mariadb: use /bin/false as the login shell and add perl to RDEPENDS

PATCH In review Chong Lu 3 participants 9 messages Apr 14, 2014 – Apr 20, 2014

lore

Share & tools

lore

Chong Lu

author

2014-04-14 07:16 UTC #0 lore raw

cover mariadb: use /bin/false as the login shell and add perl to RDEPENDS

The following changes since commit 477ccd867cc71f8277f2670b7be34b3b15300052:

klibc: restylize a bit the recipes (2014-04-06 13:36:20 +0100)

are available in the git repository at:

git://git.pokylinux.org/poky-contrib chonglu/mariadb
http://git.pokylinux.org/cgit.cgi/poky-contrib/log/?h=chonglu/mariadb

Chong Lu (2):
mariadb: use /bin/false as the login shell
mariadb: add perl to RDEPENDS

 meta-oe/recipes-support/mysql/mariadb_5.1.67.inc | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

Signature · 1 line

1.8.1.2

Chong Lu

author

2014-04-14 07:16 UTC #1 lore raw

PATCH 1/2 mariadb: use /bin/false as the login shell

Use /bin/false as the login shell, just like what Ubuntu does, otherwise there might be secure issue.

Signed-off-by Robert Yang <[email protected]>

Signed-off-by Chong Lu <[email protected]>

---
 meta-oe/recipes-support/mysql/mariadb_5.1.67.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

meta-oe/recipes-support/mysql/mariadb_5.1.67.inc +1 -1

index 100b3a7..37a0f0c 100644
@@ -35,7 +35,7 @@ INITSCRIPT_NAME = "mysqld"
 INITSCRIPT_PARAMS = "start 45 5 . stop 45 0 6 1 ."
 
 USERADD_PACKAGES = "${PN}-server"
-USERADD_PARAM_${PN}-server = "--system --home-dir /var/mysql -g nogroup mysql"
+USERADD_PARAM_${PN}-server = "--system --home-dir /var/mysql -g nogroup --shell /bin/false mysql"
 
 
 export ac_cv_path_PS="/bin/ps"

Signature · 1 line

1.8.1.2

Martin Jansa

2014-04-20 09:28 UTC #2 lore raw

Re: [PATCH 1/2] mariadb: use /bin/false as the login shell

Quoted 2 lines · Chong Lu

Use /bin/false as the login shell, just like what Ubuntu does, otherwise there might be secure issue.

1/2 Merged, thanks

2/2 has question from koen, which needs to be resolved first

Quoted 28 lines

Signed-off-by Robert Yang <[email protected]>

Signed-off-by Chong Lu <[email protected]>

---
 meta-oe/recipes-support/mysql/mariadb_5.1.67.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

meta-oe/recipes-support/mysql/mariadb_5.1.67.inc +1 -1

index 100b3a7..37a0f0c 100644
@@ -35,7 +35,7 @@ INITSCRIPT_NAME = "mysqld"
 INITSCRIPT_PARAMS = "start 45 5 . stop 45 0 6 1 ."
 
 USERADD_PACKAGES = "${PN}-server"
-USERADD_PARAM_${PN}-server = "--system --home-dir /var/mysql -g nogroup mysql"
+USERADD_PARAM_${PN}-server = "--system --home-dir /var/mysql -g nogroup --shell /bin/false mysql"
 
 
 export ac_cv_path_PS="/bin/ps"

Signature · 7 lines

1.8.1.2

-- 
_______________________________________________
Openembedded-devel mailing list
[email protected]
http://lists.openembedded.org/mailman/listinfo/openembedded-devel

Signature · 1 line

Martin 'JaMa' Jansa     jabber: [email protected]

Chong Lu

author

2014-04-14 07:16 UTC #3 lore raw

PATCH 2/2 mariadb: add perl to RDEPENDS

In reply to Chong Lu

Perl doesn't be installed in small image, but mariadb-server, mariadb-client and mariadb-leftovers need it in runtime, so we add perl to RDEPENDS.

Signed-off-by Hongxu Jia <[email protected]>

Signed-off-by Chong Lu <[email protected]>

---
 meta-oe/recipes-support/mysql/mariadb_5.1.67.inc | 4 ++++
 1 file changed, 4 insertions(+)

meta-oe/recipes-support/mysql/mariadb_5.1.67.inc +4 -0

index 37a0f0c..e474b3c 100644
@@ -116,6 +116,10 @@ FILES_${PN} = " "
 RDEPENDS_${PN} = "${PN}-client ${PN}-server"
 ALLOW_EMPTY_${PN} = "1"
 
+RDEPENDS_${PN}-client = "perl"
+RDEPENDS_${PN}-server = "perl"
+RDEPENDS_${PN}-leftovers = "perl"
+
 FILES_libmysqlclient = "\
     ${libdir}/libmysqlclient.so.* \
     ${libdir}/plugin/*.so.*"

Signature · 1 line

1.8.1.2

Koen Kooi

2014-04-14 07:43 UTC #4 lore raw

Re: [PATCH 2/2] mariadb: add perl to RDEPENDS

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Chong Lu schreef op 14-04-14 09:16:

Quoted 3 lines

Perl doesn't be installed in small image, but mariadb-server, mariadb-client and mariadb-leftovers need it in runtime, so we add perl to RDEPENDS.

It doesn't need any perl modules to work?

Quoted 15 lines

Signed-off-by Hongxu Jia <[email protected]> Signed-off-by: Chong
Lu <[email protected]> --- meta-oe/recipes-support/mysql/mariadb_5.1.67.inc | 4 ++++ 1 file changed, 4 insertions(+)
(quoted diff) +0 -0
b/meta-oe/recipes-support/mysql/mariadb_5.1.67.inc index 37a0f0c..e474b3c 100644 --- a/meta-oe/recipes-support/mysql/mariadb_5.1.67.inc +++ b/meta-oe/recipes-support/mysql/mariadb_5.1.67.inc @@ -116,6 +116,10 @@ FILES_${PN} = " " RDEPENDS_${PN} = "${PN}-client ${PN}-server" ALLOW_EMPTY_${PN} = "1"
(quoted diff) +2 -0
+RDEPENDS_${PN}-client = "perl" +RDEPENDS_${PN}-server = "perl" 
+RDEPENDS_${PN}-leftovers = "perl" + FILES_libmysqlclient = "\ 

Quoted 2 lines

${libdir}/libmysqlclient.so.* \ ${libdir}/plugin/*.so.*"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Darwin)
Comment: GPGTools - http://gpgtools.org

iD8DBQFTS5GcMkyGM64RGpERAoYVAJ4+8cnpKMHIC7YqhO/N4QZPMAX3DACfaheN oB0KZz+3h0heDx7RJ5gdiT8=
=ttpI
-----END PGP SIGNATURE-----

Chong Lu

author

2014-04-14 08:06 UTC #5 lore raw

Re: [PATCH 2/2] mariadb: add perl to RDEPENDS

Quoted 8 lines · Koen Kooi

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Chong Lu schreef op 14-04-14 09:16:
Quoted 3 lines
Perl doesn't be installed in small image, but mariadb-server, mariadb-client and mariadb-leftovers need it in runtime, so we add perl to RDEPENDS.
It doesn't need any perl modules to work?

mariadb-server, mariadb-client and mariadb-leftovers need /usr/bin/perl

rpm -qp -R mariadb-server-5.1.67-r0.core2_64.rpm
warning: mariadb-server-5.1.67-r0.core2_64.rpm: Header V4 DSA/SHA1 Signature, key ID f6cf289c: NOKEY /usr/bin/perl
...

BR
Chong

Quoted 26 lines

Quoted 15 lines
Signed-off-by Hongxu Jia <[email protected]> Signed-off-by: Chong
Lu <[email protected]> --- meta-oe/recipes-support/mysql/mariadb_5.1.67.inc | 4 ++++ 1 file changed, 4 insertions(+)
(quoted diff) +0 -0
b/meta-oe/recipes-support/mysql/mariadb_5.1.67.inc index 37a0f0c..e474b3c 100644 --- a/meta-oe/recipes-support/mysql/mariadb_5.1.67.inc +++ b/meta-oe/recipes-support/mysql/mariadb_5.1.67.inc @@ -116,6 +116,10 @@ FILES_${PN} = " " RDEPENDS_${PN} = "${PN}-client ${PN}-server" ALLOW_EMPTY_${PN} = "1"
(quoted diff) +2 -0
+RDEPENDS_${PN}-client = "perl" +RDEPENDS_${PN}-server = "perl"
+RDEPENDS_${PN}-leftovers = "perl" + FILES_libmysqlclient = "\
Quoted 2 lines
${libdir}/libmysqlclient.so.* \ ${libdir}/plugin/*.so.*"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Darwin)
Comment: GPGTools - http://gpgtools.org
iD8DBQFTS5GcMkyGM64RGpERAoYVAJ4+8cnpKMHIC7YqhO/N4QZPMAX3DACfaheN oB0KZz+3h0heDx7RJ5gdiT8=
=ttpI
-----END PGP SIGNATURE-----

Koen Kooi

2014-04-14 08:35 UTC #6 lore raw

Re: [PATCH 2/2] mariadb: add perl to RDEPENDS

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Chong Lu schreef op 14-04-14 10:06:

Quoted 14 lines

On 04/14/2014 03:43 PM, Koen Kooi wrote: Chong Lu schreef op 14-04-14 09:16:
Quoted 3 lines
Quoted 3 lines
Quoted 3 lines
Perl doesn't be installed in small image, but mariadb-server, mariadb-client and mariadb-leftovers need it in runtime, so we add perl to RDEPENDS.
It doesn't need any perl modules to work?
Quoted 6 lines
mariadb-server, mariadb-client and mariadb-leftovers need /usr/bin/perl
rpm -qp -R mariadb-server-5.1.67-r0.core2_64.rpm warning:
mariadb-server-5.1.67-r0.core2_64.rpm: Header V4 DSA/SHA1 Signature, key ID f6cf289c: NOKEY /usr/bin/perl ...

I get that it needs /usr/bin/perl, but you didn't answer my question:

It doesn't need any perl modules to work?

Does it actually work with only 'perl' installed and not any of the 'perl-module-' packages?

Quoted 17 lines

Quoted 17 lines
BR Chong
Quoted 13 lines
Quoted 13 lines
Signed-off-by Hongxu Jia <[email protected]> Signed-off-by:
Chong Lu <[email protected]> --- meta-oe/recipes-support/mysql/mariadb_5.1.67.inc | 4 ++++ 1 file changed, 4 insertions(+)
(quoted diff) +0 -0
b/meta-oe/recipes-support/mysql/mariadb_5.1.67.inc index 37a0f0c..e474b3c 100644 --- a/meta-oe/recipes-support/mysql/mariadb_5.1.67.inc +++ b/meta-oe/recipes-support/mysql/mariadb_5.1.67.inc @@ -116,6 +116,10 @@ FILES_${PN} = " " RDEPENDS_${PN} = "${PN}-client ${PN}-server" ALLOW_EMPTY_${PN} = "1"

Quoted 6 lines

Quoted 5 lines
Quoted 4 lines
Quoted 4 lines
(quoted diff) +2 -0
+RDEPENDS_${PN}-client = "perl" +RDEPENDS_${PN}-server = "perl" 
+RDEPENDS_${PN}-leftovers = "perl" + FILES_libmysqlclient = "\ 
${libdir}/libmysqlclient.so.* \ ${libdir}/plugin/*.so.*"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Darwin)
Comment: GPGTools - http://gpgtools.org

iD8DBQFTS53MMkyGM64RGpERAmN9AJwNYnxwYPqCjlVl01kMy0D3EsU5LgCdEtrJ mC/STuju9Eo9yAW3XDxsNpI=
=esUj
-----END PGP SIGNATURE-----

Chong Lu

author

2014-04-14 08:56 UTC #7 lore raw

Re: [PATCH 2/2] mariadb: add perl to RDEPENDS

Quoted 16 lines · Koen Kooi

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Chong Lu schreef op 14-04-14 10:06:
Quoted 12 lines
On 04/14/2014 03:43 PM, Koen Kooi wrote: Chong Lu schreef op 14-04-14 09:16:
Quoted 3 lines
Quoted 3 lines
Quoted 3 lines
Perl doesn't be installed in small image, but mariadb-server, mariadb-client and mariadb-leftovers need it in runtime, so we add perl to RDEPENDS.
It doesn't need any perl modules to work?
Quoted 5 lines
mariadb-server, mariadb-client and mariadb-leftovers need /usr/bin/perl
rpm -qp -R mariadb-server-5.1.67-r0.core2_64.rpm warning:
mariadb-server-5.1.67-r0.core2_64.rpm: Header V4 DSA/SHA1 Signature, key ID f6cf289c: NOKEY /usr/bin/perl ...

Quoted 8 lines

I get that it needs /usr/bin/perl, but you didn't answer my question:
It doesn't need any perl modules to work?
Does it actually work with only 'perl' installed and not any of the 'perl-module-' packages?

I don't find more dependencies about perl module. I make a image and start mariadb. It works well.

Quoted 28 lines

Quoted 15 lines
Quoted 15 lines
BR Chong
Quoted 13 lines
Quoted 13 lines
Signed-off-by Hongxu Jia <[email protected]> Signed-off-by:
Chong Lu <[email protected]> --- meta-oe/recipes-support/mysql/mariadb_5.1.67.inc | 4 ++++ 1 file changed, 4 insertions(+)
(quoted diff) +0 -0
b/meta-oe/recipes-support/mysql/mariadb_5.1.67.inc index 37a0f0c..e474b3c 100644 --- a/meta-oe/recipes-support/mysql/mariadb_5.1.67.inc +++ b/meta-oe/recipes-support/mysql/mariadb_5.1.67.inc @@ -116,6 +116,10 @@ FILES_${PN} = " " RDEPENDS_${PN} = "${PN}-client ${PN}-server" ALLOW_EMPTY_${PN} = "1"
Quoted 4 lines
Quoted 4 lines
Quoted 4 lines
Quoted 4 lines
(quoted diff) +2 -0
+RDEPENDS_${PN}-client = "perl" +RDEPENDS_${PN}-server = "perl"
+RDEPENDS_${PN}-leftovers = "perl" + FILES_libmysqlclient = "\
${libdir}/libmysqlclient.so.* \ ${libdir}/plugin/*.so.*"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Darwin)
Comment: GPGTools - http://gpgtools.org
iD8DBQFTS53MMkyGM64RGpERAmN9AJwNYnxwYPqCjlVl01kMy0D3EsU5LgCdEtrJ mC/STuju9Eo9yAW3XDxsNpI=
=esUj
-----END PGP SIGNATURE-----

Koen Kooi

2014-04-14 09:06 UTC #8 lore raw

Re: [PATCH 2/2] mariadb: add perl to RDEPENDS

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Chong Lu schreef op 14-04-14 10:56:

Quoted 14 lines

On 04/14/2014 04:35 PM, Koen Kooi wrote: Chong Lu schreef op 14-04-14 10:06:
Quoted 11 lines
Quoted 11 lines
Quoted 11 lines
On 04/14/2014 03:43 PM, Koen Kooi wrote: Chong Lu schreef op 14-04-14 09:16:
Quoted 3 lines
Quoted 3 lines
Quoted 3 lines
Perl doesn't be installed in small image, but mariadb-server, mariadb-client and mariadb-leftovers need it in runtime, so we add perl to RDEPENDS.
It doesn't need any perl modules to work?
Quoted 4 lines
mariadb-server, mariadb-client and mariadb-leftovers need /usr/bin/perl rpm -qp -R mariadb-server-5.1.67-r0.core2_64.rpm
warning: mariadb-server-5.1.67-r0.core2_64.rpm: Header V4 DSA/SHA1 Signature, key ID f6cf289c: NOKEY /usr/bin/perl ...

Quoted 10 lines

I get that it needs /usr/bin/perl, but you didn't answer my question:
It doesn't need any perl modules to work?
Does it actually work with only 'perl' installed and not any of the 'perl-module-' packages?
Quoted 2 lines
I don't find more dependencies about perl module. I make a image and start mariadb. It works well.

Can you describe the difference before and after this patch for the runtime behaviour? I get the impression that you only silenced output from RPM and didn't do any real testing or try to understand the problem -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Darwin)
Comment: GPGTools - http://gpgtools.org

iD8DBQFTS6UgMkyGM64RGpERApbOAJ4teUaJa3Owih3cPogWpBuyrJ8V6QCfePw8 G+rAP5C6+rkmP8Nw+loS+CM=
=gMxa
-----END PGP SIGNATURE-----