Privilege Restriction Using Partial Revokes If an account has a privilege restriction on a schema: •The account cannot grant to other accounts a privilege on the restricted schema or any object within it. •Another account that does not have the restriction can grant privileges to the restricted account for the restricted schema or objects within it. Suppose that an unrestricted user executes these statements: CREATE USER u1; GRANT SELECT, INSERT, UPDATE ON *.* TO u1; REVOKE SELECT, INSERT, UPDATE ON mysql.* FROM u1; GRANT SELECT ON mysql.user TO u1; -- grant table privilege GRANT SELECT(Host,User) ON mysql.db TO u1; -- grant column privileges mysql>  SHOW GRANTS FOR u1; +-----------------------------------------------------------+ | Grants for u1@% | +-----------------------------------------------------------+ | GRANT SELECT, INSERT, UPDATE ON *.* TO ‘u1‘@‘%‘ | | REVOKE SELECT, INSERT, UPDATE ON ‘mysql‘.* FROM ‘u1‘@‘%‘ | | GRANT SELECT (‘Host‘, ‘User‘) ON ‘mysql‘.‘db‘ TO ‘u1‘@‘%‘ | | GRANT SELECT ON ‘mysql‘.‘user‘ TO ‘u1‘@‘%‘ | +-----------------------------------------------------------+ mysql>  CREATE USER u1; mysql>  GRANT SELECT, INSERT, UPDATE, DELETE ON *.* TO u1; mysql>  REVOKE INSERT, UPDATE, DELETE ON mysql.* FROM u1; mysql>  SHOW GRANTS FOR u1; +----------------------------------------------------------+ | Grants for u1@% | +----------------------------------------------------------+ | GRANT SELECT, INSERT, UPDATE, DELETE ON *.* TO ‘u1‘@‘%‘ | | REVOKE INSERT, UPDATE, DELETE ON ‘mysql‘.* FROM ‘u1‘@‘%‘ | +----------------------------------------------------------+ mysql>  GRANT INSERT ON *.* TO u1; mysql>  SHOW GRANTS FOR u1; +---------------------------------------------------------+ | Grants for u1@% | +---------------------------------------------------------+ | GRANT SELECT, INSERT, UPDATE, DELETE ON *.* TO ‘u1‘@‘%‘ | | REVOKE UPDATE, DELETE ON ‘mysql‘.* FROM ‘u1‘@‘%‘ | +---------------------------------------------------------+ Granting a privilege globally to  u1  from an account with no restriction removes the privilege restriction. For example, to remove the  INSERT  restriction: Granting a privilege at the schema level to  u1  removes the privilege restriction. For example, to remove the UPDATE  restriction: Consider a user  u1  who holds several privileges globally, but with restrictions on  INSERT ,  UPDATE  and DELETE : If an account has a restriction on a global privilege, the restriction is removed by any of these actions: The resulting account has these privileges, with the ability to perform limited operations within the restricted schema: •Granting the privilege globally to the account by an account that has no restriction on the privilege. •Granting the privilege at the schema level. •Revoking the privilege globally. mysql>  GRANT UPDATE ON mysql.* TO u1; 1240