Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-11721

MariaDB Systemd service does not start when 'chroot' option is activated in my.cnf

    XMLWordPrintable

Details

    Description

      When configuring a chroot environment, with 'chroot = /srv/chroot-mariadb' in my.cnf:

      # service mariadb start
      

      Fails with error "[ERROR] chroot: Operation not permitted" in syslog

      But if I start the daemon manually:

      $ /usr/sbin/mysqld
      

      OK, server started and chrooted

      And if I create a false init.d script, just to create new systemd service:

      $ cp /etc/init.d/mysql /etc/init.d/mysql-test
      $ chmod 755 /etc/init.d/mysql-test
      $ systemctl daemon-reload
      $ service mysql-test start
      

      OK, server started and chrooted

      To reproduce the chroot environment:
      (sources from http://orokon.com/chrooting-mysql-and-mariadb.html and http://www.cgsecurity.org/Articles/mysql.html)

      service mariadb stop
      CHROOT=/srv/chroot-mariadb
      mkdir -p $CHROOT/{usr/share,tmp,lib,etc,var/lib,var/run/mysqld,var/log/mysql}
      cd $CHROOT
      chmod 1777 tmp
      grep 'mysql:' /etc/passwd > etc/passwd
      mv /var/lib/mysql var/lib/
      cp -a /usr/share/mysql $CHROOT/usr/share/
      chown mysql:mysql $CHROOT/{tmp,var/lib/mysql,var/run/mysqld,var/log/mysql}
      ln -s $CHROOT/var/lib/mysql/ /var/lib/mysql
      mv /var/run/mysqld var/run
      ln -s $CHROOT/var/run/mysqld/ /var/run/mysqld
       
      librairies="$(ldd $(which mysqld)) $(find /{lib,usr/lib} -name 'libnss*')"
      regex="^/(.+)/.+$"
      while read adr1 arrow adr2 foo; do
      	[ -z "$adr2" ] && f=$adr1 || f=$adr2
      	if [[ $f =~ $regex ]]; then
      		folder="${BASH_REMATCH[1]}"
      		[ ! -d "$folder" ] && mkdir -p $folder
      		cp $f $folder/
      	fi
      done < <(echo -e "$librairies")
       
      echo -e "[client]
      socket = $CHROOT/var/run/mysqld/mysqld.sock
      [mysqld]
      chroot = $CHROOT" >> /etc/mysql/conf.d/chroot.cnf
      

      Attachments

        Activity

          People

            svoj Sergey Vojtovich
            Worst Jérémie LEGRAND
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.