Details
Description
Commit d842d6e994 ("on rpm: don't set mysql user's $HOME to datadir")
added an unconditional usermod to support-files/rpm/server-prein.sh:
- Make sure the home dir is correct too (must not be datadir)
usermod -d /nonexistent % {mysqld_user}2> /dev/null || true
This runs in %pre of MariaDB-server on every install AND every upgrade, and it
rewrites /etc/passwd for the mysql account regardless of what the local
administrator had configured. Sites that provision the mysql account themselves
with a real home directory (a very common pattern where DBAs use the account
interactively) lose that home directory silently on the next patch.
The stated goal in the commit message is that $HOME must not be the datadir. That goal does not require overwriting home directories which are NOT the
datadir. The scriptlet's own comment says "must not be datadir", but the
implementation does not test that condition.
Reported by a customer running RHEL after applying 11.8.9 and 10.6.28; the
reproduction below is on Rocky Linux 8 with Enterprise Server 11.8.9-6.
- 1. Pre-existing, site-provisioned mysql account with a real home directory
[root@gc2 ~]# grep '^mysql:' /etc/passwd |
mysql:x:1001:1001::/home/mysql:/bin/bash |
 |
[root@gc2 ~]# su - mysql |
[mysql@gc2 ~]$ pwd |
/home/mysql
|
- 2. Remove all MariaDB packages. Note the OS account is untouched, as expected.
[root@gc2 ~]# rpm -e $(rpm -qa | grep -i mariadb) |
[root@gc2 ~]# rpm -e galera-enterprise-4-26.4.26-1.el8.x86_64 |
[root@gc2 ~]# grep '^mysql:' /etc/passwd |
mysql:x:1001:1001::/home/mysql:/bin/bash |
- 3. Install 11.8.9_6-1.el8 (fresh install, not an upgrade)
[root@gc2 ~]# yum install MariaDB-server MariaDB-client MariaDB-backup |
...
|
Installing: MariaDB-server x86_64 11.8.9_6-1.el8 mariadb-es-main |
Complete!
|
|
- 4. The home directory has been rewritten
[root@gc2 ~]# grep -i mysql /etc/passwd |
mysql:x:1001:1001::/nonexistent:/bin/bash |
Actual result:
[root@gc2 ~]# su - mysql |
su: warning: cannot change directory to /nonexistent: No such file or directory
|
[mysql@gc2 root]$ getent passwd mysql |
mysql:x:1001:1001::/nonexistent:/bin/bash |
[mysql@gc2 root]$ pwd |
/root
|
[mysql@gc2 root]$ ls -larth |
ls: cannot open directory '.': Permission denied |
Attachments
Issue Links
- blocks
-
DOCS-6707 Loading...