|
 |
734564 |
From db6d12f4b7b10e214526512abe35307270f81c03 Mon Sep 17 00:00:00 2001
|
|
|
734564 |
From: Oyvind Albrigtsen <oalbrigt@redhat.com>
|
|
|
734564 |
Date: Thu, 8 Aug 2019 14:48:13 +0200
|
|
|
734564 |
Subject: [PATCH] mysql/mariadb/galera: use runuser/su to avoid using SELinux
|
|
|
734564 |
DAC_OVERRIDE
|
|
|
734564 |
|
|
|
734564 |
---
|
|
|
734564 |
heartbeat/galera | 11 ++++++-----
|
|
|
734564 |
heartbeat/mysql-common.sh | 16 ++++++++++++----
|
|
|
734564 |
2 files changed, 18 insertions(+), 9 deletions(-)
|
|
|
734564 |
|
|
|
734564 |
diff --git a/heartbeat/galera b/heartbeat/galera
|
|
|
734564 |
index 9b9fe5569..056281fb8 100755
|
|
|
734564 |
--- a/heartbeat/galera
|
|
|
734564 |
+++ b/heartbeat/galera
|
|
|
734564 |
@@ -624,8 +624,7 @@ detect_last_commit()
|
|
|
734564 |
local recover_args="--defaults-file=$OCF_RESKEY_config \
|
|
|
734564 |
--pid-file=$OCF_RESKEY_pid \
|
|
|
734564 |
--socket=$OCF_RESKEY_socket \
|
|
|
734564 |
- --datadir=$OCF_RESKEY_datadir \
|
|
|
734564 |
- --user=$OCF_RESKEY_user"
|
|
|
734564 |
+ --datadir=$OCF_RESKEY_datadir"
|
|
|
734564 |
local recovery_file_regex='s/.*WSREP\:.*position\s*recovery.*--log_error='\''\([^'\'']*\)'\''.*/\1/p'
|
|
|
734564 |
local recovered_position_regex='s/.*WSREP\:\s*[R|r]ecovered\s*position.*\:\(.*\)\s*$/\1/p'
|
|
|
734564 |
|
|
|
734564 |
@@ -654,7 +653,8 @@ detect_last_commit()
|
|
|
734564 |
|
|
|
734564 |
ocf_log info "now attempting to detect last commit version using 'mysqld_safe --wsrep-recover'"
|
|
|
734564 |
|
|
|
734564 |
- ${OCF_RESKEY_binary} $recover_args --wsrep-recover --log-error=$tmp 2>/dev/null
|
|
|
734564 |
+ $SU - $OCF_RESKEY_user -s /bin/sh -c \
|
|
|
734564 |
+ "${OCF_RESKEY_binary} $recover_args --wsrep-recover --log-error=$tmp 2>/dev/null"
|
|
|
734564 |
|
|
|
734564 |
last_commit="$(cat $tmp | sed -n $recovered_position_regex | tail -1)"
|
|
|
734564 |
if [ -z "$last_commit" ]; then
|
|
|
734564 |
@@ -670,8 +670,9 @@ detect_last_commit()
|
|
|
734564 |
# we can only rollback the transaction, but that's OK
|
|
|
734564 |
# since the DB will get resynchronized anyway
|
|
|
734564 |
ocf_log warn "local node <${NODENAME}> was not shutdown properly. Rollback stuck transaction with --tc-heuristic-recover"
|
|
|
734564 |
- ${OCF_RESKEY_binary} $recover_args --wsrep-recover \
|
|
|
734564 |
- --tc-heuristic-recover=rollback --log-error=$tmp 2>/dev/null
|
|
|
734564 |
+ $SU - $OCF_RESKEY_user -s /bin/sh -c \
|
|
|
734564 |
+ "${OCF_RESKEY_binary} $recover_args --wsrep-recover \
|
|
|
734564 |
+ --tc-heuristic-recover=rollback --log-error=$tmp 2>/dev/null"
|
|
|
734564 |
|
|
|
734564 |
last_commit="$(cat $tmp | sed -n $recovered_position_regex | tail -1)"
|
|
|
734564 |
if [ ! -z "$last_commit" ]; then
|
|
|
734564 |
diff --git a/heartbeat/mysql-common.sh b/heartbeat/mysql-common.sh
|
|
|
734564 |
index d5ac972cd..65db9bf85 100755
|
|
|
734564 |
--- a/heartbeat/mysql-common.sh
|
|
|
734564 |
+++ b/heartbeat/mysql-common.sh
|
|
|
734564 |
@@ -2,6 +2,13 @@
|
|
|
734564 |
|
|
|
734564 |
#######################################################################
|
|
|
734564 |
|
|
|
734564 |
+# Use runuser if available for SELinux.
|
|
|
734564 |
+if [ -x /sbin/runuser ]; then
|
|
|
734564 |
+ SU=runuser
|
|
|
734564 |
+else
|
|
|
734564 |
+ SU=su
|
|
|
734564 |
+fi
|
|
|
734564 |
+
|
|
|
734564 |
# Attempt to detect a default binary
|
|
|
734564 |
OCF_RESKEY_binary_default=$(which mysqld_safe 2> /dev/null)
|
|
|
734564 |
if [ "$OCF_RESKEY_binary_default" = "" ]; then
|
|
|
734564 |
@@ -207,7 +214,7 @@ mysql_common_prepare_dirs()
|
|
|
734564 |
# already existed, check whether it is writable by the configured
|
|
|
734564 |
# user
|
|
|
734564 |
for dir in $pid_dir $socket_dir; do
|
|
|
734564 |
- if ! su -s /bin/sh - $OCF_RESKEY_user -c "test -w $dir"; then
|
|
|
734564 |
+ if ! $SU -s /bin/sh - $OCF_RESKEY_user -c "test -w $dir"; then
|
|
|
734564 |
ocf_exit_reason "Directory $dir is not writable by $OCF_RESKEY_user"
|
|
|
734564 |
exit $OCF_ERR_PERM;
|
|
|
734564 |
fi
|
|
|
734564 |
@@ -219,14 +226,15 @@ mysql_common_start()
|
|
|
734564 |
local mysql_extra_params="$1"
|
|
|
734564 |
local pid
|
|
|
734564 |
|
|
|
734564 |
- ${OCF_RESKEY_binary} --defaults-file=$OCF_RESKEY_config \
|
|
|
734564 |
+ $SU - $OCF_RESKEY_user -s /bin/sh -c \
|
|
|
734564 |
+ "${OCF_RESKEY_binary} --defaults-file=$OCF_RESKEY_config \
|
|
|
734564 |
--pid-file=$OCF_RESKEY_pid \
|
|
|
734564 |
--socket=$OCF_RESKEY_socket \
|
|
|
734564 |
--datadir=$OCF_RESKEY_datadir \
|
|
|
734564 |
--log-error=$OCF_RESKEY_log \
|
|
|
734564 |
- --user=$OCF_RESKEY_user $OCF_RESKEY_additional_parameters \
|
|
|
734564 |
+ $OCF_RESKEY_additional_parameters \
|
|
|
734564 |
$mysql_extra_params >/dev/null 2>&1 &
|
|
|
734564 |
- pid=$!
|
|
|
734564 |
+ pid=$!"
|
|
|
734564 |
|
|
|
734564 |
# Spin waiting for the server to come up.
|
|
|
734564 |
# Let the CRM/LRM time us out if required.
|