permission – Page 2 – Gea-Suan Lin's BLOG

pt-show-grants

在「Reinstall MySQL and Preserve All MySQL Grants and Users」這邊看到了 pt-show-grants 這個工具可以直接將權限表輸出成對應的 SQL 指令，像是這樣：

$ pt-show-grants -u root -pmydbr00tpassword
-- Grants dumped by pt-show-grants
-- Dumped from server Localhost via UNIX socket, MySQL 5.7.16-10-log at 2017-01-12 14:19:45
-- Grants for 'mysql.sys'@'localhost'
CREATE USER IF NOT EXISTS 'mysql.sys'@'localhost';
ALTER USER 'mysql.sys'@'localhost' IDENTIFIED WITH 'mysql_native_password' AS '*THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE' REQUIRE NONE PASSWORD EXPIRE DEFAULT ACCOUNT LOCK;
GRANT SELECT ON `sys`.`sys_config` TO 'mysql.sys'@'localhost';
GRANT TRIGGER ON `sys`.* TO 'mysql.sys'@'localhost';
GRANT USAGE ON *.* TO 'mysql.sys'@'localhost';
-- Grants for 'root'@'localhost'
CREATE USER IF NOT EXISTS 'root'@'localhost';
ALTER USER 'root'@'localhost' IDENTIFIED WITH 'mysql_native_password' AS 'x' REQUIRE NONE PASSWORD EXPIRE DEFAULT ACCOUNT UNLOCK;
GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' WITH GRANT OPTION;
GRANT PROXY ON ''@'' TO 'root'@'localhost' WITH GRANT OPTION;

針對權限的部份可以整批搬...

Docker 的權限控制

Red Hat Enterprise Linux Blog 上整理了一篇關於 Docker 目前支援的權限控制：「Secure Your Containers with this One Weird Trick」，目前有 38 個權限可以控制：

Originally the kernel allocated a 32-bit bitmask to define these capabilities. A few years ago it was expanded to 64. There are currently around 38 capabilities defined.

這對於跑一些應用來說還頗不錯的，像是之前提到的「用 Docker 跑 Skype 講電話」，可以再縮限一些權限 :o

把主力手機從 iPhone 換到 Android

上次主力用 Android 應該是 HTC Desire 時代了，那個時候跑得是 2.2。

總算把 LG G2 (D802) 刷完機器了 (刷了半年，每次都卡關 XDDD)，這次刷了 CyanogenMod 與 Open GApps，儘量都用 command line 來刷。

adb devices # 看裝置順便打 RSA public key 進去
adb shell # 進去後可以 ls/su 看一看
adb push filename.zip /sdcard/
adb reboot recovery

Android Marshmallow (6.0) 另外多了對權限的管理，這也是想刷到 6.0 的原因之一，使用者可以隨時 revoke 掉某些權限 (沒有處理好的會 crash XD)：

Android Marshmallow introduces a redesigned application permission model: there are now only eight permission categories, and applications are no longer automatically granted all of their specified permissions at installation time. An opt-in system is now used, in which users are prompted to grant or deny individual permissions (such as the ability to access the camera or microphone) to an application when they are needed for the first time. Applications remember the grants, which can be revoked by the user at any time.

其他安裝的流程主要都是苦工了，尤其是 2FA 是少數為了安全性只能一個一個換的東西 (不提供 export，都是用手機提供的 HSM 避免被盜走)，剛好趁機會把自己與公司用到的 2FA 帳號分開。

Android 上的 Google Authenticator 不怎麼好用 (不能調整位置，另外不希望隨時都給密碼)，測了測 Red Hat 出的 FreeOTP Authenticator 算是比較好用的，就把 FreeOTP Authenticator 拿來給個人用，Google Authenticator 拿來給公司的帳號用。

繼續熟悉現在的 Android 環境，應該會有一陣子不習慣...