n+------+----------+\n`\n\nPrivilege Levels\n\nPrivileges can be set globally, for an entire database, for a table or routine, or for individual columns in a table. Certain privileges can only be set at certain levels.\n\nGlobal privileges do not take effect immediately and are only applied to connections created after the GRANT statement was executed.\n\n Global privileges priv_type are granted using . for priv_level. Global privileges include privileges to administer the database and manage user accounts, as well as privileges for all tables, functions, and procedures. Global privileges are stored in mysql.global_priv table.\n Database privileges priv_type are granted using db_name. for priv_level, or using just  to use the current database. Database privileges include privileges to create tables and functions, as well as privileges for all tables, functions, and procedures in the database. Database privileges are stored in the mysql.db table.\n Table privileges priv_type are granted using db_name.tbl_namefor priv_level, or using just tbl_name to specify a table in the current database. The TABLE keyword is optional. Table privileges include the ability to select and change data in the table. Certain table privileges can be granted for individual columns.\n Column privileges priv_type are granted by specifying a table for priv_level and providing a column list after the privilege type. They allow you to control exactly which columns in a table users can select and change.\n Function privileges priv_type are granted using FUNCTION db_name.routine_name for priv_level, or using just FUNCTION routine_name to specify a function in the current database.\n Procedure privileges priv_type are granted using PROCEDURE db_name.routine_name for priv_level, or using just PROCEDURE routine_name to specify a procedure in the current database.\n\nThe USAGE Privilege\n\nThe USAGE privilege grants no real privileges. The SHOW GRANTS statement will show a global USAGE privilege for a newly-created user. You can use USAGE with the GRANT statement to change options like GRANT OPTIONand MAX_USER_CONNECTIONS without changing any account privileges.\n\nThe ALL PRIVILEGES Privilege\n\nThe ALL PRIVILEGES privilege grants all available privileges. Granting all privileges only affects the given privilege level. For example, granting all privileges on a table does not grant any privileges on the database or globally.\n\nUsing ALL PRIVILEGES does not grant the special GRANT OPTION privilege.\n\nYou can use ALL instead of ALL PRIVILEGES.\n\nThe GRANT OPTION Privilege\n\nUse the WITH GRANT OPTION clause to give users the ability to grant privileges to other users at the given privilege level. Users with the GRANT OPTION privilege can only grant privileges they have. They cannot grant privileges at a higher privilege level than they have the GRANT OPTION privilege.\n\nThe GRANT OPTION privilege cannot be set for individual columns. If you use WITH GRANT OPTION when specifying column privileges, the GRANT OPTION privilege will be granted for the entire table.\n\nUsing the WITH GRANT OPTION clause is equivalent to listing GRANT OPTION as a privilege.\n\nGlobal Privileges\n\nThe following table lists the privileges that can be granted globally. You can also grant all database, table, and function privileges globally. When granted globally, these privileges apply to all databases, tables, or functions, including those created later.\n\nTo set a global privilege, use . for _priv_level_.\n\nBINLOG ADMIN\n\nEnables administration of the binary log, including the PURGE BINARY LOGS statement and setting the system variables:\n\n binlog_annotate_row_events\n binlog_cache_size\n binlog_commit_wait_count\n binlog_commit_wait_usec\n binlog_direct_non_transactional_updates\n binlog_expire_logs_seconds\n binlog_file_cache_size\n binlog_format\n binlog_row_image\n binlog_row_metadata\n binlog_stmt_cache_size\n expire_logs_days\n log_bin_compress\n log_bin_compress_min_len\n log_bin_trust_function_creators\n max_binlog_cache_size\n max_binlog_size\n max_binlog_stmt_cache_size\n sql_log_bin and\n sync_binlog.\n\nBINLOG ADMIN isn't available.\n\nBINLOG MONITOR\n\nNew name for REPLICATION CLIENT. REPLICATION CLIENT can still be used, though.\n\nUse REPLICATION CLIENT instead. SHOW SLAVE STATUS isn't included in this privilege, and SLAVE MONITOR is required.\n\nPermits running SHOW commands related to the binary log, in particular the SHOW BINLOG STATUS and SHOW BINARY LOGS statements.\n\nBINLOG REPLAY\n\nEnables replaying the binary log with the BINLOG statement (generated by mariadb-binlog), executing SET timestamp when secure_timestamp is set to replication, and setting the session values of system variables usually included in BINLOG output, in particular:\n\n gtid_domain_id\n gtid_seq_no\n pseudo_thread_id\n server_id.\n\nBINLOG REPLAY isn't available.\n\nCONNECTION ADMIN\n\nEnables administering connection resource limit options. This includes ignoring the limits specified by max_user_connections and max_password_errors, and allowing one extra connection over max_connections\n\nThe statements specified in init_connect are not executed, killing connections and queries owned by other users is permitted. The following connection-related system variables can be changed:\n\n connect_timeout\n disconnect_on_expired_password\n extra_max_connections\n init_connect\n max_connections\n max_connect_errors\n max_password_errors\n proxy_protocol_networks\n secure_auth\n slow_launch_time\n thread_pool_exact_stats\n thread_pool_dedicated_listener\n thread_pool_idle_timeout\n thread_pool_max_threads\n thread_pool_min_threads\n thread_pool_oversubscribe\n thread_pool_prio_kickup_timer\n thread_pool_priority\n thread_pool_size, and\n thread_pool_stall_limit.\n\nCREATE USER\n\nCreate a user using the CREATE USER statement, or implicitly create a user with the GRANT statement.\n\nFEDERATED ADMIN\n\nExecute CREATE SERVER, ALTER SERVER, and DROP SERVER statements.\n\nFEDERATED ADMIN is not available.\n\nFILE\n\nRead and write files on the server, using statements like LOAD DATA INFILE or functions like LOAD_FILE(). Also needed to create CONNECT outward tables. MariaDB server must have the permissions to access those files.\n\nGRANT OPTION\n\nGrant global privileges. You can only grant privileges that you have.\n\nPROCESS\n\nShow information about the active processes, for example via SHOW PROCESSLIST or mariadb-admin processlist. If you have the PROCESS privilege, you can see all threads. Otherwise, you can see only your own threads (that is, threads associated with the MariaDB account that you are using).\n\nREAD_ONLY ADMIN\n\nUser ignores the read_only system variable, and can perform write operations even when the read_only option is active.\n\nA user with that privilege can also change the (global) value of read_only.\n\nThe READ_ONLY ADMIN privilege has been removed from SUPER. The benefit of this is that one can remove the READ_ONLY ADMIN privilege from all users and ensure that no one can make any changes on any non-temporary tables. This is useful on slaves when one wants to ensure that the slave is kept identical to the master.\n\nUser ignores the read_only system variable, and can perform write operations even when the read_only option is active.\n\nA user with that privilege can also change the (global) value of read_only.\n\nThe READ_ONLY ADMIN privilege is included in SUPER.\n\nREAD_ONLY ADMIN isn't available.\n\nRELOAD\n\nExecute FLUSH statements or equivalent mariadb-admin commands.\n\nREPLICATION CLIENT\n\nExecute SHOW MASTER STATUS and SHOW BINARY LOGS informative statements. Renamed to BINLOG MONITOR (but still supported as an alias for compatibility reasons).\n\nExecute SHOW MASTER STATUS and SHOW BINARY LOGS informative statements. SHOW SLAVE STATUS is part of REPLICATION CLIENT.\n\nExecute SHOW MASTER STATUS and SHOW BINARY LOGS informative statements. Using BINLOG MONITOR instead is still supported as an alias.\n\nExecute SHOW MASTER STATUS and SHOW BINARY LOGS informative statements. Renamed to BINLOG MONITOR in MariaDB 10.5.2 (but still supported as an alias for compatibility reasons). SHOW SLAVE STATUS was part of REPLICATION CLIENT prior to MariaDB 10.5.\n\nREPLICATION MASTER ADMIN\n\nPermits administration of master servers, including the SHOW SLAVE HOSTS statement, and setting the gtid_binlog_state, gtid_domain_id, master_verify_checksum and server_id system variables.\n\nREPLICATION MASTER ADMIN is not available.\n\nSLAVE MONITOR\n\nPermit SHOW REPLICA STATUS and SHOW RELAYLOG EVENTS.\n\nSee _Reasoning_ tab as to why this was implemented.\n\nWhen a user would upgrade from an older major release to a MariaDB 10.5 minor release prior to MariaDB 10.5.9, certain user accounts would lose capabilities. For example, a user account that had the REPLICATION CLIENT privilege in older major releases could run SHOW REPLICA STATUS, but after upgrading to a MariaDB 10.5 minor release prior to MariaDB 10.5.9, they could no longer run SHOW REPLICA STATUS, because that statement was changed to require the REPLICATION SLAVE ADMIN privilege.\n\nThis issue is fixed in MariaDB 10.5.9 with this new privilege, which now grants the user the ability to execute SHOW [ALL] (SLAVE | REPLICA) STATUS.\n\nWhen a database is upgraded from an older major release to MariaDB Server 10.5.9 or later, any user accounts with the REPLICATION CLIENT or REPLICATION SLAVE privileges will automatically be granted the new SLAVE MONITOR privilege. The privilege fix occurs when the server is started up, not when mariadb-upgrade is performed.\n\nHowever, when a database is upgraded from an early 10.5 minor release to 10.5.9 and later, the user will have to fix any user account privileges manually.\n\nSLAVE MONITOR is not available.\n\nREPLICATION REPLICA\n\nSynonym for REPLICATION SLAVE.\n\nREPLICATION REPLICA is not available.\n\nREPLICATION SLAVE\n\nAccounts used by slave servers on the master need this privilege. This is needed to get the updates made on the master. REPLICATION REPLICA is an alias for REPLICATION SLAVE.\n\nAccounts used by slave servers on the master need this privilege. This is needed to get the updates made on the master.\n\nREPLICATION SLAVE ADMIN\n\nPermits administering slave servers, including START REPLICA/SLAVE, STOP REPLICA/SLAVE, CHANGE MASTER, SHOW REPLICA/SLAVE STATUS, SHOW RELAYLOG EVENTS statements, replaying the binary log with the BINLOG statement (generated by mariadb-binlog), and setting the system variables:\n\n gtid_cleanup_batch_size\n gtid_ignore_duplicates\n gtid_pos_auto_engines\n gtid_slave_pos\n gtid_strict_mode\n init_slave\n read_binlog_speed_limit\n relay_log_purge\n relay_log_recovery\n replicate_do_db\n replicate_do_table\n replicate_events_marked_for_skip\n replicate_ignore_db\n replicate_ignore_table\n replicate_wild_do_table\n replicate_wild_ignore_table\n slave_compressed_protocol\n slave_ddl_exec_mode\n slave_domain_parallel_threads\n slave_exec_mode\n slave_max_allowed_packet\n slave_net_timeout\n slave_parallel_max_queued\n slave_parallel_mode\n slave_parallel_threads\n slave_parallel_workers\n slave_run_triggers_for_rbr\n slave_sql_verify_checksum\n slave_transaction_retry_interval\n slave_type_conversions\n sync_master_info\n sync_relay_log, and\n sync_relay_log_info.\n\nREPLICATION SLAVE ADMIN is not available.\n\nSET USER\n\nEnables setting the DEFINER when creating triggers, views, stored functions and stored procedures.\n\nSET USER isn't available.\n\nSHOW DATABASES\n\nList all databases using the SHOW DATABASES statement. Without the SHOW DATABASES privilege, you can still issue the SHOW DATABASES statement, but it will only list databases containing tables on which you have privileges.\n\nSHUTDOWN\n\nShut down the server using SHUTDOWN or the mariadb-admin shutdown command.\n\nSUPER\n\nExecute superuser statements: CHANGE MASTER TO, KILL (users who do not have this privilege can only KILL their own threads), PURGE LOGS, SET global system variables, or the mariadb-admin debug command. Also, this permission allows the user to write data even if the read_only startup option is set, enable or disable logging, enable or disable replication on slave, specify a DEFINER for statements that support that clause, connect once reaching the MAX_CONNECTIONS. If a statement has been specified for the init-connect mariadbd option, that command will not be executed when a user with SUPER privileges connects to the server.\n\nThe SUPER privilege has been split into multiple smaller privileges to allow for more fine-grained privileges (MDEV-21743). The privileges are:\n\n SET USER\n FEDERATED ADMIN\n CONNECTION ADMIN\n REPLICATION SLAVE ADMIN\n BINLOG ADMIN\n BINLOG REPLAY\n SLAVE MONITOR\n BINLOG MONITOR\n REPLICATION MASTER ADMIN\n READ_ONLY ADMIN\n\nThese grants are no longer a part of SUPER and need to be granted separately.\n\nThe READ_ONLY ADMIN privilege has been removed from SUPER. The benefit of this is that one can remove the READ_ONLY ADMIN privilege from all users and ensure that no one can make any changes on any non-temporary tables. This is useful on\n\n[Truncated — full content at mariadb.com/docs]