Fix privilege problems of accessing information_schema

[djshow832]

Background

There are some privilege problems of accessing the tables in information_schema.
Generally, there are 2 kinds of problems:

1. Users without PROCESS privilege should be unable to access the cluster data, such as cluster_config, but they can.
2. Users without the super privilege should able to access their own data, such as user_privileges, but they can access all.

Risks

Many tools query tables in information_schema. Those tools may need special privileges to import / export / backup / restore data.

Milestones

Stage 1

Fix some issues and merge them into 5.1.1 before 2021-7-20.

• account who only has USAGE privilege can see information_schema.CLUSTER_CONFIG #26062
  • executor, privilege: require CONFIG privilege for is.cluster_config #26071
• Users without process privilege should be unable to query cluster_hardware #26121 @mjonss executor, privilege: require CONFIG or Process privilege for is.cluster_* #26220
• Users without process privilege should be unable to query cluster_info #26122 @mjonss executor, privilege: require CONFIG or Process privilege for is.cluster_* #26220
• Users without process privilege should be unable to query cluster_load #26123 @mjonss executor, privilege: require CONFIG or Process privilege for is.cluster_* #26220
• Users without process privilege should be unable to query cluster_log #26124 @mjonss executor, privilege: require CONFIG or Process privilege for is.cluster_* #26220
• Users without process privilege should be unable to query CLUSTER_STATEMENTS_SUMMARY_EVICTED #26125 @AilinKid executor: fix user without process privilege can access cluster_statements_summary_evicted table #26208
• Users without process privilege should be unable to query CLUSTER_SYSTEMINFO #26126 @AilinKid executor, privilege: require CONFIG or Process privilege for is.cluster_* #26220
• Users without process privilege should be unable to query CLUSTER_TIDB_TRX #26127 @AilinKid test: fix user without process privilege can access cluster_tidb_trx #26255
• infoschema.user_privileges privilege requirements is not dependent on user's privileges #26069
  • executor, privileges: fix infoschema.user_privileges privilege requirements #26070
• Users without super privilege should be unable to query TABLE_STORAGE_STATS of other users #26128 @AilinKid exec: access the table_storage_stats need privilege #26298

Stage 2

TBD

[bb7133]

@djshow832 Can we close this issue now?

[ti-srebot]

Please edit this comment or add a new comment to complete the following information

Not a bug

1. Remove the 'type/bug' label
2. Add notes to indicate why it is not a bug

Duplicate bug

1. Add the 'type/duplicate' label
2. Add the link to the original bug

Bug

Note: Make Sure that 'component', and 'severity' labels are added
Example for how to fill out the template: #20100

1. Root Cause Analysis (RCA) (optional)

2. Symptom (optional)

3. All Trigger Conditions (optional)

4. Workaround (optional)

5. Affected versions

6. Fixed versions

[djshow832]

Fine, I'll reopen it after I list the issues in stage 2. @bb7133