Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-18971

Add background encryption threads for Aria

Details

    Description

      Aria does not currently have background encryption threads like InnoDB does.

      https://mariadb.com/kb/en/library/innodb-background-encryption-threads/

      This means that if you change the value of aria_encrypt_tables, then you need to manually rebuild existing tables with a process like this:

      https://mariadb.com/kb/en/library/aria-enabling-encryption/#encrypting-existing-tables

      e.g.:

      1.) Enable Aria encryption:

      MariaDB [(none)]> SET GLOBAL aria_encrypt_tables=ON;
      		 
      Query OK, 0 rows affected (0.000 sec)

      2.) Rebuild the table that you want to ensure is encrypted:

      MariaDB [(none)]> ALTER TABLE mysql.global_priv ENGINE=Aria;
      		 
      Query OK, 7 rows affected (0.017 sec)
      		 
      Records: 7  Duplicates: 0  Warnings: 0

      3.) Confirm that the table is encrypted. See the following documentation section for that:

      https://mariadb.com/kb/en/library/aria-encryption-overview/#determining-whether-a-table-is-encrypted

      e.g.:

      $ sudo strings /var/lib/mysql/mysql/global_priv.MAD | grep "root"

      I suspect that a table would also have to be manually rebuilt after a key rotation.

      Attachments

        Issue Links

          blocks

          Task - A task that needs to be done. MDEV-20099 Implement key rotation for Aria

          • Major - Major loss of function.
          • Open
          relates to

          Task - A task that needs to be done. MDEV-8587 Aria log encryption

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Open

          Task - A task that needs to be done. MDEV-20099 Implement key rotation for Aria

          • Major - Major loss of function.
          • Open

          New Feature - A new feature of the product, which has yet to be developed. MDEV-17324 Make information_schema table that shows which Aria tables are encrypted

          • Major - Major loss of function.
          • Open

          New Feature - A new feature of the product, which has yet to be developed. MDEV-18049 Support ENCRYPTED and ENCRYPTION_KEY_ID table options for Aria

          • Major - Major loss of function.
          • Open

          Activity

            Ascending order - Click to sort in descending order
            GeoffMontee Geoff Montee (Inactive) created issue -
            GeoffMontee Geoff Montee (Inactive) made changes -
            Field Original Value New Value
            GeoffMontee Geoff Montee (Inactive) made changes -
            GeoffMontee Geoff Montee (Inactive) made changes -
            Description Aria does not currently have background encryption threads like InnoDB does. If you change the value of aria_encrypt_tables, then you need to rebuild existing tables with a process like this:

            https://mariadb.com/kb/en/library/aria-enabling-encryption/#encrypting-existing-tables

            e.g.:

            1.) Enable Aria encryption:

            {noformat}
            MariaDB [(none)]> SET GLOBAL aria_encrypt_tables=ON;
            Query OK, 0 rows affected (0.000 sec)
            {noformat}

            2.) Rebuild the table that you want to ensure is encrypted:

            {noformat}
            MariaDB [(none)]> ALTER TABLE mysql.global_priv ENGINE=Aria;
            Query OK, 7 rows affected (0.017 sec)
            Records: 7 Duplicates: 0 Warnings: 0
            {noformat}

            3.) Confirm that the table is encrypted. See the following documentation section for that:

            https://mariadb.com/kb/en/library/aria-encryption-overview/#determining-whether-a-table-is-encrypted

            e.g.:

            {noformat}
            $ sudo strings /var/lib/mysql/mysql/global_priv.MAD | grep "root"
            {noformat}             		Aria does not currently have background encryption threads like InnoDB does.

            https://mariadb.com/kb/en/library/innodb-background-encryption-threads/

            This means that if you change the value of aria_encrypt_tables, then you need to manually rebuild existing tables with a process like this:

            https://mariadb.com/kb/en/library/aria-enabling-encryption/#encrypting-existing-tables

            e.g.:

            1.) Enable Aria encryption:

            {noformat}
            MariaDB [(none)]> SET GLOBAL aria_encrypt_tables=ON;
            Query OK, 0 rows affected (0.000 sec)
            {noformat}

            2.) Rebuild the table that you want to ensure is encrypted:

            {noformat}
            MariaDB [(none)]> ALTER TABLE mysql.global_priv ENGINE=Aria;
            Query OK, 7 rows affected (0.017 sec)
            Records: 7 Duplicates: 0 Warnings: 0
            {noformat}

            3.) Confirm that the table is encrypted. See the following documentation section for that:

            https://mariadb.com/kb/en/library/aria-encryption-overview/#determining-whether-a-table-is-encrypted

            e.g.:

            {noformat}
            $ sudo strings /var/lib/mysql/mysql/global_priv.MAD | grep "root"
            {noformat}
            GeoffMontee Geoff Montee (Inactive) made changes -
            Description Aria does not currently have background encryption threads like InnoDB does.

            https://mariadb.com/kb/en/library/innodb-background-encryption-threads/

            This means that if you change the value of aria_encrypt_tables, then you need to manually rebuild existing tables with a process like this:

            https://mariadb.com/kb/en/library/aria-enabling-encryption/#encrypting-existing-tables

            e.g.:

            1.) Enable Aria encryption:

            {noformat}
            MariaDB [(none)]> SET GLOBAL aria_encrypt_tables=ON;
            Query OK, 0 rows affected (0.000 sec)
            {noformat}

            2.) Rebuild the table that you want to ensure is encrypted:

            {noformat}
            MariaDB [(none)]> ALTER TABLE mysql.global_priv ENGINE=Aria;
            Query OK, 7 rows affected (0.017 sec)
            Records: 7 Duplicates: 0 Warnings: 0
            {noformat}

            3.) Confirm that the table is encrypted. See the following documentation section for that:

            https://mariadb.com/kb/en/library/aria-encryption-overview/#determining-whether-a-table-is-encrypted

            e.g.:

            {noformat}
            $ sudo strings /var/lib/mysql/mysql/global_priv.MAD | grep "root"
            {noformat}             		Aria does not currently have background encryption threads like InnoDB does.

            https://mariadb.com/kb/en/library/innodb-background-encryption-threads/

            This means that if you change the value of aria_encrypt_tables, then you need to manually rebuild existing tables with a process like this:

            https://mariadb.com/kb/en/library/aria-enabling-encryption/#encrypting-existing-tables

            e.g.:

            1.) Enable Aria encryption:

            {noformat}
            MariaDB [(none)]> SET GLOBAL aria_encrypt_tables=ON;
            Query OK, 0 rows affected (0.000 sec)
            {noformat}

            2.) Rebuild the table that you want to ensure is encrypted:

            {noformat}
            MariaDB [(none)]> ALTER TABLE mysql.global_priv ENGINE=Aria;
            Query OK, 7 rows affected (0.017 sec)
            Records: 7 Duplicates: 0 Warnings: 0
            {noformat}

            3.) Confirm that the table is encrypted. See the following documentation section for that:

            https://mariadb.com/kb/en/library/aria-encryption-overview/#determining-whether-a-table-is-encrypted

            e.g.:

            {noformat}
            $ sudo strings /var/lib/mysql/mysql/global_priv.MAD | grep "root"
            {noformat}

            I suspect that a table would also have to be manually rebuilt after a key rotation.
            GeoffMontee Geoff Montee (Inactive) made changes -
            Assignee Michael Widenius [ monty ]
            GeoffMontee Geoff Montee (Inactive) made changes -
            GeoffMontee Geoff Montee (Inactive) made changes -
            GeoffMontee Geoff Montee (Inactive) made changes -
            ralf.gebhardt Ralf Gebhardt made changes -
            Fix Version/s 10.5 [ 23123 ]
            Assignee Michael Widenius [ monty ]
            serg Sergei Golubchik made changes -
            Workflow MariaDB v3 [ 93373 ] MariaDB v4 [ 131013 ]
            julien.fritsch Julien Fritsch made changes -
            Labels synchronization
            julien.fritsch Julien Fritsch made changes -
            Labels synchronization
            julien.fritsch Julien Fritsch made changes -
            Labels synchronization
            julien.fritsch Julien Fritsch made changes -
            Labels synchronization
            julien.fritsch Julien Fritsch made changes -
            Issue Type Task [ 3 ] New Feature [ 2 ]

            People

              Unassigned Unassigned
              GeoffMontee Geoff Montee (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.