When the setgid bit is set on a directory, all the files created inside it should get the group of that directory.

The MariaDB server itself appears to observe this rule.

However, the mariadb-upgrade utility does not. With datadir=/var/lib/mariadb:

chgrp root /var/lib/mariadb

chmod u=rwx,g=rwxs,o= /var/lib/mariadb

chmod -R g=rwX /var/lib/mariadb/*

# Observe that group of an example file in datadir's mysql folder is 'root':

ls -l /var/lib/mariadb/mysql/time_zone.frm

# Run mariadb-upgrade:

mariadb-upgrade --force -u root -p

# Observe that the group of the example file in datadir's mysql folder has changed to 'mysql':

ls -l /var/lib/mariadb/mysql/time_zone.frm

I think the mariadb-upgrade tool should follow the normal convention regarding the setgid bit on directories.

Note that if the setgid bit is set on the actual datadir's mysql folder, then mariadb-upgrade seems to behave as expected.