<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h3 class="title">
      <a name="stored-routines-privileges">
      </a>
      27.2.2 Stored Routines and MySQL Privileges
     </h3>
    </div>
   </div>
  </div>
  <p>
   The MySQL grant system takes stored routines into account as
      follows:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      The
      <a class="link" href="privileges-provided.html#priv_create-routine">
       <code class="literal">
        CREATE ROUTINE
       </code>
      </a>
      privilege is
          needed to create stored routines.
     </p>
    </li>
    <li class="listitem">
     <p>
      The
      <a class="link" href="privileges-provided.html#priv_alter-routine">
       <code class="literal">
        ALTER ROUTINE
       </code>
      </a>
      privilege is
          needed to alter or drop stored routines. This privilege is
          granted automatically to the creator of a routine if
          necessary, and dropped from the creator when the routine is
          dropped.
     </p>
    </li>
    <li class="listitem">
     <p>
      The
      <a class="link" href="privileges-provided.html#priv_execute">
       <code class="literal">
        EXECUTE
       </code>
      </a>
      privilege is
          required to execute stored routines. However, this privilege
          is granted automatically to the creator of a routine if
          necessary (and dropped from the creator when the routine is
          dropped). Also, the default
      <code class="literal">
       SQL SECURITY
      </code>
      characteristic for a routine is
      <code class="literal">
       DEFINER
      </code>
      ,
          which enables users who have access to the database with which
          the routine is associated to execute the routine.
     </p>
    </li>
    <li class="listitem">
     <p>
      If the
      <a class="link" href="server-system-variables.html#sysvar_automatic_sp_privileges">
       <code class="literal">
        automatic_sp_privileges
       </code>
      </a>
      system variable is 0, the
      <a class="link" href="privileges-provided.html#priv_execute">
       <code class="literal">
        EXECUTE
       </code>
      </a>
      and
      <a class="link" href="privileges-provided.html#priv_alter-routine">
       <code class="literal">
        ALTER ROUTINE
       </code>
      </a>
      privileges are
          not automatically granted to and dropped from the routine
          creator.
     </p>
    </li>
    <li class="listitem">
     <p>
      The creator of a routine is the account used to execute the
      <code class="literal">
       CREATE
      </code>
      statement for it. This might not be
          the same as the account named as the
      <code class="literal">
       DEFINER
      </code>
      in the routine definition.
     </p>
    </li>
    <li class="listitem">
     <p>
      The account named as a routine
      <code class="literal">
       DEFINER
      </code>
      can
          see all routine properties, including its definition. The
          account thus has full access to the routine output as produced
          by:
     </p>
     <div class="itemizedlist">
      <ul class="itemizedlist" style="list-style-type: circle; ">
       <li class="listitem">
        <p>
         The contents of the Information Schema
         <a class="link" href="information-schema-routines-table.html" title="28.3.30 The INFORMATION_SCHEMA ROUTINES Table">
          <code class="literal">
           ROUTINES
          </code>
         </a>
         table.
        </p>
       </li>
       <li class="listitem">
        <p>
         The
         <a class="link" href="show-create-function.html" title="15.7.7.9 SHOW CREATE FUNCTION Statement">
          <code class="literal">
           SHOW CREATE FUNCTION
          </code>
         </a>
         and
         <a class="link" href="show-create-procedure.html" title="15.7.7.10 SHOW CREATE PROCEDURE Statement">
          <code class="literal">
           SHOW CREATE PROCEDURE
          </code>
         </a>
         statements.
        </p>
       </li>
       <li class="listitem">
        <p>
         The
         <a class="link" href="show-function-code.html" title="15.7.7.20 SHOW FUNCTION CODE Statement">
          <code class="literal">
           SHOW FUNCTION CODE
          </code>
         </a>
         and
         <a class="link" href="show-procedure-code.html" title="15.7.7.29 SHOW PROCEDURE CODE Statement">
          <code class="literal">
           SHOW PROCEDURE CODE
          </code>
         </a>
         statements.
        </p>
       </li>
       <li class="listitem">
        <p>
         The
         <a class="link" href="show-function-status.html" title="15.7.7.21 SHOW FUNCTION STATUS Statement">
          <code class="literal">
           SHOW FUNCTION STATUS
          </code>
         </a>
         and
         <a class="link" href="show-procedure-status.html" title="15.7.7.30 SHOW PROCEDURE STATUS Statement">
          <code class="literal">
           SHOW PROCEDURE STATUS
          </code>
         </a>
         statements.
        </p>
       </li>
      </ul>
     </div>
    </li>
    <li class="listitem">
     <p>
      For an account other than the account named as the routine
      <code class="literal">
       DEFINER
      </code>
      , access to routine properties
          depends on the privileges granted to the account:
     </p>
     <div class="itemizedlist">
      <ul class="itemizedlist" style="list-style-type: circle; ">
       <li class="listitem">
        <p>
         With the
         <a class="link" href="privileges-provided.html#priv_show-routine">
          <code class="literal">
           SHOW_ROUTINE
          </code>
         </a>
         privilege or the global
         <a class="link" href="privileges-provided.html#priv_select">
          <code class="literal">
           SELECT
          </code>
         </a>
         privilege, the
              account can see all routine properties, including its
              definition.
        </p>
       </li>
       <li class="listitem">
        <p>
         With the
         <a class="link" href="privileges-provided.html#priv_create-routine">
          <code class="literal">
           CREATE ROUTINE
          </code>
         </a>
         ,
         <a class="link" href="privileges-provided.html#priv_alter-routine">
          <code class="literal">
           ALTER ROUTINE
          </code>
         </a>
         or
         <a class="link" href="privileges-provided.html#priv_execute">
          <code class="literal">
           EXECUTE
          </code>
         </a>
         privilege granted
              at a scope that includes the routine, the account can see
              all routine properties except its definition.
        </p>
       </li>
      </ul>
     </div>
    </li>
   </ul>
  </div>
 </div>
 <br/>
</div>
