**Describe what's wrong**

UDF functions are global objects. Creating or dropping them requires global level privilege.

- https://clickhouse.com/docs/en/sql-reference/statements/create/function/
- https://github.com/ClickHouse/ClickHouse/blob/14811a357e2136ff2940d791f2dbe59c65e87601/tests/integration/test_access_for_functions/test.py#L22

But "system.privileges" table reports DATABASE level for these privileges.

```
SELECT
    privilege,
    level
FROM system.privileges
WHERE CAST(privilege, 'text') LIKE '%FUNCTION%'

┌─privilege──────────────┬─level────┐
│ CREATE FUNCTION        │ DATABASE │
│ DROP FUNCTION          │ DATABASE │
│ SYSTEM RELOAD FUNCTION │ GLOBAL   │
└────────────────────────┴──────────┘
```

**Does it reproduce on recent release?**

Actual for the latest versions and master. In particular, for 21.12.4.1.

enabled_roles = nullptr;
        roles_info = nullptr;
        enabled_row_policies = nullptr;
        enabled_quota = nullptr;
        enabled_settings = nullptr;
        return;
    }
    user_name = user->getName();
    trace_log = &Poco::Logger::get("ContextAccess (" + user_name + ")");
    std::vector<UUID> current_roles, current_roles_with_admin_option;
    if (params.use_default_roles)
    {
        current_roles = user->granted_roles.findGranted(user->default_roles);
        current_roles_with_admin_option = user->granted_roles.findGrantedWithAdminOption(user->default_roles);
    }
    else
    {
        current_roles = user->granted_roles.findGranted(params.current_roles);
        current_roles_with_admin_option = user->granted_roles.findGrantedWithAdminOption(params.current_roles);
    }
    subscription_for_roles_changes.reset();
    enabled_roles = access_control->getEnabledRoles(current_roles, current_roles_with_admin_option);
    subscription_for_roles_changes = enabled_roles->subscribeForChanges([this](const std::shared_ptr<const EnabledRolesInfo> & roles_info_)
    {
        std::lock_guard lock{mutex};
        setRolesInfo(roles_info_);
    });
    setRolesInfo(enabled_roles->getRolesInfo());
}
void ContextAccess::setRolesInfo(const std::shared_ptr<const EnabledRolesInfo> & roles_info_) const