Skip to content

Commit 5a87f86

Browse files
PDowneyPDowney
committed
MariaDB Fixes
- Fix MariaDB install script to escape password for SQL - Fix MariaDB install script to use socket for root auth
1 parent 030100f commit 5a87f86

3 files changed

Lines changed: 56 additions & 8 deletions

File tree

‎.github/workflows/test-sql-credentials.yml‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
1+
---
12
name: Test SQL Credential Creation
23

3-
on:
4+
"on":
45
push:
56
branches:
67
- main
@@ -9,6 +10,7 @@ on:
910
- 'scripts/functions/shared/enginescript-shared-vhost.sh'
1011
- 'scripts/functions/vhost/vhost-install.sh'
1112
- 'scripts/functions/vhost/vhost-import.sh'
13+
- 'scripts/install/mariadb/mariadb-install.sh'
1214
- 'scripts/ci/test-sql-credentials.sh'
1315
- '.github/workflows/test-sql-credentials.yml'
1416
- 'enginescript-variables.txt'
@@ -18,6 +20,7 @@ on:
1820
- 'scripts/functions/shared/enginescript-shared-vhost.sh'
1921
- 'scripts/functions/vhost/vhost-install.sh'
2022
- 'scripts/functions/vhost/vhost-import.sh'
23+
- 'scripts/install/mariadb/mariadb-install.sh'
2124
- 'scripts/ci/test-sql-credentials.sh'
2225
- '.github/workflows/test-sql-credentials.yml'
2326
- 'enginescript-variables.txt'
@@ -42,10 +45,15 @@ jobs:
4245
- name: Setup MariaDB 11.8 repository
4346
run: |
4447
# Source the MariaDB version from enginescript-variables.txt
45-
MARIADB_VER="$(grep '^MARIADB_VER=' enginescript-variables.txt | cut -d'"' -f2)"
48+
MARIADB_VER="$(
49+
grep '^MARIADB_VER=' enginescript-variables.txt | cut -d'"' -f2
50+
)"
4651
MARIADB_MAJOR_MINOR="$(echo "${MARIADB_VER}" | cut -d'.' -f1,2)"
47-
echo "Installing MariaDB ${MARIADB_MAJOR_MINOR} (full version: ${MARIADB_VER})"
48-
curl -LsS https://r.mariadb.com/downloads/mariadb_repo_setup | sudo bash -s -- --mariadb-server-version="mariadb-${MARIADB_MAJOR_MINOR}"
52+
echo "Installing MariaDB ${MARIADB_MAJOR_MINOR}"
53+
echo "Full MariaDB version: ${MARIADB_VER}"
54+
curl -LsS https://r.mariadb.com/downloads/mariadb_repo_setup \
55+
| sudo bash -s -- \
56+
--mariadb-server-version="mariadb-${MARIADB_MAJOR_MINOR}"
4957
5058
- name: Install MariaDB and dependencies
5159
env:

‎scripts/ci/test-sql-credentials.sh‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -337,6 +337,36 @@ echo ""
337337
echo " vhost import/export archive contract test complete."
338338

339339

340+
#----------------------------------------------------------------------------------
341+
# Test 4: MariaDB install root authentication contract
342+
#----------------------------------------------------------------------------------
343+
echo ""
344+
echo "======================================================="
345+
echo " Test 4: MariaDB install root authentication"
346+
echo "======================================================="
347+
echo ""
348+
349+
MARIADB_INSTALL_SCRIPT="${REPO_ROOT}/scripts/install/mariadb/mariadb-install.sh"
350+
351+
assert_file_contains \
352+
"${MARIADB_INSTALL_SCRIPT}" \
353+
"ALTER USER 'root'@'localhost' IDENTIFIED VIA unix_socket OR mysql_native_password USING PASSWORD" \
354+
"MariaDB install keeps socket auth and enables mysql_native_password"
355+
assert_file_contains \
356+
"${MARIADB_INSTALL_SCRIPT}" \
357+
'mariadb --protocol=socket' \
358+
"MariaDB install uses the local socket for root bootstrap SQL"
359+
360+
if grep -Eq 'ed25519|UPDATE mysql\.global_priv SET priv=.*root' "${MARIADB_INSTALL_SCRIPT}"; then
361+
fail "MariaDB install still contains unsupported ed25519 root auth or direct root global_priv rewrites"
362+
else
363+
pass "MariaDB install avoids unsupported ed25519 root auth and direct root global_priv rewrites"
364+
fi
365+
366+
echo ""
367+
echo " MariaDB install root authentication test complete."
368+
369+
340370
#----------------------------------------------------------------------------------
341371
# Summary
342372
#----------------------------------------------------------------------------------

‎scripts/install/mariadb/mariadb-install.sh‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,13 @@ if [[ "${MARIADB}" = 1 ]]; then
2424
exit 0
2525
fi
2626

27+
escape_mariadb_sql_string_literal() {
28+
local input="$1"
29+
input="${input//\\/\\\\}"
30+
input="${input//\'/\'\'}"
31+
printf '%s' "$input"
32+
}
33+
2734
# Add MariaDB repository
2835
curl -LsS https://downloads.mariadb.com/MariaDB/mariadb_repo_setup | sudo bash -s -- --mariadb-server-version="${MARIADB_VER}" --skip-maxscale 2>> /tmp/enginescript_install_errors.log
2936
print_last_errors
@@ -51,12 +58,14 @@ debug_pause "System Update and Cleanup"
5158
sudo debconf-set-selections <<< "mysql-server mysql-server/root_password password ${MARIADB_ADMIN_PASSWORD}" # new password for the MySQL root user
5259
sudo debconf-set-selections <<< "mysql-server mysql-server/root_password_again password ${MARIADB_ADMIN_PASSWORD}" # repeat password for the MySQL root user
5360

54-
# Remote Connection to Database - use unix_socket for local root and ed25519 for password-based auth
55-
sudo mariadb -e "ALTER USER root@localhost IDENTIFIED VIA unix_socket OR ed25519 USING PASSWORD('${MARIADB_ADMIN_PASSWORD}');"
61+
# Keep local sudo/socket automation working while enabling the configured root password.
62+
SQL_ESCAPED_MARIADB_ADMIN_PASSWORD="$(escape_mariadb_sql_string_literal "${MARIADB_ADMIN_PASSWORD}")"
63+
sudo mariadb --protocol=socket << EOFMYSQLROOTAUTH
64+
ALTER USER 'root'@'localhost' IDENTIFIED VIA unix_socket OR mysql_native_password USING PASSWORD('${SQL_ESCAPED_MARIADB_ADMIN_PASSWORD}');
65+
EOFMYSQLROOTAUTH
5666

5767
# Manually Perform Secure Installation
58-
sudo mariadb -e "UPDATE mysql.global_priv SET priv=json_set(priv, '$.plugin', 'mysql_native_password', '$.authentication_string', PASSWORD('$MARIADB_ADMIN_PASSWORD')) WHERE User='root'";
59-
sudo mariadb << EOFMYSQLSECURE
68+
sudo mariadb --protocol=socket << EOFMYSQLSECURE
6069
DELETE FROM mysql.global_priv WHERE User='';
6170
DELETE FROM mysql.global_priv WHERE User='root' AND Host NOT IN ('localhost', '127.0.0.1', '::1');
6271
DROP DATABASE IF EXISTS test;
@@ -113,3 +122,4 @@ print_install_banner "MariaDB" 2
113122

114123
# Mark the installation as complete
115124
echo "MARIADB=1" >> /etc/enginescript/install-state.conf
125+
echo "MariaDB completed successfully. Script done."

0 commit comments

Comments
 (0)