Is there a Veil-like plug-in for MySQL?

Question

We have a MySQL database and would like to have row-level security implemented at the database level. I have been playing with the Veil plug-in for PostgreSQL and like what it does. Is there something similar for MySQL so we do not have to convert over to PostgreSQL?

Update

It isn't so much that we would be using veil, or its MySQL equivalent, for authentication but to determine which rows to display for an already authenticated user. User privileges are based on a relational context. Without concerning ourselves with a plug-in, how efficient would a view be where the user privilege is based on multiple joins on a table with 100k rows? The ultimate goal is to be able to display different data to two different users based on the individual users privileges to the rows in a table of 100k> rows using the same query.

Answer 1

This isn't a common feature mainly because its in most cases this is not the right place for this security system. If you could provide more details into the exact attack you are attempting to defend against perhaps there is a more suitable secuirty system to fill this requirement.

Usually you are looking to limit to a specific user based on an Access Control List implementation that you application dictates. There are cases where you want two applications to share the same data and you want to limit the impact of a compromise of one of the applications. In this case you could split it up and give 1 application read access to a database while the the other has write or read/write. Using the databases native access control like this it is possible to safely pass information between applications. The main threat being defended against is that if 1 application where compromised due to a vulnerability like SQL Injection both databases would also succumb to the attack.

There is also sepgsql which does also this for PostgreSQL. This secuirty system could be used for better separation of applications with some dependent data, but this a very unusual software requirement. In general this secuirty system should be avoided in favor of other more common and proven systems.