Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 904047 - dev-db/mysql: sandbox access violation during mysql update
Summary: dev-db/mysql: sandbox access violation during mysql update
Status: UNCONFIRMED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: x86 Linux
: Normal normal (vote)
Assignee: Gentoo Linux MySQL bugs team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-04-08 17:50 UTC by Mario Klebsch
Modified: 2024-02-10 06:37 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
Build log (compressed) (build.log.gz,164.78 KB, text/plain)
2023-04-10 20:05 UTC, Mario Klebsch
Details
emerge --info (emerge.info,5.74 KB, text/plain)
2023-04-10 20:05 UTC, Mario Klebsch
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Mario Klebsch 2023-04-08 17:50:11 UTC
Updating mysql fails on my system due to a sandbox access violation:


 * ----------------------- SANDBOX ACCESS VIOLATION SUMMARY -----------------------
 * LOG FILE: "/var/tmp/portage/dev-db/mysql-8.0.31-r2/temp/sandbox.log"
 * 
VERSION 1.0
FORMAT: F - Function called
FORMAT: S - Access Status
FORMAT: P - Path as passed to function
FORMAT: A - Absolute Path (not canonical)
FORMAT: R - Canonical Path
FORMAT: C - Command Line

F: unlink
S: deny
P: /var/lib/mysql/mysqld-auto.cnf.backup
A: /var/lib/mysql/mysqld-auto.cnf.backup
R: /var/lib/mysql/mysqld-auto.cnf.backup
C: /var/tmp/portage/dev-db/mysql-8.0.31-r2/work/mysql_build/runtime_output_directory/mysqld --no-defaults --help 
 * --------------------------------------------------------------------------------

/var/lib/mysql/mysqld-auto.cnf.backup does not exist after the failed update, but I do have a file /var/lib/mysql/mysqld-auto.cnf.
Comment 1 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2023-04-08 19:37:14 UTC
Please include the full build.log and emerge --info.
Comment 2 Mike Gilbert gentoo-dev 2023-04-10 19:28:51 UTC
Change the status to UNCONFIRMED once the above has been provided.
Comment 3 Mario Klebsch 2023-04-10 20:05:25 UTC
Created attachment 859827 [details]
Build log (compressed)
Comment 4 Mario Klebsch 2023-04-10 20:05:40 UTC
Created attachment 859828 [details]
emerge --info
Comment 5 Mario Klebsch 2023-05-04 06:53:08 UTC
I was able to re-produce the problem on a fresh installation of gentoo.

1. install mysql:       emerge --ask mysql
2. configure mysql:     emerge --config dev-db/mysql
3. start mysql server:  /etc/init.d/mysql start
4. start mysql shell:   mysql -p
5. on mysql shell:      set persist binlog_expire_logs_seconds = 259200;
6. re-emerge mysql:     emerge --ask mysql
Comment 6 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2023-05-04 06:54:40 UTC
Thank you!
Comment 7 Mario Klebsch 2023-05-04 07:40:03 UTC
I was able to get mysql updated by adding a file /etc/sandbox.d/99mysql:

> # cat  /etc/sandbox.d/99mysql 
> SANDBOX_WRITE="/var/lib/mysql/mysqld-auto.cnf.backup"
> # 

But I am not sure, why the filename in /etc/sandbox.d/ start with a number. In /etc/rc2.d, filenames starting with numbers were use to control the execution order, but I do not see the impact of ordering sandbox configurations.

I also assume that tis exceptions allows all ebuilds to write to /var/lib/mysql/mysqld-auto.cnf.backup, not just only dev-db/mysql.
Comment 8 augustin 2024-02-10 06:37:37 UTC
I confirm the bug and the fix given in comment 7.


Originally, mysql emerged without any problems, and I have been installing mysql on multiple systems over the years without ever hitting that bug.

But I just tried to emerge sci-libs/pytorch which for some reasons caused a mysql rebuild, and that is when I hit the current bug.

In order to emerge pytorch, I had to make the following changes to my system:

# cat /etc/portagepackage.accept_keywords/pytorch 
sci-libs/pytorch        ~amd64
sci-libs/caffe2         ~amd64
dev-libs/cpuinfo        ~amd64
dev-libs/pthreadpool    ~amd64
sci-libs/onnx           ~amd64
sci-libs/foxi           ~amd64
dev-libs/psimd          ~amd64
dev-libs/FP16           ~amd64
dev-libs/FXdiv          ~amd64
dev-libs/pocketfft      ~amd64
sci-libs/kineto         ~amd64
dev-libs/dynolog        ~amd64
dev-python/PeachPy      ~amd64
dev-python/Opcodes      ~amd64

# cat /etc/portage/package.use/pytorch
sci-libs/caffe2 opencv


Then:
# emerge -a pytorch

These are the packages that would be merged, in order:

Calculating dependencies... done!
Dependency resolution took 20.03 s (backtrack: 13/20).

[ebuild  N    ~] dev-libs/pocketfft-2021.11.23
[ebuild  N     ] sys-libs/libunwind-1.7.2  USE="zlib -debug -debug-frame -doc -libatomic -lzma -static-libs -test" ABI_X86="(64) -32 (-x32)"
[ebuild  N     ] dev-python/mpmath-1.3.0-r1  USE="-test" PYTHON_TARGETS="python3_11 (-pypy3) -python3_10 (-python3_12)"
[ebuild  N    ~] dev-python/Opcodes-0.3.14-r1  USE="-doc" PYTHON_TARGETS="python3_11 -python3_10 -python3_12"
[ebuild  N     ] dev-python/pyyaml-6.0.1-r1  USE="-debug -examples -test" PYTHON_TARGETS="python3_11 (-pypy3) -python3_10 (-python3_12)"
[ebuild  N     ] dev-python/ptyprocess-0.7.0-r1  USE="-test" PYTHON_TARGETS="python3_11 (-pypy3) -python3_10 (-python3_12)"
[ebuild  N    ~] dev-python/PeachPy-2022.11.13-r2  USE="-doc" PYTHON_TARGETS="python3_11 -python3_10 -python3_12"
[ebuild  N     ] dev-python/pexpect-4.9.0  USE="-doc -examples -test" PYTHON_TARGETS="python3_11 (-pypy3) -python3_10 (-python3_12)"
[ebuild  N     ] dev-cpp/gflags-2.2.2-r1  USE="-static-libs -test" ABI_X86="(64) -32 (-x32)"
[ebuild  N     ] dev-cpp/glog-0.6.0  USE="libunwind -gflags -llvm-libunwind -test" ABI_X86="(64) -32 (-x32)"
[ebuild  N    ~] dev-libs/psimd-2020.05.17
[ebuild  N    ~] dev-libs/FXdiv-2020.12.09-r1  USE="-test"
[ebuild  N     ] dev-libs/flatbuffers-23.5.26  USE="-static-libs -test"
[ebuild  N    ~] dev-libs/cpuinfo-2023.01.13  USE="-test"
[ebuild  N     ] dev-libs/sleef-3.5.1-r1  USE="-test"
[ebuild  N    ~] sci-libs/foxi-2021.05.27
[ebuild  N     ] dev-cpp/gtest-1.13.0  USE="-doc -examples -test" ABI_X86="(64) -32 (-x32)"
[ebuild  N    ~] dev-libs/pthreadpool-2023.08.29  USE="-test"
[ebuild  N    ~] dev-libs/FP16-2021.03.20-r4  USE="-test" PYTHON_TARGETS="python3_11 -python3_10 -python3_12"
[ebuild  N    ~] dev-libs/dynolog-0.3.1_p20230126-r1  USE="-debug -test"
[ebuild  N    ~] sci-libs/kineto-0.4.0_p20231127  USE="-test"
[ebuild  N     ] dev-python/pyopengl-3.1.7-r1  USE="-test -tk" PYTHON_TARGETS="python3_11 (-pypy3) -python3_10 (-python3_12)"
[ebuild  N     ] dev-python/sympy-1.12-r1  USE="opengl pdf png -aesara -examples -imaging -ipython -latex -mathml -pyglet -symengine -test (-texmacs)" PYTHON_TARGETS="python3_11 (-pypy3) -python3_10 (-python3_12)"
[ebuild  r  UD ] dev-libs/protobuf-21.9 [21.12] USE="-static-libs%"
[ebuild  N     ] dev-python/protobuf-python-4.21.9  USE="-debug -test" PYTHON_TARGETS="python3_11 -python3_10 (-python3_12)"
[ebuild  N    ~] sci-libs/onnx-1.14.1-r2  USE="python -debug" PYTHON_TARGETS="python3_11 -python3_10 -python3_12"
[ebuild  N     ] media-libs/opencv-4.8.1-r1  USE="contrib contribdnn eigen features2d ffmpeg jpeg opengl openmp png python qt5 tiff (-contribcvv) -contribfreetype (-contribhdf) (-contribovis) (-contribsfm) (-contribxfeatures2d) (-cuda) (-cudnn) -debug -dnnsamples -examples -gdal (-gflags) (-glog) -gphoto2 -gstreamer -gtk3 -ieee1394 -java -jpeg2k -lapack -non-free -opencl -opencvapps -openexr -qt6 -tbb (-tesseract) -testprograms -v4l -vaapi (-vtk) -webp -xine" ABI_X86="(64) -32 (-x32)" CPU_FLAGS_X86="avx avx2 avx512f f16c fma3 popcnt sse sse2 sse3 sse4_1 sse4_2 ssse3" PYTHON_TARGETS="python3_11 -python3_10 (-python3_12)" VIDEO_CARDS="-intel"
[ebuild  N    ~] sci-libs/caffe2-2.1.2-r3  USE="ffmpeg numpy opencv openmp -cuda -distributed -fbgemm -gloo -mkl -mpi -nnpack -onednn -opencl -qnnpack -tensorpipe -xnnpack" PYTHON_SINGLE_TARGET="python3_11 -python3_10 -python3_12"
[ebuild  N    ~] sci-libs/pytorch-2.1.2-r1  USE="-debug" PYTHON_SINGLE_TARGET="python3_11 -python3_10 -python3_12"
[ebuild  rR    ] dev-db/mysql-8.0.32-r2

WARNING: One or more updates/rebuilds have been skipped due to a dependency conflict:

dev-libs/protobuf:0

  (dev-libs/protobuf-21.12:0/3.21.12.0::gentoo, ebuild scheduled for merge) USE="zlib -emacs -examples -test" ABI_X86="(64) -32 (-x32)" conflicts with
    dev-libs/protobuf:0/32 required by (dev-python/protobuf-python-4.21.9:0/32::gentoo, ebuild scheduled for merge) USE="-debug -test" ABI_X86="(64)" PYTHON_TARGETS="python3_11 -python3_10 (-python3_12)"
                     ^^^^^


The following packages are causing rebuilds:

  (dev-libs/protobuf-21.9:0/32::gentoo, ebuild scheduled for merge) causes rebuilds for:
    (dev-db/mysql-8.0.32-r2:8.0/8.0::gentoo, ebuild scheduled for merge)

Would you like to merge these packages? [Yes/No] y

Note that dev-libs/protobuf caused a rebuild of ev-db/mysql.


Everything emerged successfully except mysqld:

* ACCESS DENIED:  unlink:             /var/lib/mysql/mysqld-auto.cnf.backup
* ----------------------- SANDBOX ACCESS VIOLATION SUMMARY -----------------------
*
VERSION 1.0
FORMAT: F - Function called
FORMAT: S - Access Status
FORMAT: P - Path as passed to function
FORMAT: A - Absolute Path (not canonical)
FORMAT: R - Canonical Path
FORMAT: C - Command Line

F: unlink
S: deny
P: /var/lib/mysql/mysqld-auto.cnf.backup
A: /var/lib/mysql/mysqld-auto.cnf.backup
R: /var/lib/mysql/mysqld-auto.cnf.backup
C: /var/tmp/portage/dev-db/mysql-8.0.32-r2/work/mysql_build/runtime_output_directory/




Comment 7 provided the fix. Thank you.