<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h3 class="title">
      <a name="privilege-changes">
      </a>
      8.2.13 When Privilege Changes Take Effect
     </h3>
    </div>
   </div>
  </div>
  <a class="indexterm" name="idm46045248776432">
  </a>
  <a class="indexterm" name="idm46045248774976">
  </a>
  <p>
   If the
   <a class="link" href="mysqld.html" title="6.3.1 mysqld — The MySQL Server">
    <span class="command">
     <strong>
      mysqld
     </strong>
    </span>
   </a>
   server is started without the
   <a class="link" href="server-options.html#option_mysqld_skip-grant-tables">
    <code class="option">
     --skip-grant-tables
    </code>
   </a>
   option, it
      reads all grant table contents into memory during its startup
      sequence. The in-memory tables become effective for access control
      at that point.
  </p>
  <p>
   If you modify the grant tables indirectly using an
      account-management statement, the server notices these changes and
      loads the grant tables into memory again immediately.
      Account-management statements are described in
   <a class="xref" href="account-management-statements.html" title="15.7.1 Account Management Statements">
    Section 15.7.1, “Account Management Statements”
   </a>
   . Examples include
   <a class="link" href="grant.html" title="15.7.1.6 GRANT Statement">
    <code class="literal">
     GRANT
    </code>
   </a>
   ,
   <a class="link" href="revoke.html" title="15.7.1.8 REVOKE Statement">
    <code class="literal">
     REVOKE
    </code>
   </a>
   ,
   <a class="link" href="set-password.html" title="15.7.1.10 SET PASSWORD Statement">
    <code class="literal">
     SET
      PASSWORD
    </code>
   </a>
   , and
   <a class="link" href="rename-user.html" title="15.7.1.7 RENAME USER Statement">
    <code class="literal">
     RENAME
      USER
    </code>
   </a>
   .
  </p>
  <p>
   If you modify the grant tables directly using statements such as
   <a class="link" href="insert.html" title="15.2.7 INSERT Statement">
    <code class="literal">
     INSERT
    </code>
   </a>
   ,
   <a class="link" href="update.html" title="15.2.17 UPDATE Statement">
    <code class="literal">
     UPDATE
    </code>
   </a>
   , or
   <a class="link" href="delete.html" title="15.2.2 DELETE Statement">
    <code class="literal">
     DELETE
    </code>
   </a>
   (which is not recommended),
      the changes have no effect on privilege checking until you either
      tell the server to reload the tables or restart it. Thus, if you
      change the grant tables directly but forget to reload them, the
      changes have
   <span class="emphasis">
    <em>
     no effect
    </em>
   </span>
   until you restart the
      server. This may leave you wondering why your changes seem to make
      no difference!
  </p>
  <p>
   To tell the server to reload the grant tables, perform a
      flush-privileges operation. This can be done by issuing a
   <a class="link" href="flush.html#flush-privileges">
    <code class="literal">
     FLUSH PRIVILEGES
    </code>
   </a>
   statement or by
      executing a
   <a class="link" href="mysqladmin.html" title="6.5.2 mysqladmin — A MySQL Server Administration Program">
    <span class="command">
     <strong>
      mysqladmin flush-privileges
     </strong>
    </span>
   </a>
   or
   <a class="link" href="mysqladmin.html" title="6.5.2 mysqladmin — A MySQL Server Administration Program">
    <span class="command">
     <strong>
      mysqladmin reload
     </strong>
    </span>
   </a>
   command.
  </p>
  <p>
   A grant table reload affects privileges for each existing client
      session as follows:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      Table and column privilege changes take effect with the
          client's next request.
     </p>
    </li>
    <li class="listitem">
     <p>
      Database privilege changes take effect the next time the
          client executes a
      <code class="literal">
       USE
       <em class="replaceable">
        <code>
         db_name
        </code>
       </em>
      </code>
      statement.
     </p>
     <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
      <div class="admon-title">
       Note
      </div>
      <p>
       Client applications may cache the database name; thus, this
            effect may not be visible to them without actually changing
            to a different database.
      </p>
     </div>
    </li>
    <li class="listitem">
     <p>
      Static global privileges and passwords are unaffected for a
          connected client. These changes take effect only in sessions
          for subsequent connections. Changes to dynamic global
          privileges apply immediately. For information about the
          differences between static and dynamic privileges, see
      <a class="xref" href="privileges-provided.html#static-dynamic-privileges" title="Static Versus Dynamic Privileges">
       Static Versus Dynamic Privileges
      </a>
      .)
     </p>
    </li>
   </ul>
  </div>
  <p>
   Changes to the set of active roles within a session take effect
      immediately, for that session only. The
   <a class="link" href="set-role.html" title="15.7.1.11 SET ROLE Statement">
    <code class="literal">
     SET
      ROLE
    </code>
   </a>
   statement performs session role activation and
      deactivation (see
   <a class="xref" href="set-role.html" title="15.7.1.11 SET ROLE Statement">
    Section 15.7.1.11, “SET ROLE Statement”
   </a>
   ).
  </p>
  <p>
   If the server is started with the
   <a class="link" href="server-options.html#option_mysqld_skip-grant-tables">
    <code class="option">
     --skip-grant-tables
    </code>
   </a>
   option, it does
      not read the grant tables or implement any access control. Any
      user can connect and perform any operation,
   <span class="emphasis">
    <em>
     which is
      insecure.
    </em>
   </span>
   To cause a server thus started to read the
      tables and enable access checking, flush the privileges.
  </p>
 </div>
 <br/>
</div>
