4 ms·

If Debian is running mysqld_safe as root then that--alone--is a problem. As for the rest, they are just configuration mishaps being used with malicious intent.

If Debian is running mysqld_safe as root then that--alone--is a problem. As for the rest, they are just configuration mishaps being used with malicious intent. One could just as easily misconfigure similar services rendering similar results.

JdeBP 10y ago
It's the running it that is the problem, not the running it as root. mysqld_safe is a Poor Man's Daemon Supervisor, written badly in shell script, as they always are. It demands running as root, because it has a configuration parameter of the user that the server program attempts to switch to and that it chown's various files to. (Part of) the problem is that it is run at all. Don't be confused into thinking that this is a Debian problem, moreover, just because the problem happened to be demonstrated on Debian Linux. Debian isn't the only system still running mysqld_safe. * http://jdebp.eu./Softwares/nosh/mariadb-and-mysql.html http://jdebp.eu./Softwares/nosh/mariadb-and-mysql.html
- msimpson 10y ago
  You're right, running mysqld_safe is the problem. However, after a quick bit of further research, even Debian isn't running mysqld_safe anymore as they now default to systemd in version 8. So this isn't even a problem in that distribution unless you make it one.
  - JdeBP 10y ago
    Your research was too quick. (-: Debian 8 packages up mysql 5.5 with only a van Smoorenburg rc script, no systemd units. * https://packages.debian.org/en/jessie/arm64/mysql-server-5.5/filelist https://packages.debian.org/en/jessie/arm64/mysql-server-5.5... Debian 8 only has mysql 5.6 available through backports. That has a systemd service unit, written in 2014 by Akhil Mohan of Oracle. That service unit invokes mysqld_safe, though, in classic systemd House of Horror fashion. * https://packages.debian.org/en/jessie-backports/arm64/mysql-server-5.6/filelist https://packages.debian.org/en/jessie-backports/arm64/mysql-... * https://anonscm.debian.org/cgit/pkg-mysql/mysql-5.6.git/tree/debian/mysql-server-5.6.mysql.service?id=fcd2771abdb7cc4809f6dfce6d900dbf612e5113 https://anonscm.debian.org/cgit/pkg-mysql/mysql-5.6.git/tree... Apparently, Red Hat Enterprise Linux 7 has no systemd unit files for mysql 5.6, either, and still uses mysqld_safe. * http://rpm.pbone.net/index.php3/stat/6/idpl/34647467/dir/redhat_el_7/com/MySQL-server-5.6.33-1.el7.x86_64.rpm http://rpm.pbone.net/index.php3/stat/6/idpl/34647467/dir/red...
    - msimpson 10y ago
      You're right, again, even though you linked arm64 file lists instead of amd64. The 5.6 backport does have that unit file, but the badly written one from Oracle. I guess you shouldn't use Debian (-:

JdeBP 10y ago

It's the running it that is the problem, not the running it as root. mysqld_safe is a Poor Man's Daemon Supervisor, written badly in shell script, as they always are. It demands running as root, because it has a configuration parameter of the user that the server program attempts to switch to and that it chown's various files to. (Part of) the problem is that it is run at all. Don't be confused into thinking that this is a Debian problem, moreover, just because the problem happened to be demonstrated on Debian Linux. Debian isn't the only system still running mysqld_safe. * http://jdebp.eu./Softwares/nosh/mariadb-and-mysql.html http://jdebp.eu./Softwares/nosh/mariadb-and-mysql.html

msimpson 10y ago
You're right, running mysqld_safe is the problem. However, after a quick bit of further research, even Debian isn't running mysqld_safe anymore as they now default to systemd in version 8. So this isn't even a problem in that distribution unless you make it one.
- JdeBP 10y ago
  Your research was too quick. (-: Debian 8 packages up mysql 5.5 with only a van Smoorenburg rc script, no systemd units. * https://packages.debian.org/en/jessie/arm64/mysql-server-5.5/filelist https://packages.debian.org/en/jessie/arm64/mysql-server-5.5... Debian 8 only has mysql 5.6 available through backports. That has a systemd service unit, written in 2014 by Akhil Mohan of Oracle. That service unit invokes mysqld_safe, though, in classic systemd House of Horror fashion. * https://packages.debian.org/en/jessie-backports/arm64/mysql-server-5.6/filelist https://packages.debian.org/en/jessie-backports/arm64/mysql-... * https://anonscm.debian.org/cgit/pkg-mysql/mysql-5.6.git/tree/debian/mysql-server-5.6.mysql.service?id=fcd2771abdb7cc4809f6dfce6d900dbf612e5113 https://anonscm.debian.org/cgit/pkg-mysql/mysql-5.6.git/tree... Apparently, Red Hat Enterprise Linux 7 has no systemd unit files for mysql 5.6, either, and still uses mysqld_safe. * http://rpm.pbone.net/index.php3/stat/6/idpl/34647467/dir/redhat_el_7/com/MySQL-server-5.6.33-1.el7.x86_64.rpm http://rpm.pbone.net/index.php3/stat/6/idpl/34647467/dir/red...
  - msimpson 10y ago
    You're right, again, even though you linked arm64 file lists instead of amd64. The 5.6 backport does have that unit file, but the badly written one from Oracle. I guess you shouldn't use Debian (-: