Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-40629

environment injection via wsrep bootstrap in the service file

    XMLWordPrintable

Details

    • Can result in unexpected behaviour
    • Hide
      It was possible for a user with FILE privileges and a secure_file_priv system variable configuration that can write to /run/mysqld (enabled by default), to create the environment file /run/mysqld/wsrep-new-cluster that the mariadb service will use on the next restart.
      Show
      It was possible for a user with FILE privileges and a secure_file_priv system variable configuration that can write to /run/mysqld (enabled by default), to create the environment file /run/mysqld/wsrep-new-cluster that the mariadb service will use on the next restart.

    Description

      The systemd unit loads a mysql-writable file as a service EnvironmentFile and then runs a command that inherits that environment:

      systemd.service

      		 
      User=mysql
      		 
      EnvironmentFile=-/run/mysqld/wsrep-new-cluster
      		 
      ExecStartPost=!/etc/mysql/debian-start

      A database account with only the FILE privilege (and empty secure_file_priv, the default) can write an poisoned /run/mysqld/wsrep-new-cluster (with IFS, PATH, various LD_* variables), via SELECT … INTO DUMPFILE, which is writable by the mysql user. On the next service restart, systemd passes that environment to the ExecStart/ExecStartPos processes.

      Reported by Vincent55 Yang via the Webpros (cPanel/Plesk) security team

      Attachments

        Issue Links

          is caused by

          Bug - A problem which impairs or prevents the functions of the product. MDEV-15502 debian: systemd, with tmpfiles install not required

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-19210 use environment file in systemd units for _WSREP_*

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-37726 wsrep-new-cluster and wsrep-start-position in wrong directory with wrong selinux permissions

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Closed

          Activity

            People

              serg Sergei Golubchik
              danblack Daniel Black
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Time Tracking

                  Estimated:
                  Original Estimate - 1d
                  1d
                  Remaining:
                  Remaining Estimate - 0d
                  0d
                  Logged:
                  Time Spent - 1d
                  1d

                  Git Integration

                    Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.