Package: mysql-server
Version: 4.0.24-5
I have some suggestions to make it easier to use mysqld's "chroot"
feature. As with the setuid call, the chroot call must be carefully
positioned in the server's initialization sequence. The current
placement of the chroot call makes it hard to use.
By moving some of the file-accessing initialization before the chroot,
fewer system files need to be copied into the chroot area, making set-up
easier and more portable. Also, the external behavior of mysqld would
be more like the behavior without chroot.
Three initialization operations that could be moved before the chroot:
1. Determining the numeric UID and GID to use for our process. The
user/group name to number translation is complicated and opens many
system files. Library calls such as initgroups(), getpwnam(),
and getpwuid() may load shared libraries and files in /etc such as
/etc/passwd, /etc/group, and /etc/nsswitch.conf.
Once we have the numbers, the setuid and setgid calls themselves
should not be moved, of course, as they must happen after binding
the TCP listening socket.
Because the initgroups function both determines the numeric groups
to use and also sets them, it should be replaced with getgrouplist
(before the chroot) and setgroups (after the chroot).
2. Writing the .pid file. It is simplest to leave this where it is and
have agreement on its location between the daemon, the config files,
and the scripts.
3. Opening the Unix socket. Again, it is most convenient to not change
the location of this socket in the file system. This is probably
the most important change to make.
Note that the opening of the TCP/IP listener socket can continue to
happen after the chroot.
Note that all these changes are separable, and doing any of them would
make chroot easier to use even if not all of the changes were done.
It looks to me like the affected code is in sql/mysqld.cc.
These comments apply to MySQL 4.0.24 and 4.1.11.
< Stephen
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
