[MDEV-20205] mysql_install_db shouldn't execute chown Created: 2019-07-29  Updated: 2020-08-25  Resolved: 2020-01-17

Status: Closed
Project: MariaDB Server
Component/s: Packaging, Plugin - pam
Affects Version/s: 10.4.7
Fix Version/s: 10.4.12

Type: Bug Priority: Critical
Reporter: Geoff Montee (Inactive) Assignee: Sergei Golubchik
Resolution: Fixed Votes: 2
Labels: None

Issue Links:
Problem/Incident
is caused by MDEV-19876 pam v2: auth_pam_tool_dir and auth_pa... Closed
Relates
relates to MDEV-22459 pam v2 should log an error if auth_pa... Closed
relates to MDEV-22482 pam v2: mysql_upgrade doesn't fix the... Open

 Description   

One of the fixes for MDEV-19876 added a "chown" call to mysql_install_db:

https://github.com/mariadb/server/commit/ec494cb1fadb40ae25b944bb1229fc2d6f88e8c6

This essentially introduces a new limitation that mysql_install_db has to be run as root. This is not ideal for all users.

The "chown" call didn't actually fix MDEV-19876, so maybe we should remove it. The proper fix for MDEV-19876 required changing the RPM's post-installation script:

https://github.com/mariadb/server/commit/11f3e2366282eb8cf1cb0062793d102067db6472

In my opinion, a packaging script seems like a more appropriate place for a fix like this than mysql_install_db does.



 Comments   
Comment by Oleksandr Byelkin [ 2019-11-06 ]

What about people who do not use packaging scripts? (uses tarball instead of rpm or deb)

Comment by Geoff Montee (Inactive) [ 2019-11-06 ]

People who use binary tarballs are the ones who are most likely to run mysql_install_db is a non-root user, so those are the users who are most likely to encounter this issue.

If you want to keep this behavior in mysql_install_db, then I would suggest making it optional, and requiring an option to enable it. What could the option be called? -chown, chown-pamtool, -root?

e.g.:

mysql_install_db --user=mysql --chown-pamtool

Comment by Oleksandr Byelkin [ 2019-11-28 ]

How it should lead to install failure if it should print an error and proceed?

Comment by Geoff Montee (Inactive) [ 2019-11-28 ]

In my opinion, the error should probably be non-fatal, so it should just print an error message and continue. A failed chown should be easy for a user to fix manually.

Generated at Thu Feb 08 08:57:38 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.