regex_policy is an Authorization plugin that uses regex patterns to match policies. When drizzled is started with --plugin-add=regex_policy, the regex policy plugin is enabled with the default policy file. Policy file can be specified by either specifying --regex-policy.policy=<policy file> at the time of server startup or by changing the regex_policy_policy with SET GLOBAL.
To load this plugin, start drizzled with:
--plugin-add=regex_policy
Loading the plugin may not enable or configure it. See the plugin’s Configuration and Variables.
See also
Plugin Options for more information about adding and removing plugins.
These command line options configure the plugin when drizzled is started. See Command Line Options for more information about specifying command line options.
Default : | drizzle.policy |
---|---|
Variable : | regex_policy_policy |
File to load for regex authorization policies.
These variables show the running configuration of the plugin. See variables for more information about querying and setting variables.
regex_policy_policy
Scope: Global Dynamic: No Option: --regex-policy.policy File to load for regex authorization policies.
The general line format of a regex policy file is:
USER_PATTERN SCHEMA_OBJECT_PATTERN POLICY
In Drizzle 7 and Drizzle 7.1 the POLICY values supported were 'ACCEPT' and 'DENY'. Beginning with Drizzle 7.2.0, the values used should be 'ALLOW' and 'DENY'. Although 'ACCEPT' and 'REJECT' are also supported for backward compatibility, but their use is deprecated.
For example:
# This is a comment line and should be skipped
.+ schema=DATA_DICTIONARY ALLOW
.+ schema=INFORMATION_SCHEMA ALLOW
.+ schema=data_dictionary ALLOW
.+ schema=information_schema ALLOW
root table=.+ ALLOW
root schema=.+ ALLOW
root process=.+ ALLOW
user1 schema=user1 ALLOW
user2 schema=user2 ALLOW
user1 process=user1 ALLOW
user2 process=user2 ALLOW
# Default to denying everything
.+ schema=.+ DENY
.+ process=.+ DENY
Policy file can be reloaded by:
SET GLOBAL regex_policy_policy=@@regex_policy_policy
Moreover, the policy file can be changed by:
SET GLOBAL regex_policy_policy=/path/to/new/policy/file
Sorry, there are no examples for this plugin.
Clint Byrum
This documentation applies to regex_policy 2.0.
To see which version of the plugin a Drizzle server is running, execute:
SELECT MODULE_VERSION FROM DATA_DICTIONARY.MODULES WHERE MODULE_NAME='regex_policy'