Details
-
New Feature
-
Status: Open (View Workflow)
-
Major
-
Resolution: Unresolved
-
None
-
None
Description
Update packaging scripts, systemd unit files, and mariadb-install-db to default to the mariadb:mariadb user and group.
Additionally, shipped SELinux and AppArmor policies are mapped to the legacy user and also needs to be updated.
While this is trivial for new installations there are challenges for upgrades.
If the `mariadbd` starts against an existing datadir owned by mysql, it will fail with permission errors. We cannot automate a recursive `chown` in the package post-install scripts, or replace username with `usermod` keeping the same UID/GID because:
1. It risks severe timeouts on databases during the install in case there are multiple thousands of tables or partitions.
2. It could create problems on systems where MySQL is also installed.
Solution
- Packages and tarball scripts create the mariadb:mariadb user/group. systemd units and mariadb-install-db default to mariadb.
- Update shipped SELinux policies (contexts/rules) and AppArmor profiles to explicitly allow the mariadb user to run the service and access the datadir.
- The install script checks if the existing datadir is owned by mysql.
If legacy ownership is detected, the script prints a warning instructing the sysadmin to manually resolve the permissions before starting the service, choosing one of two paths:
Path A: Override the systemd unit (systemctl edit mariadb) to set User=mysql and Group=mysql.
Path B: Manually execute chown -R mariadb:mariadb /var/lib/mysql (and run restorecon for SELinux environments) during their maintenance window.