Error
Error Code:
1370
MariaDB Error 1370: Routine Access Denied
Description
Error 1370 indicates that a specific MariaDB user, originating from a particular host, attempted to perform an action (like `EXECUTE` or `ALTER`) on a stored routine (procedure or function) but was denied access. This typically happens when the user lacks the required privileges to interact with that routine.
Error Message
%s command denied to user '%s'@'%s' for routine '%s'
Known Causes
4 known causesMissing EXECUTE Privilege
The user does not have the `EXECUTE` privilege specifically granted for the stored procedure or function they are attempting to run.
Insufficient Routine Privileges
Beyond `EXECUTE`, the user might lack other necessary privileges such as `ALTER ROUTINE` or `CREATE ROUTINE` needed for different operations on the routine.
Privileges on Wrong Scope
Privileges were granted to the user, but for a different database, table, or an incorrect routine, not the specific one being accessed.
Host Restriction Mismatch
The user account exists, but the associated privileges are not granted for the specific host from which the user is connecting.
Solutions
3 solutions available1. Grant EXECUTE Privilege to the User easy
Grant the specific user the necessary EXECUTE privilege on the routine that is causing the access denied error.
1
Connect to your MariaDB server as a user with sufficient privileges (e.g., root or a user with GRANT OPTION).
mysql -u root -p2
Identify the exact routine name and the user and host combination from the error message. For example, if the error is 'EXECUTE command denied to user 'app_user'@'localhost' for routine 'my_database.my_stored_procedure'', then the routine is 'my_stored_procedure' in 'my_database', and the user is 'app_user'@'localhost'.
3
Grant the EXECUTE privilege to the user for the specific routine. Replace 'your_user', 'your_host', 'your_database', and 'your_routine' with the actual values.
GRANT EXECUTE ON FUNCTION your_database.your_function TO 'your_user'@'your_host';
GRANT EXECUTE ON PROCEDURE your_database.your_procedure TO 'your_user'@'your_host';4
Apply the privilege changes.
FLUSH PRIVILEGES;5
Test the operation that previously failed.
2. Grant Global EXECUTE Privilege (Use with Caution) medium
Grant the EXECUTE privilege to the user for all routines in a specific database or globally. This is a broader permission and should be used judiciously.
1
Connect to your MariaDB server as a privileged user.
mysql -u root -p2
Grant EXECUTE privilege on all routines within a specific database. Replace 'your_database' and 'your_user'@'your_host' with actual values.
GRANT EXECUTE ON your_database.* TO 'your_user'@'your_host';3
Alternatively, grant EXECUTE privilege on all routines across all databases (use with extreme caution). Replace 'your_user'@'your_host' with actual values.
GRANT EXECUTE ON *.* TO 'your_user'@'your_host';4
Apply the privilege changes.
FLUSH PRIVILEGES;5
Test the operation.
3. Review and Correct Routine Ownership/Permissions advanced
Ensure the routine itself has the correct definer and is accessible by the user trying to execute it. This is more about the routine's properties than the user's permissions.
1
Connect to your MariaDB server.
mysql -u root -p2
Inspect the definer of the routine. The definer is the user who created the routine and whose privileges are used when the routine is executed (in some contexts, like SQL SECURITY INVOKER).
SHOW CREATE FUNCTION your_database.your_function;
SHOW CREATE PROCEDURE your_database.your_procedure;3
If the definer is a user that no longer exists or has insufficient privileges, you might need to re-create the routine with a different definer or grant the definer the necessary permissions.
4
Consider the `SQL SECURITY` clause of the routine. If it's `DEFINER` (the default), the definer's privileges are used. If it's `INVOKER`, the privileges of the user calling the routine are used. If the routine is `SQL SECURITY DEFINER` and the definer has lost permissions or is incorrect, this can cause issues for the invoker.
5
If necessary, alter the routine to change the definer or the security context, or re-create it with the correct definer. This often requires dropping and re-creating the routine.
ALTER FUNCTION your_database.your_function SQL SECURITY INVOKER;
-- Or re-create the routine with a new definer6
Ensure the user attempting to execute the routine has the necessary read/write/execute permissions on the tables or other objects *used within* the routine if `SQL SECURITY INVOKER` is set.