privilege: fix auth_socket bug, should only allow os user name to login (#54032)

[ti-chi-bot]

This is an automated cherry-pick of #54032

What problem does this PR solve?

Issue Number: close #54031

Problem Summary:

What changed and how does it work?

Check List

Tests

• Unit test
• Integration test
• Manual test (add detailed scripts or steps below)

1. my os user is wangchao

$ whoami
wangchao

2. create users:

> CREATE USER 'u1'@'localhost' IDENTIFIED WITH auth_socket;
Query OK, 0 rows affected
Time: 0.017s
> CREATE USER 'u2'@'localhost' IDENTIFIED WITH auth_socket AS "wangchao";
Query OK, 0 rows affected
Time: 0.012s
> CREATE USER 'wangchao'@'localhost' IDENTIFIED WITH auth_socket;
Query OK, 0 rows affected
Time: 0.025s
TiDB root@127.0.0.1:test> select host,user,authentication_string,plugin from mysql.user;
+-----------+----------+-----------------------+-----------------------+
| host      | user     | authentication_string | plugin                |
+-----------+----------+-----------------------+-----------------------+
| %         | root     |                       | mysql_native_password |
| localhost | u1       |                       | auth_socket           |
| localhost | u2       | wangchao              | auth_socket           |
| localhost | wangchao |                       | auth_socket           |
+-----------+----------+-----------------------+-----------------------+
4 rows in set
Time: 0.011s

3. Try log in:

u1 is rejected because it is not same with os user:

$ mysql --comments -uu1 -S/tmp/tidb-4001.sock
ERROR 1045 (28000): Access denied for user 'u1'@'localhost' (using password: YES)

u2 is allowed because its authenticate string is same with os user:

$ mysql --comments -uu2 -S/tmp/tidb-4001.sock
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 2097182
Server version: 8.0.11-TiDB-None TiDB Server (Apache License 2.0) Community Edition, MySQL 8.0 compatible
...

wangchao is allowed because its the os user name:

> mysql --comments -uwangchao -S/tmp/tidb-4001.sock
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 2097184
Server version: 8.0.11-TiDB-None TiDB Server (Apache License 2.0) Community Edition, MySQL 8.0 compatible
...

• No need to test

  • I checked and no code files have been changed.

Side effects

• Performance regression: Consumes more CPU
• Performance regression: Consumes more Memory
• Breaking backward compatibility

Documentation

• Affects user behaviors
• Contains syntax changes
• Contains variable changes
• Contains experimental features
• Changes MySQL compatibility

Release note

Please refer to Release Notes Language Style Guide to write a quality release note.

fix `auth_socket` bug, should only allow os user name to login

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Please upload report for BASE (release-8.1@eabd1de). Learn more about missing BASE report.

Additional details and impacted files

@@               Coverage Diff                @@
##             release-8.1     #54050   +/-   ##
================================================
  Coverage               ?   71.1599%           
================================================
  Files                  ?       1465           
  Lines                  ?     421529           
  Branches               ?          0           
================================================
  Hits                   ?     299960           
  Misses                 ?     101089           
  Partials               ?      20480           

Flag	Coverage Δ
unit	71.1599% <100.0000%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
dumpling	53.9957% <0.0000%> (?)
parser	∅ <0.0000%> (?)
br	40.9637% <0.0000%> (?)

[lcwangchao]

/retest

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: CbcWestwolf, lcwangchao

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [CbcWestwolf,lcwangchao]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ti-chi-bot]

[LGTM Timeline notifier]

Timeline:

• 2024-06-17 09:30:51.721461678 +0000 UTC m=+20778.206950503: ☑️ agreed by lcwangchao.
• 2024-06-17 09:50:58.896903169 +0000 UTC m=+21985.382392001: ☑️ agreed by CbcWestwolf.