Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-13402

mysqld should create its PID file before dropping privileges

    Details

    • Type: Bug
    • Status: Open (View Workflow)
    • Priority: Minor
    • Resolution: Unresolved
    • Affects Version/s: 5.5, 10.0, 10.1, 10.2
    • Fix Version/s: 5.5, 10.0, 10.1, 10.2
    • Component/s: Server
    • Labels:
      None

      Description

      Summary

      The database server daemon should create its PID file before dropping
      privileges. This represents a minor security issue; additional factors
      are needed to make it exploitable.

      Description

      The purpose of the PID file is to hold the PID of the running daemon,
      so that later it can be stopped, restarted, or otherwise signalled
      (many daemons reload their configurations in response to a SIGHUP).
      To fulfill that purpose, the contents of the PID file need to be
      trustworthy. If the PID file is writable by a non-root user, then he
      can replace its contents with the PID of a root process. Afterwards,
      any attempt to signal the PID contained in the PID file will instead
      signal a root process chosen by the non-root user (a vulnerability).

      This is commonly exploitable by init scripts that are run as root and
      which blindly trust the contents of their PID files. If one daemon
      flushes its cache in response to SIGUSR2 and another daemon drops all
      connections in response to SIGUSR2, it is not hard to imagine a
      denial-of-service by the user of the first daemon against the second.

      Exploitation

      There is only a risk of exploitation when some other user relies on
      the data in the PID file. But you have to wonder, what's the point of
      the PID file if not to provide the PID to other people? Any situation
      where the PID file is used is therefore suspicious.

        Attachments

          Activity

            People

            • Assignee:
              serg Sergei Golubchik
              Reporter:
              mjo Michael Orlitzky
            • Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

              • Created:
                Updated: