MySQL incorporates the concept of user account categories, with system and regular users distinguished according to whether they have the SYSTEM_USER privilege:MySQL引入了用户帐户类别的概念，根据是否具有SYSTEM_USER权限来区分系统用户和常规用户：

The SYSTEM_USER privilege has an effect on the accounts to which a given user can apply its other privileges, as well as whether the user is protected from other accounts:SYSTEM_USER权限对给定用户可以应用其其他权限的帐户以及用户是否受到其他帐户的保护有影响：

If a user has the appropriate privileges to perform a given operation on regular accounts, SYSTEM_USER enables the user to also perform the operation on system accounts. 如果用户具有在常规帐户上执行给定操作的适当权限，则SYSTEM_USER允许用户也在系统帐户上执行该操作。SYSTEM_USER does not imply any other privilege, so the ability to perform a given account operation remains predicated on possession of any other required privileges. SYSTEM_USER并不意味着任何其他特权，因此执行给定帐户操作的能力仍然取决于是否拥有任何其他所需的特权。For example, if a user can grant the SELECT and UPDATE privileges to regular accounts, then with SYSTEM_USER the user can also grant SELECT and UPDATE to system accounts.例如，如果用户可以向常规帐户授予SELECT和UPDATE权限，那么使用SYSTEM_USER，用户还可以向系统帐户授予SELECT与UPDATE权限。

The distinction between system and regular accounts enables better control over certain account administration issues by protecting accounts that have the SYSTEM_USER privilege from accounts that do not have the privilege. 系统帐户和常规帐户之间的区别通过保护具有SYSTEM_USER权限的帐户免受没有该权限的帐户的影响，可以更好地控制某些帐户管理问题。For example, the CREATE USER privilege enables not only creation of new accounts, but modification and removal of existing accounts. 例如，CREATE USER权限不仅可以创建新帐户，还可以修改和删除现有帐户。Without the system user concept, a user who has the CREATE USER privilege can modify or drop any existing account, including the root account. 如果没有系统用户概念，具有CREATE USER权限的用户可以修改或删除任何现有帐户，包括root帐户。The concept of system user enables restricting modifications to the root account (itself a system account) so they can be made only by system users. 系统用户的概念允许限制对root帐户（本身就是系统帐户）的修改，因此只能由系统用户进行修改。Regular users with the CREATE USER privilege can still modify or drop existing accounts, but only regular accounts.具有CREATE USER权限的普通用户仍然可以修改或删除现有帐户，但只能修改或删除普通帐户。

The SYSTEM_USER privilege affects these operations:SYSTEM_USER权限影响以下操作：

Sessions executing within the server are distinguished as system or regular sessions, similar to the distinction between system and regular users:在服务器内执行的会话被区分为系统会话或常规会话，类似于系统用户和常规用户之间的区别：

A regular session is able to perform only operations permitted to regular users. A system session is additionally able to perform operations permitted only to system users.常规会话只能执行常规用户允许的操作。系统会话还能够执行仅允许系统用户执行的操作。

The privileges possessed by a session are those granted directly to its underlying account, plus those granted to all roles currently active within the session. 会话所拥有的特权是直接授予其基础帐户的特权，以及授予会话中当前活动的所有角色的特权。Thus, a session may be a system session because its account has been granted the SYSTEM_USER privilege directly, or because the session has activated a role that has the SYSTEM_USER privilege. 因此，会话可能是系统会话，因为其帐户直接被授予了SYSTEM_USER权限，或者因为会话激活了具有SYSTEM_USER特权的角色。Roles granted to an account that are not active within the session do not affect session privileges.授予会话中未处于活动状态的帐户的角色不会影响会话权限。

Because activating and deactivating roles can change the privileges possessed by sessions, a session may change from a regular session to a system session or vice versa. 因为激活和停用角色会改变会话所拥有的特权，所以会话可能会从常规会话更改为系统会话，反之亦然。If a session activates or deactivates a role that has the SYSTEM_USER privilege, the appropriate change between regular and system session takes place immediately, for that session only:如果会话激活或停用具有SYSTEM_USER权限的角色，则仅对该会话立即在常规会话和系统会话之间进行适当的更改：

These operations have no effect on existing sessions:这些操作对现有会话没有影响：

Because role activation affects only sessions and not accounts, granting a role that has the SYSTEM_USER privilege to a regular account does not protect that account against regular users. 由于角色激活仅影响会话而不影响帐户，因此将具有SYSTEM_USER权限的角色授予常规帐户并不能保护该帐户免受常规用户的攻击。The role protects only sessions for the account in which the role has been activated, and protects the session only against being killed by regular sessions.该角色仅保护已激活该角色的帐户的会话，并且仅保护会话不被常规会话杀死。

Account manipulation includes creating and dropping accounts, granting and revoking privileges, changing account authentication characteristics such as credentials or authentication plugin, and changing other account characteristics such as password expiration policy.帐户操作包括创建和删除帐户、授予和撤销特权、更改帐户身份验证特性（如凭据或身份验证插件）以及更改其他帐户特性（如密码过期策略）。

Account manipulation can be done two ways:账户操作有两种方式：

To fully protect system accounts against modification by a given account, make it a regular account and do not grant it modification privileges for the mysql schema:为了完全保护系统帐户免受给定帐户的修改，请将其设置为常规帐户，不要授予其mysql模式的修改权限：

Suppose that you want to create a user u1 who has all privileges on all schemas, except that u1 should be a regular user without the ability to modify system accounts. 假设你想创建一个用户u1，他对所有模式都有所有权限，除了u1应该是一个没有修改系统帐户能力的普通用户。Assuming that the partial_revokes system variable is enabled, configure u1 as follows:假设partial_revokes系统变量已启用，请按如下方式配置u1：

CREATE USER u1 IDENTIFIED BY 'password';

GRANT ALL ON *.* TO u1 WITH GRANT OPTION;
-- GRANT ALL includes SYSTEM_USER, so at this point
-- u1 can manipulate system or regular accounts

REVOKE SYSTEM_USER ON *.* FROM u1;
-- Revoking SYSTEM_USER makes u1 a regular user;
-- now u1 can use account-management statements
-- to manipulate only regular accounts

REVOKE ALL ON mysql.* FROM u1;
-- This partial revoke prevents u1 from directly
-- modifying grant tables to manipulate accounts

To prevent all mysql system schema access by an account, revoke all its privileges on the mysql schema, as just shown. 为了防止帐户访问所有mysql系统模式，请撤销其对mysql模式的所有权限，如图所示。It is also possible to permit partial mysql schema access, such as read-only access. 也可以允许部分mysql模式访问，例如只读访问。The following example creates an account that has SELECT, INSERT, UPDATE, and DELETE privileges globally for all schemas, but only SELECT for the mysql schema:以下示例创建了一个帐户，该帐户对所有模式具有全局SELECT、INSERT、UPDATE和DELETE权限，但对mysql模式仅具有SELECT权限：

CREATE USER u2 IDENTIFIED BY 'password';
GRANT SELECT, INSERT, UPDATE, DELETE ON *.* TO u2;
REVOKE INSERT, UPDATE, DELETE ON mysql.* FROM u2;

Another possibility is to revoke all mysql schema privileges but grant access to specific mysql tables or columns. This can be done even with a partial revoke on mysql. 另一种可能是撤销所有mysql模式权限，但授予对特定mysql表或列的访问权限。即使在mysql上进行部分撤销，也可以做到这一点。The following statements enable read-only access to u1 within the mysql schema, but only for the db table and the Host and User columns of the user table:以下语句允许对mysql模式中的u1进行只读访问，但仅限于db表以及user表的Host和User列：

CREATE USER u3 IDENTIFIED BY 'password';
GRANT ALL ON *.* TO u3;
REVOKE ALL ON mysql.* FROM u3;
GRANT SELECT ON mysql.db TO u3;
GRANT SELECT(Host,User) ON mysql.user TO u3;