The crude loop I wrote to come up with this changeset:
find -L package/feeds/packages/ -name patches | \
sed 's/patches$/refresh/' | sort | xargs make
Signed-off-by: Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com>
Remove few no longer needed bits - like checking that datadir is defined
or mysqld_safe from server package and bumping revision after all the
init script cleanups.
Signed-off-by: Michal Hrusecky <michal.hrusecky@turris.com>
Rewrite init script as mysqladmin requires access to the MySQL which is
hard to guarantee. Use standard signals instead.
Signed-off-by: Michal Hrusecky <michal.hrusecky@turris.com>
Use /srv/mysql as default datadir as /var/lib/mysql is in tmpfs. This
doesn't affect any existing setup as up till now it had to be always
specified in configuration. That is addressed in the second part of this
commit - init script now uses even defaults as compiled in MariaDB so
not everything has to be specified in configuration file.
Signed-off-by: Michal Hrusecky <michal.hrusecky@turris.com>
On few places, shellcheck gets confused by how some OpenWrt functions
work - especially load ones. Also on few places there are $options
variables that need not to be globbed. Could be rewritten better not to
need them, but I'll do major rewrites later in separate pull request.
Signed-off-by: Michal Hrusecky <michal.hrusecky@turris.com>
Just to make sure, add double quotes around strings and various
variables. In some cases it could prevent some issues, in other cases it
is just a good practice.
Signed-off-by: Michal Hrusecky <michal.hrusecky@turris.com>
Even though I think that mysql_upgrade is a client package (it depends
on the mysql client and it's in the "client" directory in the source
tree, for instance), upstream laid it out differently. Since upstream
commit ec586f5 mysql_upgrade is to be considered a part of the server,
because the COMPONENT argument in the MYSQL_ADD_EXECUTABLE macro is set
to "Server".
That means that mysql_upgrade is only installed when the server is. So
we need to move it back to the server package, otherwise we will have a
build failure when mariadb-client is selected while mariadb-server is
not. This particular build failure was recently a topic on
openwrt-devel.
Some more binaries are moved, following the layout visible in
"man/CMakeLists.txt", to make sure we follow upstream's vision with
regards to how the binaries are packaged.
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
mysqld_safe is the recommended way to start the server on non-systemd
systems ([1]). For instance, it has a crash detection with auto-restart
function, can update ulimits, setup core files, set the niceness of the
server etc. It looks like it could also be helpful when trying to set up
clusters. It's maintained upstream and adding it means we don't need to
add these features into our init script.
mysqld_safe is a script itself, so it's added to conffiles in case users
want to edit it.
It can't be run under procd, so the init script is converted to a normal
System V type. To stop the server and to reload the privileges tables
mysqladmin is used. To that end mysqladmin is moved into the server
package.
While changing the init script, the Debian init script was used for
ideas. It wasn't copied verbatim and adapted a bit here and there.
Thanks to whoever wrote it!
This commit removes the support for starting the service as a user other
than "mariadb". This makes the init script simpler. If anybody wants to
play around with the user then it's up to them to fix the permissions.
[1] https://mariadb.com/kb/en/mysqld_safe/
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
It's really a client. It connects to the running server as a client, to
upgrade the DBs. And it depends on both mysql and mysqlcheck.
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
With INSTALL_PAMDIR undefined some items necessary for the auth_pam
module aren't built. This adds the define so that configuration and
shared object become available.
This commit also tightens up the installation of the SUID tool. The
directory it is copied into gets created on the build host already with
u=rwx,g=rx,o=, so it cannot be accessed on target, except by root. The
post-install script then changes group ownership of the directory to the
"mariadb" group only if the directory is really a directory and owned by
"root:root".
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
Until now $(INSTALL_CONF) is used for configuration files that go into
/etc/mysql. This commit replaces that with $(INSTALL_DATA). The
configuration files are not only parsed by the server, but also by the
clients (which can be anybody).
This also removes a comment about a cron job from one of the
configuration files. There is no cron job.
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
Today CVE-2020-7221 was publicly discussed on oss-sec [1]. MariaDB
upstream had not mentioned this CVE in their last release notes. The CVE
is related to auth-pam and the possibility of a local mariadb to root
user exploit in the mysql_install_db script.
Upstream has made amendments to the script, but according to the oss-sec
posts the folder permissions were not updated as they should have been.
In OpenWrt the script mysql_install_db is actually patched to never run
the commands in question. This has been this way since MariaDB 10.4 was
made available.
Still, the directory permissions set by the postinstall script are too
lax. To quote the discoverer of the issue, Matthias Gerstner from Suse,
they exhibit "the dangerous situation of a setuid-root binary residing
in a directory owned by an unprivileged user".
This commit fixes this by changing the permissions to the following:
root:mariadb 0750 /usr/lib/mariadb/plugin/auth_pam_tool_dir
This way the setuid-root binary is only available to root and the
mariadb user, while at the same time the mariadb user has no ownership
of the directory.
[1] https://seclists.org/oss-sec/2020/q1/55
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
MariaDB 10.4 includes some changes in sql/sql_statistics.cc that require
std::fmin and std::fmax. But these functions aren't available when
libstdc++ is compiled against uClibc, because uClibc doesn't pass the
test when libstdc++ checks for C99 math that supports "TR1" facilities
(macro: GLIBCXX_CHECK_C99_TR1).
Hence compilation fails:
[ 90%] Building CXX object sql/CMakeFiles/sql.dir/sql_table.cc.o
/builder/shared-workdir/build/sdk/build_dir/target-arc_archs_uClibc/mariadb-10.4.10/sql/sql_statistics.cc: In member function 'void Column_statistics_collected::finish(ha_rows, double)':
/builder/shared-workdir/build/sdk/build_dir/target-arc_archs_uClibc/mariadb-10.4.10/sql/sql_statistics.cc:2533:20: error: 'fmax' is not a member of 'std'
val = std::fmax(estimate_total_distincts * (rows - nulls) / rows, 1.0);
This commit updates package dependencies to prevent a build against
uClibc. There is no reason to waste CPU cycles on the build bots.
The dependencies are also tidied up. In the past it made sense to define
MARIADB_COMMON_DEPENDS and MARIADB_COMMON_DEPENDS_EXE, because the
server had different dependencies compared to the library. But since the
library is now in its own package we can remove the differentiation.
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
This adds a few lines to the BuildPlugin routine to install some missing
files for auth_pam as well as ha_spider.
It also adds a postinstall script that updates the ownership of a
directory used by auth_pam.
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
This way when only wanting the library nobody needs to download and
compile the server package, saving space and time. Also this way we can
avoid sudden SONAME bumps during a server upgrade.
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
This moves mariadb-common into its own (tiny) package in preparation for
moving out libmariadb as well. Otherwise the library would have a
dependency on the big mariadb package.
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
Highlights:
- Bump from 10.2.26 to 10.4.10
- auth_pam got replaced with never version, old one still available as
auth_pam_v1
- semisync plugins were merged into the core
- Upstream now installs symlinks for binaries with mariadb prefix. To
accommodate that this commit updates Package/mariadb/install/bin
accordingly.
- Patches are updated with new ones from Debian and Arch (thanks!)
- libedit patch dropped because it's upstream now.
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
New upstream release. Addresses:
CVE-2019-2805
CVE-2019-2740
CVE-2019-2739
CVE-2019-2737
CVE-2019-2758
Package updates:
- includes "THIRDPARTY" in PKG_LICENSE_FILES
- drops client_ed25519 as a dynamic plugin and install it with the lib
as per upstream decision
- refreshes patches
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
Now that libaio compiles on arc targets we need to add the dependency to
libaio on these targets as well.
resolves#9298
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
- added trailing '--' to logger to make it foolproof
- user is extracted from config instead of using hard-coded value
- log directory is now also extracted from config (if set)
- directory creation is now done via awk script (more robust)
- improved log messages
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
From Release Notes:
Security
MDEV-18686 - Add option to PAM authentication plugin to allow case insensitive username matching
bugfix - multi-update checked privileges on views incorrectly (commit 5057d46375)
MDEV-19276 - during connect, write error log warning for ER_DBACCESS_DENIED_ERROR, if log_warnings > 1
MDEV-17456 - Malicious SUPER user can possibly change audit log configuration without leaving traces.
Fixes for the following security vulnerabilities:
CVE-2019-2614
CVE-2019-2627
CVE-2019-2628
OpenWrt changes:
- added PKG_CPE_ID
- shortened default description to make "opkg info" output easier on the eyes
- refreshed patches
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
The shared library does not depend on libatomic nor libstdcpp anymore.
This is very good news for the users of said lib.
This commit updates the depends accordingly.
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
50-client.cnf is used by the client library, so it should be installed
with the library. This commit moves the configuration file to the
correct package and updates its depend (50-client.cnf is sourced by
my.cnf from mariadb-common).
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
Does away with /etc/default/mysqld, introduces uci configuration
instead. The init script receives some further brushing up, like a
function (copied from Debian) to get mysqld configuration parameters
easily and quickly.
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
- correct spelling in comments ("mariadb" to "MariaDB")
- remove mysqld_safe and mysqld_safe_helper (not used)
- add some extra cmake configuration defines
- remove cmake configuration defines that don't exist in the source
- don't disable address sanitizer (ASAN) support
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
Add galera support by installing the configuration and including the
wsrep scripts in mariadb-server-extra.
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
There is little sense in keeping these charsets in an extra package. The
included sets are of the single byte character set variety. They only
amount to a few kbytes.
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
At present there are some flaws related to configuration, also related
to the packaging of mariadb. For starters there are complaints that the
configuration is too static.
To address this a new configuration layout is introduced. The primary
configuration file (my.cnf) is changed so that it now only includes
further configuration files in the directory /etc/mysql/conf.d. More
default configuration files are added for the server and the client.
This is the new default configuration.
With these changes it's possible for the user to select if they want to
change the default configuration (in conf.d/*.cnf) or if they want to
drop their own files into conf.d instead. If the user .cnf files are
read after the default .cnf files (files are included in alphabetical
order), they will overwrite the settings from the default configuration.
The other flaw is that the my.cnf file is included in mariadb-server.
But that doesn't really fit the requirements, as the client also uses
the configuration file(s). To accomodate this a new package
mariadb-common is added. It installs the shared my.cnf file.
The remaining changes add base packages, both for the server and the
client. These are meant as foundation for the packages containing the
respective binaries. In summary they will install the configuration,
small miscellaneous files (SQL scripts etc.) and the user "mariadb".
That means that everything is ready for the binaries, like mysql and
mysqld. If there is not enough space left on flash memory, the user can
just drop the binaries on a pendrive, link them to /usr/bin and get
started.
The ideas and configuration files were copied from Debian. Some
amendments were made.
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
This commit deals with changes related to plugins and how they're built
or disabled.
Currently a lot of plugins are packaged which are merely for tests or
plain examples. Other distros do not bundle these, hence this commit
does away with them.
A few new plugins are added related to PAM and Kerberos (auth_gssapi,
auth_gssapi_client and auth_pam).
The BuildPlugin template is refactored to also allow building of library
plugins (needed for auth_gssapi_client). The template is also cleaned up
- some extraneous dollar signs are removed and the install function is
now defined outside the template.
Unwanted plugins/engines are now turned off efficiently (without using
cmake variables) by blanking CMakeLists.txt files in the associated
folders. The idea was lifted from Gentoo.
ha_sequence is now built into the server. This is an upstream
preference. The plugin is about 30 kbytes in size, so there is no harm
adding it into the server, which weighs in at about 15 Mbytes anyway.
Last but not least the auth_socket plugin is now also built into the
server. This allows the local root user to login to the database
without a password being set. This makes maintenance easier without
being detrimental to security. The idea was lifted from Debian.
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
libedit changed its interface a while back. mariadb currently does not
recognize this interface and instead uses a static old readline version.
It does not link in the system readline due to licence incompatibility.
This commit adds a patch that enables mariadb to detect and use the
system libedit. The patch was sent upstream already ([1]).
[1] https://github.com/MariaDB/server/pull/1001
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
The build breaks when Kerberos is available in staging dir. mariadb
build system exits with error:
CMake Error at libmariadb/cmake/plugins.cmake:43 (message):
Invalid plugin type NO. Allowed plugin types are DYNAMIC;STATIC;OFF
It doesn't like the definition "PLUGIN_AUTH_GSSAPI_CLIENT=NO" anymore.
We need to set it to "OFF" to make it happy.
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
Include fix from upstream for MDEV-17200. musl-1.1.20 segfaults when
pthread_detach() is called for already detached threads.
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
From Release Notes:
- New variable innodb_log_optimize_ddl for avoiding delay due to page flushing and allowing concurrent backup
- InnoDB updated to 5.7.23
- ALTER TABLE fixes:
MDEV-14637 - Fix hang due to DDL with FOREIGN KEY or persistent statistics
MDEV-15953 - Alter InnoDB Partitioned Table Moves Files (which were originally not in the datadir) to the datadir
MDEV-16515 - InnoDB: Failing assertion: ++retries < 10000 in file dict0dict.cc line 2737
MDEV-16809 - Allow full redo logging for ALTER TABLE
- Temporary tables: MDEV-16713 - InnoDB hang with repeating log entry
- indexed virtual columns: MDEV-15855 - Deadlock between purge thread and DDL statement
- locking: MDEV-16664 - Change the default to innodb_lock_schedule_algorithm=fcfs
- Galera: MDEV-15822 - WSREP: BF lock wait long for trx
- Fixes for the following security vulnerabilities:
CVE-2018-3060
CVE-2018-3064
CVE-2018-3063
CVE-2018-3058
CVE-2018-3066
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
Ilya Lipnitskiy
Michal Hrusecky
Rosen Penev
Sebastian Kemper
Michal Hrusecky
Eneas U de Queiroz