Details
-
Bug
-
Status: In Review (View Workflow)
-
Major
-
Resolution: Unresolved
-
10.11.16
-
None
-
Related to install and upgrade
Description
The removal of pam_mariadb_mtr has caused the deb-autobake-install tests, that previously tested pam on Debain based systems to be disabled with "No pam setup for mtr".
This was caused by commit.
Per MDEV-21654 - the /usr/share is out as far as an install location.
The server Test component and therefore in the mariadb-test-data Deb package.
The package doesn't install mariadb_mtr.conf in a functional location on the test system so its not like installing the mariadb-test-data will create a security vunerability because of its hard coded password.
/lib/x86_64-linux-gnu/security/ as a location looks excessively official and therefore in MDEV-21654 "cannot be installed" and similar comments. The side effect of this is it hasn't been tested for over a year.
As a compromise /lib/$arch/security/insecure_test_mariadb/pam_mariadb_mtr.so could be considered an install location? The pam configuration where the pam module name is specified can take a full (or relative) path so the absolute strict location isn't required.
A compatible RPM change can also occur with the mariadb_mtr.conf file containing a relative path, but with the configuration file still installed in "${INSTALL_MYSQLTESTDIR}/suite/plugins/pam", leaving the OS still secure, but easy to update to a mtr testable system, and with "insecure_test_mariadb" making it pretty obvious that the PAM shouldn't be a production installed module.
otto, serg is this acceptable so we can restore some PAM testing on Debian?
Attachments
Issue Links
- is caused by
-
MDEV-21654 binary library file pam_mariadb_mtr.so installed among test data files
-
- Closed
-