On Mon, 10 Jan 2000 sin...@mysql.com wrote:

Ok, seems I've misunderstood here. I believed that WITH GRANT OPTION meant that I could give away _my_own_ privileges. But WITH GRANT OPTION seems to mean that I can give away _any_ privileges in the entire database, i.e. that I'm a mysql-root.

Why should I be able to change the password of those to whom I give the rights? I'm _not_ talking about a global grant option in the mysql.user table here, but about a grant option on a specific database in the mysql.db-table.

From the manual, section on GRANT:

- In MySQL 3.22.12 or later, if a new user is created or if you have - global grant privileges, the user's password will be set to the - password specified by the IDENTIFIED BY clause, if one is given. If - the user already had a password, it is replaced by the new one.

The test users, as created by the mysql_install_db-script does not have global grant privileges. There is a 'N' in that column in the mysql.user table. They only have a grant option for test* databases. But they can still update the password of any user in the database, including root. To me that seems wrong.

/Viktor...