If an account has a privilege restriction on a schema: 

•The account cannot grant to other accounts a privilege on the restricted schema or any object within it. 

•Another account that does not have the restriction can grant privileges to the restricted account for the restricted schema or objects within it. Suppose that an unrestricted user executes these statements: 

CREATE USER u1; GRANT SELECT, INSERT, UPDATE ON *.* TO u1; REVOKE SELECT, INSERT, UPDATE ON mysql.* FROM u1; GRANT SELECT ON mysql.user TO u1; -- grant table privilege GRANT SELECT(Host,User) ON mysql.db TO u1; -- grant column privileges 

The resulting account has these privileges, with the ability to perform limited operations within the restricted schema: 

mysql> SHOW GRANTS FOR u1; +-----------------------------------------------------------+ | Grants for u1@% | +-----------------------------------------------------------+ | GRANT SELECT, INSERT, UPDATE ON *.* TO ‘u1‘@‘%‘ | | REVOKE SELECT, INSERT, UPDATE ON ‘mysql‘.* FROM ‘u1‘@‘%‘ | | GRANT SELECT (‘Host‘, ‘User‘) ON ‘mysql‘.‘db‘ TO ‘u1‘@‘%‘ | | GRANT SELECT ON ‘mysql‘.‘user‘ TO ‘u1‘@‘%‘ | +-----------------------------------------------------------+ 

If an account has a restriction on a global privilege, the restriction is removed by any of these actions: 

•Granting the privilege globally to the account by an account that has no restriction on the privilege. 

•Granting the privilege at the schema level. 

•Revoking the privilege globally. 

Consider a user u1  who holds several privileges globally, but with restrictions on INSERT , UPDATE  and DELETE : 

mysql> CREATE USER u1; mysql> GRANT SELECT, INSERT, UPDATE, DELETE ON *.* TO u1; mysql> REVOKE INSERT, UPDATE, DELETE ON mysql.* FROM u1; mysql> SHOW GRANTS FOR u1; +----------------------------------------------------------+ | Grants for u1@% | +----------------------------------------------------------+ | GRANT SELECT, INSERT, UPDATE, DELETE ON *.* TO ‘u1‘@‘%‘ | | REVOKE INSERT, UPDATE, DELETE ON ‘mysql‘.* FROM ‘u1‘@‘%‘ | +----------------------------------------------------------+ 

Granting a privilege globally to u1  from an account with no restriction removes the privilege restriction. For example, to remove the INSERT  restriction: 

mysql> GRANT INSERT ON *.* TO u1; mysql> SHOW GRANTS FOR u1; +---------------------------------------------------------+ | Grants for u1@% | +---------------------------------------------------------+ | GRANT SELECT, INSERT, UPDATE, DELETE ON *.* TO ‘u1‘@‘%‘ | | REVOKE UPDATE, DELETE ON ‘mysql‘.* FROM ‘u1‘@‘%‘ | +---------------------------------------------------------+ 

Granting a privilege at the schema level to u1  removes the privilege restriction. For example, to remove the UPDATE  restriction: 

mysql> GRANT UPDATE ON mysql.* TO u1; 

