Blame SOURCES/bz1692960-mysql-galera-runuser-su-to-avoid-dac_override.patch

734564
From db6d12f4b7b10e214526512abe35307270f81c03 Mon Sep 17 00:00:00 2001
734564
From: Oyvind Albrigtsen <oalbrigt@redhat.com>
734564
Date: Thu, 8 Aug 2019 14:48:13 +0200
734564
Subject: [PATCH] mysql/mariadb/galera: use runuser/su to avoid using SELinux
734564
 DAC_OVERRIDE
734564
734564
---
734564
 heartbeat/galera          | 11 ++++++-----
734564
 heartbeat/mysql-common.sh | 16 ++++++++++++----
734564
 2 files changed, 18 insertions(+), 9 deletions(-)
734564
734564
diff --git a/heartbeat/galera b/heartbeat/galera
734564
index 9b9fe5569..056281fb8 100755
734564
--- a/heartbeat/galera
734564
+++ b/heartbeat/galera
734564
@@ -624,8 +624,7 @@ detect_last_commit()
734564
     local recover_args="--defaults-file=$OCF_RESKEY_config \
734564
                         --pid-file=$OCF_RESKEY_pid \
734564
                         --socket=$OCF_RESKEY_socket \
734564
-                        --datadir=$OCF_RESKEY_datadir \
734564
-                        --user=$OCF_RESKEY_user"
734564
+                        --datadir=$OCF_RESKEY_datadir"
734564
     local recovery_file_regex='s/.*WSREP\:.*position\s*recovery.*--log_error='\''\([^'\'']*\)'\''.*/\1/p'
734564
     local recovered_position_regex='s/.*WSREP\:\s*[R|r]ecovered\s*position.*\:\(.*\)\s*$/\1/p'
734564
 
734564
@@ -654,7 +653,8 @@ detect_last_commit()
734564
 
734564
         ocf_log info "now attempting to detect last commit version using 'mysqld_safe --wsrep-recover'"
734564
 
734564
-        ${OCF_RESKEY_binary} $recover_args --wsrep-recover --log-error=$tmp 2>/dev/null
734564
+        $SU - $OCF_RESKEY_user -s /bin/sh -c \
734564
+        "${OCF_RESKEY_binary} $recover_args --wsrep-recover --log-error=$tmp 2>/dev/null"
734564
 
734564
         last_commit="$(cat $tmp | sed -n $recovered_position_regex | tail -1)"
734564
         if [ -z "$last_commit" ]; then
734564
@@ -670,8 +670,9 @@ detect_last_commit()
734564
                     # we can only rollback the transaction, but that's OK
734564
                     # since the DB will get resynchronized anyway
734564
                     ocf_log warn "local node <${NODENAME}> was not shutdown properly. Rollback stuck transaction with --tc-heuristic-recover"
734564
-                    ${OCF_RESKEY_binary} $recover_args --wsrep-recover \
734564
-                                         --tc-heuristic-recover=rollback --log-error=$tmp 2>/dev/null
734564
+                    $SU - $OCF_RESKEY_user -s /bin/sh -c \
734564
+                    "${OCF_RESKEY_binary} $recover_args --wsrep-recover \
734564
+                                         --tc-heuristic-recover=rollback --log-error=$tmp 2>/dev/null"
734564
 
734564
                     last_commit="$(cat $tmp | sed -n $recovered_position_regex | tail -1)"
734564
                     if [ ! -z "$last_commit" ]; then
734564
diff --git a/heartbeat/mysql-common.sh b/heartbeat/mysql-common.sh
734564
index d5ac972cd..65db9bf85 100755
734564
--- a/heartbeat/mysql-common.sh
734564
+++ b/heartbeat/mysql-common.sh
734564
@@ -2,6 +2,13 @@
734564
 
734564
 #######################################################################
734564
 
734564
+# Use runuser if available for SELinux.
734564
+if [ -x /sbin/runuser ]; then
734564
+	SU=runuser
734564
+else
734564
+	SU=su
734564
+fi
734564
+
734564
 # Attempt to detect a default binary
734564
 OCF_RESKEY_binary_default=$(which mysqld_safe 2> /dev/null)
734564
 if [ "$OCF_RESKEY_binary_default" = "" ]; then
734564
@@ -207,7 +214,7 @@ mysql_common_prepare_dirs()
734564
     # already existed, check whether it is writable by the configured
734564
     # user
734564
     for dir in $pid_dir $socket_dir; do
734564
-        if ! su -s /bin/sh - $OCF_RESKEY_user -c "test -w $dir"; then
734564
+        if ! $SU -s /bin/sh - $OCF_RESKEY_user -c "test -w $dir"; then
734564
             ocf_exit_reason "Directory $dir is not writable by $OCF_RESKEY_user"
734564
             exit $OCF_ERR_PERM;
734564
         fi
734564
@@ -219,14 +226,15 @@ mysql_common_start()
734564
     local mysql_extra_params="$1"
734564
     local pid
734564
 
734564
-    ${OCF_RESKEY_binary} --defaults-file=$OCF_RESKEY_config \
734564
+    $SU - $OCF_RESKEY_user -s /bin/sh -c \
734564
+    "${OCF_RESKEY_binary} --defaults-file=$OCF_RESKEY_config \
734564
     --pid-file=$OCF_RESKEY_pid \
734564
     --socket=$OCF_RESKEY_socket \
734564
     --datadir=$OCF_RESKEY_datadir \
734564
     --log-error=$OCF_RESKEY_log \
734564
-    --user=$OCF_RESKEY_user $OCF_RESKEY_additional_parameters \
734564
+    $OCF_RESKEY_additional_parameters \
734564
     $mysql_extra_params >/dev/null 2>&1 &
734564
-    pid=$!
734564
+    pid=$!"
734564
 
734564
     # Spin waiting for the server to come up.
734564
     # Let the CRM/LRM time us out if required.