
the GRANT statement to change options like GRANT OPTION and
MAX_USER_CONNECTIONS without changing any account privileges.

The ALL PRIVILEGES Privilege
----------------------------

The ALL PRIVILEGES privilege grants all available privileges. Granting all
privileges only affects the given privilege level. For example, granting all
privileges on a table does not grant any privileges on the database or
globally.

Using ALL PRIVILEGES does not grant the special GRANT OPTION privilege.

You can use ALL instead of ALL PRIVILEGES.

The GRANT OPTION Privilege
--------------------------

Use the WITH GRANT OPTION clause to give users the ability to grant privileges
to other users at the given privilege level. Users with the GRANT OPTION
privilege can only grant privileges they have. They cannot grant privileges at
a higher privilege level than they have the GRANT OPTION privilege.

The GRANT OPTION privilege cannot be set for individual columns. If you use
WITH GRANT OPTION when specifying column privileges, the GRANT OPTION
privilege will be granted for the entire table.

Using the WITH GRANT OPTION clause is equivalent to listing GRANT OPTION as a
privilege.

Global Privileges
-----------------

The following table lists the privileges that can be granted globally. You can
also grant all database, table, and function privileges globally. When granted
globally, these privileges apply to all databases, tables, or functions,
including those created later.

To set a global privilege, use *.* for priv_level.

BINLOG ADMIN
------------

Enables administration of the binary log, including the PURGE BINARY LOGS
statement and setting the system variables:

* binlog_annotate_row_events
* binlog_cache_size
* binlog_commit_wait_count
* binlog_commit_wait_usec
* binlog_direct_non_transactional_updates
* binlog_expire_logs_seconds
* binlog_file_cache_size
* binlog_format
* binlog_row_image
* binlog_row_metadata
* binlog_stmt_cache_size
* expire_logs_days
* log_bin_compress
* log_bin_compress_min_len
* log_bin_trust_function_creators
* max_binlog_cache_size
* max_binlog_size
* max_binlog_stmt_cache_size
* sql_log_bin and
* sync_binlog.

Added in MariaDB 10.5.2.

BINLOG MONITOR
--------------

New name for REPLICATION CLIENT from MariaDB 10.5.2, (REPLICATION CLIENT still
supported as an alias for compatibility purposes). Permits running SHOW
commands related to the binary log, in particular the SHOW BINLOG STATUS and
SHOW BINARY LOGS statements. Unlike REPLICATION CLIENT prior to MariaDB 10.5,
SHOW REPLICA STATUS isn't included in this privilege, and REPLICA MONITOR is
required.

BINLOG REPLAY
-------------

Enables replaying the binary log with the BINLOG statement (generated by
mariadb-binlog), executing SET timestamp when secure_timestamp is set to
replication, and setting the session values of system variables usually
included in BINLOG output, in particular:

* gtid_domain_id
* gtid_seq_no
* pseudo_thread_id
* server_id.

Added in MariaDB 10.5.2

CONNECTION ADMIN
----------------

Enables administering connection resource limit options. This includes
ignoring the limits specified by:

* max_connections
* max_user_connections and
* max_password_errors.

The statements specified in init_connect are not executed, killing connections
and queries owned by other users is permitted. The following
connection-related system variables can be changed:

* connect_timeout
* disconnect_on_expired_password
* extra_max_connections
* init_connect
* max_connections
* max_connect_errors
* max_password_errors
* proxy_protocol_networks
* secure_auth
* slow_launch_time
* thread_pool_exact_stats
* thread_pool_dedicated_listener
* thread_pool_idle_timeout
* thread_pool_max_threads
* thread_pool_min_threads
* thread_pool_oversubscribe
* thread_pool_prio_kickup_timer
* thread_pool_priority
* thread_pool_size, and
* thread_pool_stall_limit.

Added in MariaDB 10.5.2.

CREATE USER
-----------

Create a user using the CREATE USER statement, or implicitly create a user
with the GRANT statement.

FEDERATED ADMIN
---------------

Execute CREATE SERVER, ALTER SERVER, and DROP SERVER statements. Added in
MariaDB 10.5.2.

FILE
----

Read and write files on the server, using statements like LOAD DATA INFILE or
functions like LOAD_FILE(). Also needed to create CONNECT outward tables.
MariaDB server must have the permissions to access those files.

GRANT OPTION
------------

Grant global privileges. You can only grant privileges that you have.

PROCESS
-------

Show information about the active processes, for example via SHOW PROCESSLIST
or mysqladmin processlist. If you have the PROCESS privilege, you can see all
threads. Otherwise, you can see only your own threads (that is, threads
associated with the MariaDB account that you are using).

READ_ONLY ADMIN
---------------

User can set the read_only system variable and allows the user to perform
write operations, even when the read_only option is active. Added in MariaDB
10.5.2.

From MariaDB 10.11.0, the READ_ONLY ADMIN privilege has been removed from
SUPER. The benefit of this is that one can remove the READ_ONLY ADMIN
privilege from all users and ensure that no one can make any changes on any
non-temporary tables. This is useful on replicas when one wants to ensure that
the replica is kept identical to the primary.

RELOAD
------

Execute FLUSH statements or equivalent mariadb-admin/mysqladmin commands.
