Starting mysqld using "/etc/init.d/mysql start" with a umask other than 022 (such as 027) can cause /var/run/mysqld to be created with permissions that prevent the MySQL socket from being accessed from normal user processes. Reproducible: Always Steps to Reproduce: 1. /etc/init.d/mysql stop (Make sure that MySQL is stopped) 2. rm -rf /var/run/mysqld (to make sure that the directory is gone) 3. umask 027 4. /etc/init.d/mysql start 5. ls -ld /var/run/mysqld Actual Results: # ls -ld /var/run/mysqld drwxr-x--- 2 mysql root 80 Jun 24 14:39 /var/run/mysqld Expected Results: # ls -ld /var/run/mysqld drwxr-xr-x 2 mysql mysql 80 Jun 24 14:27 /var/run/mysqld The init script creates the /var/run/mysqld directory when the PID file is handled in the start() function: local piddir="${pidfile%/*}" if [ ! -d "$piddir" ] ; then mkdir "$piddir" && \ chown mysql "$piddir" The chown command should technically set the ownership to mysql:mysql, and explicitly do a: chmod 755 "$piddir" as well. This would prevent the umask from affecting the permissions of the /var/run/mysqld directory. Alternatively, the init script itself could explicitly set the umask to a known value, which may solve any number of issues related to this... Note that it is not obvious from the init script that mysqld.sock is also created in this directory (since that is in my.cnf, and not part of the init script). This is probably why it wasn't considered important that this directory be readable by world. The reason why this wasn't originally a big deal was that the /var/run/mysqld directory had persistent permissions before /var/run was handled as a tmpfs in newer baselayouts. Now that it is a tmpfs, the permissions aren't peristent and that directory will be created every time the system is booted (or the first time that /etc/init.d/mysql is run, in this case). Workaround: Be sure that your umask is 022 before using this init.d script If you would like my system's configuration, I can add it here, but I believe that the information I provided above should be sufficient.
Portage 2.1.10.49 (default/linux/amd64/10.0, gcc-4.5.3, glibc-2.14.1-r3, 3.4.2-x86_64-linode25 x86_64) ================================================================= System uname: Linux-3.4.2-x86_64-linode25-x86_64-Intel-R-_Xeon-R-_CPU_L5520_@_2.27GHz-with-gentoo-2.1 Timestamp of tree: Wed, 13 Jun 2012 20:45:01 +0000 app-shells/bash: 4.2_p20 dev-lang/python: 2.7.3-r2, 3.2.3 sys-apps/baselayout: 2.1-r1 sys-apps/openrc: 0.9.8.4 sys-apps/sandbox: 2.5 sys-devel/binutils: 2.21.1-r1 sys-devel/gcc: 4.5.3-r2 sys-devel/gcc-config: 1.6 sys-devel/make: 3.82-r1 sys-kernel/linux-headers: 3.1 (virtual/os-headers) sys-libs/glibc: 2.14.1-r3 Repositories: gentoo kloepfer ACCEPT_KEYWORDS="amd64" ACCEPT_LICENSE="*" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-O2 -march=nocona -pipe -fomit-frame-pointer -fno-ident -mno-tls-direct-seg-refs" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/gconf /etc/gentoo-release /etc/init.d /etc/php/apache2-php5.3/ext-active/ /etc/php/cgi-php5.3/ext-active/ /etc/php/cli-php5.3/ext-active/ /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo" CXXFLAGS="" DISTDIR="/sysbuild/distfiles" FEATURES="assume-digests binpkg-logs buildpkg distlocks ebuild-locks fixlafiles news parallel-fetch protect-owned sandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch" FFLAGS="" GENTOO_MIRRORS="http://distfiles.gentoo.org" LDFLAGS="-Wl,-O1 -Wl,--as-needed" MAKEOPTS="-j5" PKGDIR="/sysbuild/packages" PORTAGE_CONFIGROOT="/" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages" PORTAGE_TMPDIR="/var/tmp" PORTDIR="/usr/portage" PORTDIR_OVERLAY="/sysbuild/overlay" SYNC="rsync://localhost/gentoo-portage" USE="acl amd64 bash-completion berkdb bzip2 cli cracklib crypt cxx dri gdbm iconv ipv6 mmx modules mudflap multilib ncurses nls nptl openmp pam pcre pppd readline session sqlite sse sse2 ssl tcpd unicode zlib" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mmap_emul mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" APACHE2_MPMS="prefork" CALLIGRA_FEATURES="kexi words flow plan sheets stage tables krita karbon braindump" CAMERAS="ptp2" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ubx" INPUT_DEVICES="keyboard mouse evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" PHP_TARGETS="php5-3" PYTHON_TARGETS="python3_2 python2_7" RUBY_TARGETS="ruby18 ruby19" USERLAND="GNU" VIDEO_CARDS="fbdev glint intel mach64 mga neomagic nouveau nv r128 radeon savage sis tdfx trident vesa via vmware dummy v4l" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account" Unset: CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL, LINGUAS, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, USE_PYTHON
(In reply to comment #0) > if [ ! -d "$piddir" ] ; then > mkdir "$piddir" && \ > chown mysql "$piddir" Perhaps a better solution is to replace this block with: checkpath --dir --owner mysql:mysql --mode 0755 "$piddir" Then change error checking as needed.
(In reply to comment #2) > (In reply to comment #0) > > if [ ! -d "$piddir" ] ; then > > mkdir "$piddir" && \ > > chown mysql "$piddir" > > Perhaps a better solution is to replace this block with: > checkpath --dir --owner mysql:mysql --mode 0755 "$piddir" > > Then change error checking as needed. I agree, your suggestion is a lot cleaner. My guess is that the original styling was done prior to the checkpath openrc applet being available. I tend to be very conservative with changes to existing code because I've gotten resistance from people in the past when I've tried to make these kinds of improvements. Again, this one looks like a win to me.
+1 I am hitting this issue, would be awesome if the fix could be commited soonish.
All, checkpath is the correct way to handle this. Thanks, William
I can confirm this behaviour too, and that it's still an issue.
Same behaviour, and now the issue happens every time you reboot your machine, because /run is now by default a tmpfs partition. (and /var/un is a symlink to /run) PS: Maybe change the status to "CONFIRMED", no?
An other suggestion is maybe to put curly brackets around the name of the variable.
Created attachment 335798 [details, diff] Uses checkpath to always set perms and ownership I can confirm this is happening on x86 as well, same version. Here's a very simple patch that works for me.
InCVS
*** Bug 457164 has been marked as a duplicate of this bug. ***
