Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-14707

systemd: remove PermissionsStartOnly=true (by removing environment _WSREP_START_POSITION)

Details

    Description

      MDEV-10004 introduced _WSREP_START_POSITION{,%I} as a mechanism to store the mysqld arguments required to recover after crashes. This 'systemctl set-environment' is the only operations that requires PermissionsStartOnly=true in the service file.

      If we could replace this with another mechanism we can run as the ordinary User= and make the scripts less vulnerable to CVEs.

      This will also enable a multi-instance where each user is different without the complication of re-acquiring the systemd user for the service.

      Attachments

        Issue Links

          relates to

          Bug - A problem which impairs or prevents the functions of the product. MDEV-19210 use environment file in systemd units for _WSREP_*

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-10004 Galera's pc.recovery process fails in 10.1 with systemd

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-11494 galera_recovery script hard-codes the user

          • Major - Major loss of function.
          • Closed

          Activity

            Ascending order - Click to sort in descending order
            danblack Daniel Black created issue -
            danblack Daniel Black made changes -
            Field Original Value New Value
            serg Sergei Golubchik made changes -
            Description MDEV-10004 introduced _WSREP_START_POSITION{,%I} as a mechanism to store the mysqld arguments required to recover after crashes. This 'systemctl set-environment' is the only operations that requires PermissionsStartOnly=true in the service file.

            If we could replace this with another mechanism we can run as the ordinary User= and make the scripts less vulnerable to CVEs.

            This will also enable a multi-instance where each user is different without the complication of re-acquiring the systemd user for the service.             		MDEV-10004 introduced _WSREP_START_POSITION\{,%I} as a mechanism to store the mysqld arguments required to recover after crashes. This 'systemctl set-environment' is the only operations that requires PermissionsStartOnly=true in the service file.

            If we could replace this with another mechanism we can run as the ordinary User= and make the scripts less vulnerable to CVEs.

            This will also enable a multi-instance where each user is different without the complication of re-acquiring the systemd user for the service.
            danblack Daniel Black made changes -
            serg Sergei Golubchik made changes -
            Fix Version/s 10.4 [ 22408 ]
            serg Sergei Golubchik made changes -
            Labels systemd
            danblack Daniel Black made changes -
            Assignee Daniel Black [ danblack ]
            serg Sergei Golubchik made changes -
            Workflow MariaDB v3 [ 84507 ] MariaDB v4 [ 130758 ]
            danblack Daniel Black made changes -
            julien.fritsch Julien Fritsch made changes -
            Fix Version/s 10.3 [ 22126 ]
            danblack Daniel Black made changes -
            Component/s Scripts & Clients [ 11002 ]
            Fix Version/s 11.6.0 [ 29839 ]
            Fix Version/s 10.4(EOL) [ 22408 ]
            Resolution Fixed [ 1 ]
            Status Open [ 1 ] Closed [ 6 ]

            People

              danblack Daniel Black
              danblack Daniel Black
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.