maria-discuss team mailing list archive

[Felipe Gasper <felipe@xxxxxxxxxxxxxxxx>]

On 13 Nov 2015 2:51 AM, Sergei Golubchik wrote:
> On Nov 12, Felipe Gasper wrote:
> > Hello,
> >
> > Is this script supposed to be runnable as a normal (i.e., non-root)
> > user?
> >
> > In MySQL 5.6 there is logic that prevents the chown() of the mysql
> > data dir when running as non-root. MariaDB 10.1.8 doesn’t seem to have
> > this logic, so the script fails when chown() fails.
> >
> > Is this change intended? We have tests that verify functionality of
> > user-created, UNIX-socket-only MySQL/MariaDB servers. These work on
> > MySQL 5.6 but not on MariaDB 10.1.
>
> There's no special logic around it in MySQL 5.6 and no changes in
> MariaDB 10.1.
>
> chown is done if user=xxx is specified on the command line or in the
> my.cnf file. And if chown fails, you'll see the error message and
> mysql_install_db will abort. Both in MySQL and MariaDB.

Hi Sergei! Thanks for responding. :)

I wonder, are we looking at the same things?

Both scripts say:

By default mysqld runs using your current login name and files and 
directories that it creates will be owned by you.

The 5.6 box’s mysql_install_db has:

-----------------
  if ($opt_user and -w "/")
  {
    chown($pwnam[2], $pwnam[3], $dir)
      or error($opt, "Could not chown directory $dir");
  }
-----------------

… which will forgo chown() if it’s doomed to fail.

… whereas the MariaDB box has:

-----------------
    chown $user "$dir"
    if test $? -ne 0
    then
      echo "Cannot change ownership of the database directories to the 
'$user'"
      echo "user.  Check that you have the necessary permissions and 
try again."
      exit 1
    fi
------------------

… which has no safeguard around the chown(). (And is in a different 
language … ?)

Even if I specify --user, MariaDB still errors:

------------------
~/temp $ mysql_install_db --user=felipe mysqldata
chown: changing ownership of `/var/lib/mysql': Operation not permitted
Cannot change ownership of the database directories to the 'felipe'
user.  Check that you have the necessary permissions and try again.
------------------

Thank you for your time!

-FG