prevent mysql user change password of other user

Question

I have two users:

user1 : all privleges, no grant option.

user2 : all privleges, with grant option.

user1 , connect to database and change password of user2 .
How can I prevent this?

Answer 1

The GRANT privilege isn't related to passwords. It determines if user is able to change permissions for others.

In Set Password we can read:

Setting the password for a named account (with a FOR clause) requires the UPDATE privilege for the mysql system schema . Setting the password for yourself (for a nonanonymous account with no FOR clause) requires no special privileges.

The recommend way to change passwords is the ALTER USER statement but that documentation section basically states the same:

In most cases, ALTER USER requires the global CREATE USER privilege, or the UPDATE privilege for the mysql system schema .