WL#925 - Privileges for stored routines

  Implement fine-grained control over access to stored procedures
  Privileges are cached (same way as existing table/column privs)
  


mysql-test/include/system_db_struct.inc:
  WL#925 - Privileges for stored routines
    New system table: procs_priv
mysql-test/r/connect.result:
  WL#925 - Privileges for stored routines
    New system table: procs_priv
mysql-test/r/grant.result:
  WL#925 - Privileges for stored routines
    user table has additional privilege attributes
    SHOW PRIVILEGES amended
mysql-test/r/grant2.result:
  Fix result
mysql-test/r/information_schema.result:
  WL#925 - Privileges for stored routines
    New system table procs_priv
    New user privileges
mysql-test/r/show_check.result:
  Fix result
mysql-test/r/sp-security.result:
  WL#925 - Privileges for stored routines
    Fix existing tests to work with new privileges
    New tests for new privileges
mysql-test/r/sp.result:
  WL#925 - Privileges for stored routines
    Fix SHOW PRIVILEGES results
mysql-test/r/system_mysql_db.result:
  WL#925 - Privileges for stored routines
    New system table: procs_priv
    user and db tables have new privilege attributes
mysql-test/t/grant2.test:
  Fix test
mysql-test/t/show_check.test:
  Fix test
mysql-test/t/sp-security.test:
  WL#925 - Privileges for stored routines
    Allow existing tests to run with new privilege checks
    New tests for privileges
mysql-test/t/system_mysql_db_fix.test:
  WL#925 - Privileges for stored routines
    New system table: procs_priv
scripts/mysql_create_system_tables.sh:
  WL#925 - Privileges for stored routines
    db and user has new privilege attributes
    new system table: procs_priv
scripts/mysql_fix_privilege_tables.sql:
  WL#925 - Privileges for stored routines
    new system table: procs_priv
scripts/mysql_install_db.sh:
  WL#925 - Privileges for stored routines
    Amend comment
sql/item_func.cc:
  WL#925 - Privileges for stored routines
    Privilege check for stored FUNCTION routine
sql/lex.h:
  WL#925 - Privileges for stored routines
    new token ROUTINE
sql/mysql_priv.h:
  WL#925 - Privileges for stored routines
    New function: check_procedure_access()
sql/mysqld.cc:
  WL#925 - Privileges for stored routines
    system option automatic-sp-privileges
sql/set_var.cc:
  WL#925 - Privileges for stored routines
    system option automatic-sp-privileges
sql/share/errmsg.txt:
  WL#925 - Privileges for stored routines
    rename errormessage to conform:
      ER_SP_ACCESS_DENIED_ERROR -> ER_PROCACCESS_DENIED_ERROR
    New error messages
      ER_NONEXISTING_PROC_GRANT, ER_PROC_AUTO_GRANT_FAIL, ER_PROC_AUTO_REVOKE_FAIL
sql/sp.cc:
  WL#925 - Privileges for stored routines
    new function: sp_exists_routine()
sql/sp.h:
  WL#925 - Privileges for stored routines
    new function: sp_exists_routine()
sql/sql_acl.cc:
  WL#925 - Privileges for stored routines
    Implementation for SP privileges.
    Privileges are cached in memory hash.
    New functions:
      mysql_procedure_grant()
      check_grant_procedure()
      sp_revoke_privileges()
      sp_grant_privileges()
sql/sql_acl.h:
  WL#925 - Privileges for stored routines
    New privilege bits: CREATE_PROC_ACL, ALTER_PROC_ACL
    Alter confusing bit-segments to be shifted
    New macros: fix_rights_for_procedure() get_rights_for_procedure()
    New functions:
      mysql_procedure_grant()
      check_grant_procedure()
      sp_grant_privileges()
      sp_revoke_privileges()
sql/sql_lex.h:
  WL#925 - Privileges for stored routines
    new all_privileges attribute in LEX
sql/sql_parse.cc:
  WL#925 - Privileges for stored routines
    Remove function: check_sp_definer_access()
    Add handling for SP grants/revokes
    Add privilege checks for stored procedure invocation
sql/sql_show.cc:
  WL#925 - Privileges for stored routines
    update result for SHOW PRIVILEGES
sql/sql_yacc.yy:
  WL#925 - Privileges for stored routines
    New token ROUTINE
    rename some rules
    handle CREATE ROUTINE / ALTER ROUTINE privileges

13 files changed, 226 insertions, 33 deletions

diff --git a/mysql-test/include/system_db_struct.inc b/mysql-test/include/system_db_struct.inc
index 5a7aa26c65a..e24c8f3311d 100644
--- a/mysql-test/include/system_db_struct.inc
+++ b/mysql-test/include/system_db_struct.inc
@@ -10,3 +10,4 @@ show create table user;
 show create table func;
 show create table tables_priv;
 show create table columns_priv;
+show create table procs_priv;
diff --git a/mysql-test/r/connect.result b/mysql-test/r/connect.result
index 702b725764b..fef813371c8 100644
--- a/mysql-test/r/connect.result
+++ b/mysql-test/r/connect.result
@@ -9,6 +9,7 @@ help_relation
 help_topic
 host
 proc
+procs_priv
 tables_priv
 time_zone
 time_zone_leap_second
@@ -31,6 +32,7 @@ help_relation
 help_topic
 host
 proc
+procs_priv
 tables_priv
 time_zone
 time_zone_leap_second
@@ -57,6 +59,7 @@ help_relation
 help_topic
 host
 proc
+procs_priv
 tables_priv
 time_zone
 time_zone_leap_second
diff --git a/mysql-test/r/grant.result b/mysql-test/r/grant.result
index b69ba9702a6..629a3221330 100644
--- a/mysql-test/r/grant.result
+++ b/mysql-test/r/grant.result
@@ -10,8 +10,8 @@ GRANT USAGE ON *.* TO 'mysqltest_1'@'localhost' REQUIRE CIPHER 'EDH-RSA-DES-CBC3
 GRANT SELECT ON `mysqltest`.* TO 'mysqltest_1'@'localhost'
 grant delete on mysqltest.* to mysqltest_1@localhost;
 select * from mysql.user where user="mysqltest_1";
-Host	User	Password	Select_priv	Insert_priv	Update_priv	Delete_priv	Create_priv	Drop_priv	Reload_priv	Shutdown_priv	Process_priv	File_priv	Grant_priv	References_priv	Index_priv	Alter_priv	Show_db_priv	Super_priv	Create_tmp_table_priv	Lock_tables_priv	Execute_priv	Repl_slave_priv	Repl_client_priv	Create_view_priv	Show_view_priv	ssl_type	ssl_cipher	x509_issuer	x509_subject	max_questions	max_updates	max_connections
-localhost	mysqltest_1		N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N							0	0	0
+Host	User	Password	Select_priv	Insert_priv	Update_priv	Delete_priv	Create_priv	Drop_priv	Reload_priv	Shutdown_priv	Process_priv	File_priv	Grant_priv	References_priv	Index_priv	Alter_priv	Show_db_priv	Super_priv	Create_tmp_table_priv	Lock_tables_priv	Execute_priv	Repl_slave_priv	Repl_client_priv	Create_view_priv	Show_view_priv	Create_routine_priv	Alter_routine_priv	ssl_type	ssl_cipher	x509_issuer	x509_subject	max_questions	max_updates	max_connections
+localhost	mysqltest_1		N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N	N									0	0	0
 show grants for mysqltest_1@localhost;
 Grants for mysqltest_1@localhost
 GRANT USAGE ON *.* TO 'mysqltest_1'@'localhost' REQUIRE CIPHER 'EDH-RSA-DES-CBC3-SHA'
@@ -62,7 +62,7 @@ revoke LOCK TABLES, ALTER on mysqltest.* from mysqltest_1@localhost;
 show grants for mysqltest_1@localhost;
 Grants for mysqltest_1@localhost
 GRANT USAGE ON *.* TO 'mysqltest_1'@'localhost'
-GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, REFERENCES, INDEX, CREATE TEMPORARY TABLES, CREATE VIEW, SHOW VIEW ON `mysqltest`.* TO 'mysqltest_1'@'localhost' WITH GRANT OPTION
+GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, REFERENCES, INDEX, CREATE TEMPORARY TABLES, EXECUTE, CREATE VIEW, SHOW VIEW, CREATE ROUTINE, ALTER ROUTINE ON `mysqltest`.* TO 'mysqltest_1'@'localhost' WITH GRANT OPTION
 revoke all privileges on mysqltest.* from mysqltest_1@localhost;
 delete from mysql.user where user='mysqltest_1';
 flush privileges;
@@ -347,13 +347,16 @@ drop table t1;
 SHOW PRIVILEGES;
 Privilege	Context	Comment
 Alter	Tables	To alter the table
+Alter routine	Functions,Procedures	To alter or drop stored functions/procedures
 Create	Databases,Tables,Indexes	To create new databases and tables
+Create routine	Functions,Procedures	To use CREATE FUNCTION/PROCEDURE
 Create temporary tables	Databases	To use CREATE TEMPORARY TABLE
 Create view	Tables	To create new views
 Delete	Tables	To delete existing rows
 Drop	Databases,Tables	To drop databases, tables, and views
+Execute	Functions,Procedures	To execute stored routines
 File	File access on server	To read and write files on the server
-Grant option	Databases,Tables	To give to other users those privileges you possess
+Grant option	Databases,Tables,Functions,Procedures	To give to other users those privileges you possess
 Index	Tables	To create or drop indexes
 Insert	Tables	To insert data into tables
 Lock tables	Databases	To use LOCK TABLES (together with SELECT privilege)
diff --git a/mysql-test/r/grant2.result b/mysql-test/r/grant2.result
index edfd1a07680..48cbac10d46 100644
--- a/mysql-test/r/grant2.result
+++ b/mysql-test/r/grant2.result
@@ -48,9 +48,9 @@ GRANT SELECT, INSERT ON `mysqltest`.* TO 'mysqltest_1'@'localhost'
 use mysqltest;
 insert into t1 values (1, 'I can''t change it!');
 update t1 set data='I can change it!' where id = 1;
-ERROR 42000: Access denied for user 'mysqltest_1'@'localhost' to database 'mysqltest'
+ERROR 42000: update command denied to user 'mysqltest_1'@'localhost' for table 't1'
 insert into t1 values (1, 'XXX') on duplicate key update data= 'I can change it!';
-ERROR 42000: Access denied for user 'mysqltest_1'@'localhost' to database 'mysqltest'
+ERROR 42000: update command denied to user 'mysqltest_1'@'localhost' for table 't1'
 select * from t1;
 id	data
 1	I can't change it!
@@ -202,7 +202,7 @@ drop user '%@a'@'a';
 create user mysqltest_2@localhost;
 grant usage on *.* to mysqltest_2@localhost with grant option;
 select host,user,password from mysql.user where user like 'mysqltest_%' order by host,user,password;
-ERROR 42000: Access denied for user 'mysqltest_2'@'localhost' to database 'mysql'
+ERROR 42000: select command denied to user 'mysqltest_2'@'localhost' for table 'user'
 create user mysqltest_A@'%';
 rename user mysqltest_A@'%' to mysqltest_B@'%';
 drop user mysqltest_B@'%';
diff --git a/mysql-test/r/information_schema.result b/mysql-test/r/information_schema.result
index 0bd3ba14636..6cd58674a3c 100644
--- a/mysql-test/r/information_schema.result
+++ b/mysql-test/r/information_schema.result
@@ -58,6 +58,7 @@ help_relation
 help_topic
 host
 proc
+procs_priv
 tables_priv
 time_zone
 time_zone_leap_second
@@ -346,8 +347,11 @@ GRANTEE	TABLE_CATALOG	TABLE_SCHEMA	PRIVILEGE_TYPE	IS_GRANTABLE
 'mysqltest_1'@'localhost'	NULL	test	ALTER	YES
 'mysqltest_1'@'localhost'	NULL	test	CREATE TEMPORARY TABLES	YES
 'mysqltest_1'@'localhost'	NULL	test	LOCK TABLES	YES
+'mysqltest_1'@'localhost'	NULL	test	EXECUTE	YES
 'mysqltest_1'@'localhost'	NULL	test	CREATE VIEW	YES
 'mysqltest_1'@'localhost'	NULL	test	SHOW VIEW	YES
+'mysqltest_1'@'localhost'	NULL	test	CREATE ROUTINE	YES
+'mysqltest_1'@'localhost'	NULL	test	ALTER ROUTINE	YES
 select * from information_schema.TABLE_PRIVILEGES where grantee like '%mysqltest_1%';
 GRANTEE	TABLE_CATALOG	TABLE_SCHEMA	TABLE_NAME	PRIVILEGE_TYPE	IS_GRANTABLE
 'mysqltest_1'@'localhost'	NULL	test	t1	SELECT	NO
@@ -600,6 +604,8 @@ Process_priv	select,insert,update,references
 Show_db_priv	select,insert,update,references
 Lock_tables_priv	select,insert,update,references
 Show_view_priv	select,insert,update,references
+Create_routine_priv	select,insert,update,references
+Alter_routine_priv	select,insert,update,references
 max_questions	select,insert,update,references
 max_connections	select,insert,update,references
 use test;
diff --git a/mysql-test/r/show_check.result b/mysql-test/r/show_check.result
index ec9bd33d301..c1cabce7e92 100644
--- a/mysql-test/r/show_check.result
+++ b/mysql-test/r/show_check.result
@@ -382,19 +382,19 @@ show create database mysqltest;
 Database	Create Database
 mysqltest	CREATE DATABASE `mysqltest` /*!40100 DEFAULT CHARACTER SET latin1 */
 drop table t1;
-ERROR 42000: Access denied for user 'mysqltest_1'@'localhost' to database 'mysqltest'
+ERROR 42000: drop command denied to user 'mysqltest_1'@'localhost' for table 't1'
 drop database mysqltest;
 ERROR 42000: Access denied for user 'mysqltest_1'@'localhost' to database 'mysqltest'
 select * from mysqltest.t1;
-ERROR 42000: Access denied for user 'mysqltest_2'@'localhost' to database 'mysqltest'
+ERROR 42000: select command denied to user 'mysqltest_2'@'localhost' for table 't1'
 show create database mysqltest;
 ERROR 42000: Access denied for user 'mysqltest_2'@'localhost' to database 'mysqltest'
 drop table mysqltest.t1;
-ERROR 42000: Access denied for user 'mysqltest_2'@'localhost' to database 'mysqltest'
+ERROR 42000: drop command denied to user 'mysqltest_2'@'localhost' for table 't1'
 drop database mysqltest;
 ERROR 42000: Access denied for user 'mysqltest_2'@'localhost' to database 'mysqltest'
 select * from mysqltest.t1;
-ERROR 42000: Access denied for user 'mysqltest_3'@'localhost' to database 'mysqltest'
+ERROR 42000: select command denied to user 'mysqltest_3'@'localhost' for table 't1'
 show create database mysqltest;
 ERROR 42000: Access denied for user 'mysqltest_3'@'localhost' to database 'mysqltest'
 drop table mysqltest.t1;
diff --git a/mysql-test/r/sp-security.result b/mysql-test/r/sp-security.result
index 25582796812..365368873fa 100644
--- a/mysql-test/r/sp-security.result
+++ b/mysql-test/r/sp-security.result
@@ -23,12 +23,16 @@ root@localhost	1
 select db();
 db()
 db1_secret
+grant execute on db1_secret.stamp to user1@'%';
+grant execute on db1_secret.db to user1@'%';
+grant execute on db1_secret.stamp to ''@'%';
+grant execute on db1_secret.db to ''@'%';
 call db1_secret.stamp(2);
 select db1_secret.db();
 db1_secret.db()
 db1_secret
 select * from db1_secret.t1;
-ERROR 42000: Access denied for user 'user1'@'localhost' to database 'db1_secret'
+ERROR 42000: select command denied to user 'user1'@'localhost' for table 't1'
 create procedure db1_secret.dummy() begin end;
 ERROR 42000: Access denied for user 'user1'@'localhost' to database 'db1_secret'
 drop procedure db1_secret.dummy;
@@ -38,7 +42,7 @@ select db1_secret.db();
 db1_secret.db()
 db1_secret
 select * from db1_secret.t1;
-ERROR 42000: Access denied for user ''@'localhost' to database 'db1_secret'
+ERROR 42000: select command denied to user ''@'localhost' for table 't1'
 create procedure db1_secret.dummy() begin end;
 ERROR 42000: Access denied for user ''@'localhost' to database 'db1_secret'
 drop procedure db1_secret.dummy;
@@ -82,15 +86,16 @@ insert into t2 values (0);
 grant usage on db2.* to user1@localhost;
 grant select on db2.* to user1@localhost;
 grant usage on db2.* to user2@localhost;
-grant select,insert,update,delete on db2.* to user2@localhost;
+grant select,insert,update,delete,create routine on db2.* to user2@localhost;
+grant create routine on db2.* to user1@localhost;
 flush privileges;
 use db2;
 create procedure p () insert into t2 values (1);
 call p();
-ERROR 42000: Access denied for user 'user1'@'localhost' to database 'db2'
+ERROR 42000: insert command denied to user 'user1'@'localhost' for table 't2'
 use db2;
 call p();
-ERROR 42000: Access denied for user 'user1'@'localhost' to database 'db2'
+ERROR 42000: execute command denied to user 'user2'@'localhost' for routine 'db2.p'
 select * from t2;
 s1
 0
@@ -100,6 +105,8 @@ select * from t2;
 s1
 0
 2
+grant usage on db2.q to user2@localhost with grant option;
+grant execute on db2.q to user1@localhost;
 use db2;
 call q();
 select * from t2;
@@ -110,9 +117,9 @@ s1
 alter procedure p modifies sql data;
 drop procedure p;
 alter procedure q modifies sql data;
-ERROR 42000: Access denied; you are not the procedure/function definer of 'db2.q'
+ERROR 42000: alter procedure command denied to user 'user1'@'localhost' for routine 'db2.q'
 drop procedure q;
-ERROR 42000: Access denied; you are not the procedure/function definer of 'db2.q'
+ERROR 42000: alter procedure command denied to user 'user1'@'localhost' for routine 'db2.q'
 use db2;
 alter procedure q modifies sql data;
 drop procedure q;
@@ -126,3 +133,64 @@ drop database db2;
 select type,db,name from mysql.proc;
 type	db	name
 delete from mysql.user where user='user1' or user='user2';
+delete from mysql.procs_priv where user='user1' or user='user2';
+grant usage on *.* to usera@localhost;
+grant usage on *.* to userb@localhost;
+grant usage on *.* to userc@localhost;
+create database sptest;
+create table t1 ( u varchar(64), i int );
+create procedure sptest.p1(i int) insert into test.t1 values (user(), i);
+grant insert on t1 to usera@localhost;
+grant execute on sptest.p1 to usera@localhost;
+show grants for usera@localhost;
+Grants for usera@localhost
+GRANT USAGE ON *.* TO 'usera'@'localhost'
+GRANT INSERT ON `test`.`t1` TO 'usera'@'localhost'
+GRANT EXECUTE ON `sptest`.`p1` TO 'usera'@'localhost'
+grant execute on sptest.p1 to userc@localhost with grant option;
+show grants for userc@localhost;
+Grants for userc@localhost
+GRANT USAGE ON *.* TO 'userc'@'localhost'
+GRANT EXECUTE ON `sptest`.`p1` TO 'userc'@'localhost' WITH GRANT OPTION
+call sptest.p1(1);
+grant execute on sptest.p1 to userb@localhost;
+ERROR 42000: grant command denied to user 'usera'@'localhost' for routine 'sptest.p1'
+drop procedure sptest.p1;
+ERROR 42000: alter procedure command denied to user 'usera'@'localhost' for routine 'sptest.p1'
+call sptest.p1(2);
+ERROR 42000: execute command denied to user 'userb'@'localhost' for routine 'sptest.p1'
+grant execute on sptest.p1 to userb@localhost;
+ERROR 42000: execute command denied to user 'userb'@'localhost' for routine 'sptest.p1'
+drop procedure sptest.p1;
+ERROR 42000: alter procedure command denied to user 'userb'@'localhost' for routine 'sptest.p1'
+call sptest.p1(3);
+grant execute on sptest.p1 to userb@localhost;
+drop procedure sptest.p1;
+ERROR 42000: alter procedure command denied to user 'userc'@'localhost' for routine 'sptest.p1'
+call sptest.p1(4);
+grant execute on sptest.p1 to userb@localhost;
+ERROR 42000: grant command denied to user 'userb'@'localhost' for routine 'sptest.p1'
+drop procedure sptest.p1;
+ERROR 42000: alter procedure command denied to user 'userb'@'localhost' for routine 'sptest.p1'
+select * from t1;
+u	i
+usera@localhost	1
+userc@localhost	3
+userb@localhost	4
+grant all privileges on sptest.p1 to userc@localhost;
+show grants for userc@localhost;
+Grants for userc@localhost
+GRANT USAGE ON *.* TO 'userc'@'localhost'
+GRANT EXECUTE, ALTER ROUTINE ON `sptest`.`p1` TO 'userc'@'localhost' WITH GRANT OPTION
+show grants for userb@localhost;
+Grants for userb@localhost
+GRANT USAGE ON *.* TO 'userb'@'localhost'
+GRANT EXECUTE ON `sptest`.`p1` TO 'userb'@'localhost'
+revoke all privileges on sptest.p1 from userb@localhost;
+show grants for userb@localhost;
+Grants for userb@localhost
+GRANT USAGE ON *.* TO 'userb'@'localhost'
+use test;
+drop database sptest;
+delete from mysql.user where user='usera' or user='userb' or user='userc';
+delete from mysql.procs_priv where user='usera' or user='userb' or user='userc';
diff --git a/mysql-test/r/sp.result b/mysql-test/r/sp.result
index 0d7f9f7d50c..269c4104a05 100644
--- a/mysql-test/r/sp.result
+++ b/mysql-test/r/sp.result
@@ -1654,13 +1654,16 @@ Table	Non_unique	Key_name	Seq_in_index	Column_name	Collation	Cardinality	Sub_par
 Database	Table	In_use	Name_locked
 Privilege	Context	Comment
 Alter	Tables	To alter the table
+Alter routine	Functions,Procedures	To alter or drop stored functions/procedures
 Create	Databases,Tables,Indexes	To create new databases and tables
+Create routine	Functions,Procedures	To use CREATE FUNCTION/PROCEDURE
 Create temporary tables	Databases	To use CREATE TEMPORARY TABLE
 Create view	Tables	To create new views
 Delete	Tables	To delete existing rows
 Drop	Databases,Tables	To drop databases, tables, and views
+Execute	Functions,Procedures	To execute stored routines
 File	File access on server	To read and write files on the server
-Grant option	Databases,Tables	To give to other users those privileges you possess
+Grant option	Databases,Tables,Functions,Procedures	To give to other users those privileges you possess
 Index	Tables	To create or drop indexes
 Insert	Tables	To insert data into tables
 Lock tables	Databases	To use LOCK TABLES (together with SELECT privilege)
@@ -1704,13 +1707,16 @@ Table	Non_unique	Key_name	Seq_in_index	Column_name	Collation	Cardinality	Sub_par
 Database	Table	In_use	Name_locked
 Privilege	Context	Comment
 Alter	Tables	To alter the table
+Alter routine	Functions,Procedures	To alter or drop stored functions/procedures
 Create	Databases,Tables,Indexes	To create new databases and tables
+Create routine	Functions,Procedures	To use CREATE FUNCTION/PROCEDURE
 Create temporary tables	Databases	To use CREATE TEMPORARY TABLE
 Create view	Tables	To create new views
 Delete	Tables	To delete existing rows
 Drop	Databases,Tables	To drop databases, tables, and views
+Execute	Functions,Procedures	To execute stored routines
 File	File access on server	To read and write files on the server
-Grant option	Databases,Tables	To give to other users those privileges you possess
+Grant option	Databases,Tables,Functions,Procedures	To give to other users those privileges you possess
 Index	Tables	To create or drop indexes
 Insert	Tables	To insert data into tables
 Lock tables	Databases	To use LOCK TABLES (together with SELECT privilege)
diff --git a/mysql-test/r/system_mysql_db.result b/mysql-test/r/system_mysql_db.result
index 400b508ff50..e9606ec5f88 100644
--- a/mysql-test/r/system_mysql_db.result
+++ b/mysql-test/r/system_mysql_db.result
@@ -9,6 +9,7 @@ help_relation
 help_topic
 host
 proc
+procs_priv
 tables_priv
 time_zone
 time_zone_leap_second
@@ -36,6 +37,9 @@ db	CREATE TABLE `db` (
   `Lock_tables_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
   `Create_view_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
   `Show_view_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
+  `Create_routine_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
+  `Alter_routine_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
+  `Execute_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
   PRIMARY KEY  (`Host`,`Db`,`User`),
   KEY `User` (`User`)
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8 COLLATE=utf8_bin COMMENT='Database privileges'
@@ -89,6 +93,8 @@ user	CREATE TABLE `user` (
   `Repl_client_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
   `Create_view_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
   `Show_view_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
+  `Create_routine_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
+  `Alter_routine_priv` enum('N','Y') collate utf8_bin NOT NULL default 'N',
   `ssl_type` enum('','ANY','X509','SPECIFIED') collate utf8_bin NOT NULL default '',
   `ssl_cipher` blob NOT NULL,
   `x509_issuer` blob NOT NULL,
@@ -133,5 +139,18 @@ columns_priv	CREATE TABLE `columns_priv` (
   `Column_priv` set('Select','Insert','Update','References') collate utf8_bin NOT NULL default '',
   PRIMARY KEY  (`Host`,`Db`,`User`,`Table_name`,`Column_name`)
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8 COLLATE=utf8_bin COMMENT='Column privileges'
+show create table procs_priv;
+Table	Create Table
+procs_priv	CREATE TABLE `procs_priv` (
+  `Host` char(60) collate utf8_bin NOT NULL default '',
+  `Db` char(64) collate utf8_bin NOT NULL default '',
+  `User` char(16) collate utf8_bin NOT NULL default '',
+  `Routine_name` char(64) collate utf8_bin NOT NULL default '',
+  `Grantor` char(77) collate utf8_bin NOT NULL default '',
+  `Timestamp` timestamp NOT NULL default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP,
+  `Proc_priv` set('Execute','Alter Routine','Grant') collate utf8_bin NOT NULL default '',
+  PRIMARY KEY  (`Host`,`Db`,`User`,`Routine_name`),
+  KEY `Grantor` (`Grantor`)
+) ENGINE=MyISAM DEFAULT CHARSET=utf8 COLLATE=utf8_bin COMMENT='Procedure privileges'
 show tables;
 Tables_in_test
diff --git a/mysql-test/t/grant2.test b/mysql-test/t/grant2.test
index 69c42ce2252..ad3fc1c228e 100644
--- a/mysql-test/t/grant2.test
+++ b/mysql-test/t/grant2.test
@@ -64,10 +64,10 @@ connection mrbad;
 show grants for current_user();
 use mysqltest;
 insert into t1 values (1, 'I can''t change it!');
---error 1044
+--error 1142
 update t1 set data='I can change it!' where id = 1;
 # This should not be allowed since it too require UPDATE privilege.
---error 1044
+--error 1142
 insert into t1 values (1, 'XXX') on duplicate key update data= 'I can change it!';
 select * from t1;
 
@@ -199,7 +199,7 @@ create user mysqltest_2@localhost;
 grant usage on *.* to mysqltest_2@localhost with grant option;
 connect (user2,localhost,mysqltest_2,,);
 connection user2;
---error 1044
+--error 1142
 select host,user,password from mysql.user where user like 'mysqltest_%' order by host,user,password;
 create user mysqltest_A@'%';
 rename user mysqltest_A@'%' to mysqltest_B@'%';
diff --git a/mysql-test/t/show_check.test b/mysql-test/t/show_check.test
index 8680da9b31a..566f9f625df 100644
--- a/mysql-test/t/show_check.test
+++ b/mysql-test/t/show_check.test
@@ -287,25 +287,25 @@ connect (con1,localhost,mysqltest_1,,mysqltest);
 connection con1;
 select * from t1;
 show create database mysqltest;
---error 1044
+--error 1142
 drop table t1;
 --error 1044
 drop database mysqltest;
 
 connect (con2,localhost,mysqltest_2,,test);
 connection con2;
---error 1044
+--error 1142
 select * from mysqltest.t1;
 --error 1044
 show create database mysqltest;
---error 1044
+--error 1142
 drop table mysqltest.t1;
 --error 1044
 drop database mysqltest;
 
 connect (con3,localhost,mysqltest_3,,test);
 connection con3;
---error 1044
+--error 1142
 select * from mysqltest.t1;
 --error 1044
 show create database mysqltest;
diff --git a/mysql-test/t/sp-security.test b/mysql-test/t/sp-security.test
index d1119499cf1..aad5f4eaf9e 100644
--- a/mysql-test/t/sp-security.test
+++ b/mysql-test/t/sp-security.test
@@ -40,6 +40,11 @@ call stamp(1);
 select * from t1;
 select db();
 
+grant execute on db1_secret.stamp to user1@'%';
+grant execute on db1_secret.db to user1@'%';
+grant execute on db1_secret.stamp to ''@'%';
+grant execute on db1_secret.db to ''@'%';
+
 connect (con2user1,localhost,user1,,);
 connect (con3anon,localhost,anon,,);
 
@@ -54,7 +59,7 @@ call db1_secret.stamp(2);
 select db1_secret.db();
 
 # ...but not this
---error 1044
+--error 1142
 select * from db1_secret.t1;
 
 # ...and not this
@@ -74,7 +79,7 @@ call db1_secret.stamp(3);
 select db1_secret.db();
 
 # ...but not this
---error 1044
+--error 1142
 select * from db1_secret.t1;
 
 # ...and not this
@@ -146,7 +151,8 @@ insert into t2 values (0);
 grant usage on db2.* to user1@localhost;
 grant select on db2.* to user1@localhost;
 grant usage on db2.* to user2@localhost;
-grant select,insert,update,delete on db2.* to user2@localhost;
+grant select,insert,update,delete,create routine on db2.* to user2@localhost;
+grant create routine on db2.* to user1@localhost;
 flush privileges;
 
 connection con2user1;
@@ -155,7 +161,7 @@ use db2;
 create procedure p () insert into t2 values (1);
 
 # Check that this doesn't work.
---error 1044
+--error 1142
 call p();
 
 connect (con4user2,localhost,user2,,);
@@ -164,7 +170,7 @@ connection con4user2;
 use db2;
 
 # This should not work, since p is executed with definer's (user1's) rights.
---error 1044
+--error 1370
 call p();
 select * from t2;
 
@@ -173,6 +179,12 @@ create procedure q () insert into t2 values (2);
 call q();
 select * from t2;
 
+connection con1root;
+grant usage on db2.q to user2@localhost with grant option;
+
+connection con4user2;
+grant execute on db2.q to user1@localhost;
+
 connection con2user1;
 use db2;
 
@@ -206,6 +218,9 @@ drop procedure q;
 
 # Clean up
 #Still connection con1root;
+disconnect con2user1;
+disconnect con3anon;
+disconnect con4user2;
 use test;
 select type,db,name from mysql.proc;
 drop database db1_secret;
@@ -214,3 +229,75 @@ drop database db2;
 select type,db,name from mysql.proc;
 # Get rid of the users
 delete from mysql.user where user='user1' or user='user2';
+# And any routine privileges
+delete from mysql.procs_priv where user='user1' or user='user2';
+
+#
+# Test the new security acls
+#
+grant usage on *.* to usera@localhost;
+grant usage on *.* to userb@localhost;
+grant usage on *.* to userc@localhost;
+create database sptest;
+create table t1 ( u varchar(64), i int );
+create procedure sptest.p1(i int) insert into test.t1 values (user(), i);
+grant insert on t1 to usera@localhost;
+grant execute on sptest.p1 to usera@localhost;
+show grants for usera@localhost;
+grant execute on sptest.p1 to userc@localhost with grant option;
+show grants for userc@localhost;
+
+connect (con2usera,localhost,usera,,);
+connect (con3userb,localhost,userb,,);
+connect (con4userc,localhost,userc,,);
+
+connection con2usera;
+call sptest.p1(1);
+--error 1370
+grant execute on sptest.p1 to userb@localhost;
+--error 1370
+drop procedure sptest.p1;
+
+connection con3userb;
+--error 1370
+call sptest.p1(2);
+--error 1370
+grant execute on sptest.p1 to userb@localhost;
+--error 1370
+drop procedure sptest.p1;
+
+connection con4userc;
+call sptest.p1(3);
+grant execute on sptest.p1 to userb@localhost;
+--error 1370
+drop procedure sptest.p1;
+
+connection con3userb;
+call sptest.p1(4);
+--error 1370
+grant execute on sptest.p1 to userb@localhost;
+--error 1370
+drop procedure sptest.p1;
+
+connection con1root;
+select * from t1;
+
+grant all privileges on sptest.p1 to userc@localhost;
+show grants for userc@localhost;
+show grants for userb@localhost;
+
+connection con4userc;
+revoke all privileges on sptest.p1 from userb@localhost;
+
+connection con1root;
+show grants for userb@localhost;
+
+#cleanup
+disconnect con4userc;
+disconnect con3userb;
+disconnect con2usera;
+use test;
+drop database sptest;
+delete from mysql.user where user='usera' or user='userb' or user='userc';
+delete from mysql.procs_priv where user='usera' or user='userb' or user='userc';
+
diff --git a/mysql-test/t/system_mysql_db_fix.test b/mysql-test/t/system_mysql_db_fix.test
index e34dbefbcba..56f291ae69d 100644
--- a/mysql-test/t/system_mysql_db_fix.test
+++ b/mysql-test/t/system_mysql_db_fix.test
@@ -74,7 +74,7 @@ INSERT INTO user VALUES ('localhost','',    '','N','N','N','N','N','N','N','N','
 
 -- disable_query_log
 
-DROP TABLE db, host, user, func, tables_priv, columns_priv, help_category, help_keyword, help_relation, help_topic, proc, time_zone, time_zone_leap_second, time_zone_name, time_zone_transition, time_zone_transition_type;
+DROP TABLE db, host, user, func, tables_priv, columns_priv, procs_priv, help_category, help_keyword, help_relation, help_topic, proc, time_zone, time_zone_leap_second, time_zone_name, time_zone_transition, time_zone_transition_type;
 
 -- enable_query_log