content_image/702388.jpg
| u1 | % | [{"Database": "world", "Privileges": ["INSERT"]}] | +------+------+------------------------------------------------------+ 

<img src='content_image/702388.jpg'>

Partial revoke operations are subject to these conditions: 

## Note 

Although partial revokes can be imposed for any schema, privilege restrictions on the mysql  system schema in particular are useful as part of a strategy for preventing regular accounts from modifying system accounts. See Protecting System Accounts Against Manipulation by Regular Accounts. 

•Partial revokes must name the schema literally. Schema names that contain the %  or _  SQL wildcard characters (for example, myschema% ) are not permitted. 

•It is possible to use partial revokes to place restrictions on nonexistent schemas, but only if the revoked privilege is granted globally. If a privilege is not granted globally, revoking it for a nonexistent schema produces an error. 

•Partial revokes apply at the schema level only. You cannot use partial revokes for privileges that apply only globally (such as FILE  or BINLOG_ADMIN ), or for table, column, or routine privileges. 

As mentioned previously, partial revokes of schema-level privileges appear in SHOW GRANTS  output as REVOKE  statements. This differs from how SHOW GRANTS  represents “plain”  schema-level privileges: 

•When granted, schema-level privileges are represented by their own GRANT  statements in the output: 

mysql> CREATE USER u1; mysql> GRANT UPDATE ON mysql.* TO u1; mysql> GRANT DELETE ON world.* TO u1; mysql> SHOW GRANTS FOR u1; +---------------------------------------+ | Grants for u1@% | +---------------------------------------+ | GRANT USAGE ON *.* TO ‘u1‘@‘%‘ | | GRANT UPDATE ON ‘mysql‘.* TO ‘u1‘@‘%‘ | | GRANT DELETE ON ‘world‘.* TO ‘u1‘@‘%‘ | +---------------------------------------+ 

•When revoked, schema-level privileges simply disappear from the output. They do not appear as REVOKE  statements: 

mysql> REVOKE UPDATE ON mysql.* FROM u1; mysql> REVOKE DELETE ON world.* FROM u1; mysql> SHOW GRANTS FOR u1; +--------------------------------+ | Grants for u1@% | +--------------------------------+ | GRANT USAGE ON *.* TO ‘u1‘@‘%‘ | +--------------------------------+ 

When a user grants a privilege, any restriction the grantor has on the privilege is inherited by the grantee, unless the grantee already has the privilege without the restriction. Consider the following two users, one of whom has the global SELECT  privilege: 

CREATE USER u1, u2; GRANT SELECT ON *.* TO u2; 

Suppose that an administrative user admin  has a global but partially revoked SELECT  privilege: 

mysql> CREATE USER admin; mysql> GRANT SELECT ON *.* TO admin WITH GRANT OPTION; 

