Skip to content

Prevent root password from being accessible by normal users on first run #53

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 8 commits into from
Jun 3, 2015
Merged

Prevent root password from being accessible by normal users on first run #53

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
b5ca4c2
Fixed security issue
ltangvald Mar 4, 2015
6e9444e
Tell mysql_install_db where mysqld is located
ltangvald Mar 5, 2015
8e2518a
Changed some paths to reflect how 5.5 is set up differently
ltangvald Mar 5, 2015
355b0d2
Ensure correct ownership of an existing datadir
ltangvald Mar 6, 2015
3e88d68
* Fix whitespace inconsistencies
ltangvald Mar 16, 2015
b141456
Fix variable quoting inconsistencies
ltangvald Apr 7, 2015
ae647b4
Various fixes.
ltangvald Apr 14, 2015
0fd8c68
Removed workaround that isn't needed on current Debian image
ltangvald Jun 3, 2015
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
73 changes: 56 additions & 17 deletions 5.5/docker-entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,31 +1,57 @@
#!/bin/bash
set -e

get_option () {
local section=$1
local option=$2
local default=$3
ret=$(my_print_defaults $section | grep '^--'${option}'=' | cut -d= -f2-)
[ -z $ret ] && ret=$default
echo $ret
}

# if command starts with an option, prepend mysqld
if [ "${1:0:1}" = '-' ]; then
set -- mysqld "$@"
fi

if [ "$1" = 'mysqld' ]; then
# read DATADIR from the MySQL config
# Get config
DATADIR="$("$@" --verbose --help 2>/dev/null | awk '$1 == "datadir" { print $2; exit }')"

SOCKET=$(get_option mysqld socket "/tmp/mysql.sock")
HOSTNAME=$(hostname)
PIDFILE=$(get_option mysqld pid-file "$DATADIR/mysqld.pid")

if [ ! -d "$DATADIR/mysql" ]; then
if [ -z "$MYSQL_ROOT_PASSWORD" -a -z "$MYSQL_ALLOW_EMPTY_PASSWORD" ]; then
echo >&2 'error: database is uninitialized and MYSQL_ROOT_PASSWORD not set'
echo >&2 ' Did you forget to add -e MYSQL_ROOT_PASSWORD=... ?'
exit 1
fi

echo 'Running mysql_install_db ...'
mysql_install_db --datadir="$DATADIR" --basedir=/usr/local/mysql

mkdir -p "$DATADIR"
chown -R mysql:mysql "$DATADIR"

echo 'Running mysql_install_db'
mysql_install_db --user=mysql --datadir="$DATADIR" --rpm --basedir=/usr/local/mysql
echo 'Finished mysql_install_db'


mysqld --user=mysql --datadir="$DATADIR" --skip-networking --basedir=/usr/local/mysql --pid-file="$PIDFILE" &
for i in $(seq 30 -1 0); do
[ -S "$SOCKET" ] && break
echo 'MySQL init process in progress...'
sleep 1
done
if [ $i = 0 ]; then
echo >&2 'MySQL init process failed.'
exit 1
fi

# These statements _must_ be on individual lines, and _must_ end with
# semicolons (no line breaks or comments are permitted).
# TODO proper SQL escaping on ALL the things D:
tempSqlFile='/tmp/mysql-first-time.sql'

tempSqlFile=$(mktemp /tmp/mysql-first-time.XXXXXX.sql)
cat > "$tempSqlFile" <<-EOSQL
-- What's done in this file shouldn't be replicated
-- or products like mysql-fabric won't work
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Permissions are now only set during initialization. Would this be a problem when using an already initialized data-dir (e.g. bind-mounted)?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, it almost certainly will. The line should have been copied instead of moved. Thanks :)

Expand All @@ -36,24 +62,37 @@ if [ "$1" = 'mysqld' ]; then
GRANT ALL ON *.* TO 'root'@'%' WITH GRANT OPTION ;
DROP DATABASE IF EXISTS test ;
EOSQL

if [ "$MYSQL_DATABASE" ]; then
echo "CREATE DATABASE IF NOT EXISTS \`$MYSQL_DATABASE\` ;" >> "$tempSqlFile"
fi

if [ "$MYSQL_USER" -a "$MYSQL_PASSWORD" ]; then
echo "CREATE USER '$MYSQL_USER'@'%' IDENTIFIED BY '$MYSQL_PASSWORD' ;" >> "$tempSqlFile"
echo "CREATE USER '"$MYSQL_USER"'@'%' IDENTIFIED BY '"$MYSQL_PASSWORD"' ;" >> "$tempSqlFile"

if [ "$MYSQL_DATABASE" ]; then
echo "GRANT ALL ON \`$MYSQL_DATABASE\`.* TO '$MYSQL_USER'@'%' ;" >> "$tempSqlFile"
echo "GRANT ALL ON \`"$MYSQL_DATABASE"\`.* TO '"$MYSQL_USER"'@'%' ;" >> "$tempSqlFile"
fi
fi

echo 'FLUSH PRIVILEGES ;' >> "$tempSqlFile"

set -- "$@" --init-file="$tempSqlFile"

mysql -uroot < "$tempSqlFile"

rm -f "$tempSqlFile"
kill $(cat $PIDFILE)
for i in $(seq 30 -1 0); do
[ -f "$PIDFILE" ] || break
echo 'MySQL init process in progress...'
sleep 1
done
if [ $i = 0 ]; then
echo >&2 'MySQL hangs during init process.'
exit 1
fi
echo 'MySQL init process done. Ready for start up.'
fi

chown -R mysql:mysql "$DATADIR"
fi

Expand Down
72 changes: 55 additions & 17 deletions 5.6/docker-entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,31 +1,56 @@
#!/bin/bash
set -e

get_option () {
local section=$1
local option=$2
local default=$3
ret=$(my_print_defaults $section | grep '^--'${option}'=' | cut -d= -f2-)
[ -z $ret ] && ret=$default
echo $ret
}

# if command starts with an option, prepend mysqld
if [ "${1:0:1}" = '-' ]; then
set -- mysqld "$@"
fi

if [ "$1" = 'mysqld' ]; then
# read DATADIR from the MySQL config
# Get config
DATADIR="$("$@" --verbose --help 2>/dev/null | awk '$1 == "datadir" { print $2; exit }')"

SOCKET=$(get_option mysqld socket "$DATADIR/mysql.sock")
PIDFILE=$(get_option mysqld pid-file "/var/run/mysqld/mysqld.pid")

if [ ! -d "$DATADIR/mysql" ]; then
if [ -z "$MYSQL_ROOT_PASSWORD" -a -z "$MYSQL_ALLOW_EMPTY_PASSWORD" ]; then
echo >&2 'error: database is uninitialized and MYSQL_ROOT_PASSWORD not set'
echo >&2 ' Did you forget to add -e MYSQL_ROOT_PASSWORD=... ?'
exit 1
fi

echo 'Running mysql_install_db ...'
mysql_install_db --datadir="$DATADIR"

mkdir -p "$DATADIR"
chown -R mysql:mysql "$DATADIR"

echo 'Running mysql_install_db'
mysql_install_db --user=mysql --datadir="$DATADIR" --rpm --keep-my-cnf
echo 'Finished mysql_install_db'


mysqld --user=mysql --datadir="$DATADIR" --skip-networking &
for i in $(seq 30 -1 0); do
[ -S "$SOCKET" ] && break
echo 'MySQL init process in progress...'
sleep 1
done
if [ $i = 0 ]; then
echo >&2 'MySQL init process failed.'
exit 1
fi

# These statements _must_ be on individual lines, and _must_ end with
# semicolons (no line breaks or comments are permitted).
# TODO proper SQL escaping on ALL the things D:
tempSqlFile='/tmp/mysql-first-time.sql'

tempSqlFile=$(mktemp /tmp/mysql-first-time.XXXXXX.sql)
cat > "$tempSqlFile" <<-EOSQL
-- What's done in this file shouldn't be replicated
-- or products like mysql-fabric won't work
Expand All @@ -36,24 +61,37 @@ if [ "$1" = 'mysqld' ]; then
GRANT ALL ON *.* TO 'root'@'%' WITH GRANT OPTION ;
DROP DATABASE IF EXISTS test ;
EOSQL

if [ "$MYSQL_DATABASE" ]; then
echo "CREATE DATABASE IF NOT EXISTS \`$MYSQL_DATABASE\` ;" >> "$tempSqlFile"
fi

if [ "$MYSQL_USER" -a "$MYSQL_PASSWORD" ]; then
echo "CREATE USER '$MYSQL_USER'@'%' IDENTIFIED BY '$MYSQL_PASSWORD' ;" >> "$tempSqlFile"
echo "CREATE USER '"$MYSQL_USER"'@'%' IDENTIFIED BY '"$MYSQL_PASSWORD"' ;" >> "$tempSqlFile"

if [ "$MYSQL_DATABASE" ]; then
echo "GRANT ALL ON \`$MYSQL_DATABASE\`.* TO '$MYSQL_USER'@'%' ;" >> "$tempSqlFile"
echo "GRANT ALL ON \`"$MYSQL_DATABASE"\`.* TO '"$MYSQL_USER"'@'%' ;" >> "$tempSqlFile"
fi
fi

echo 'FLUSH PRIVILEGES ;' >> "$tempSqlFile"

set -- "$@" --init-file="$tempSqlFile"

mysql -uroot < "$tempSqlFile"

rm -f "$tempSqlFile"
kill $(cat $PIDFILE)
for i in $(seq 30 -1 0); do
[ -f "$PIDFILE" ] || break
echo 'MySQL init process in progress...'
sleep 1
done
if [ $i = 0 ]; then
echo >&2 'MySQL hangs during init process.'
exit 1
fi
echo 'MySQL init process done. Ready for start up.'
fi

chown -R mysql:mysql "$DATADIR"
fi

Expand Down
68 changes: 53 additions & 15 deletions 5.7/docker-entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,31 +1,56 @@
#!/bin/bash
set -e

get_option () {
local section=$1
local option=$2
local default=$3
ret=$(my_print_defaults $section | grep '^--'${option}'=' | cut -d= -f2-)
[ -z $ret ] && ret=$default
echo $ret
}

# if command starts with an option, prepend mysqld
if [ "${1:0:1}" = '-' ]; then
set -- mysqld "$@"
fi

if [ "$1" = 'mysqld' ]; then
# read DATADIR from the MySQL config
# Get config
DATADIR="$("$@" --verbose --help 2>/dev/null | awk '$1 == "datadir" { print $2; exit }')"

SOCKET=$(get_option mysqld socket "$DATADIR/mysql.sock")
PIDFILE=$(get_option mysqld pid-file "/var/run/mysqld/mysqld.pid")

if [ ! -d "$DATADIR/mysql" ]; then
if [ -z "$MYSQL_ROOT_PASSWORD" -a -z "$MYSQL_ALLOW_EMPTY_PASSWORD" ]; then
echo >&2 'error: database is uninitialized and MYSQL_ROOT_PASSWORD not set'
echo >&2 ' Did you forget to add -e MYSQL_ROOT_PASSWORD=... ?'
exit 1
fi


mkdir -p "$DATADIR"
chown -R mysql:mysql "$DATADIR"

echo 'Initializing database'
mysqld --initialize-insecure=on --datadir="$DATADIR"
echo 'Database initialized'


mysqld --user=mysql --datadir="$DATADIR" --skip-networking &
for i in $(seq 30 -1 0); do
[ -S $SOCKET ] && break
echo 'MySQL init process in progress...'
sleep 1
done
if [ $i = 0 ]; then
echo >&2 'MySQL init process failed.'
exit 1
fi

# These statements _must_ be on individual lines, and _must_ end with
# semicolons (no line breaks or comments are permitted).
# TODO proper SQL escaping on ALL the things D:
tempSqlFile='/tmp/mysql-first-time.sql'

tempSqlFile=$(mktemp /tmp/mysql-first-time.XXXXXX.sql)
cat > "$tempSqlFile" <<-EOSQL
-- What's done in this file shouldn't be replicated
-- or products like mysql-fabric won't work
Expand All @@ -36,25 +61,38 @@ if [ "$1" = 'mysqld' ]; then
GRANT ALL ON *.* TO 'root'@'%' WITH GRANT OPTION ;
DROP DATABASE IF EXISTS test ;
EOSQL

if [ "$MYSQL_DATABASE" ]; then
echo "CREATE DATABASE IF NOT EXISTS \`$MYSQL_DATABASE\` ;" >> "$tempSqlFile"
fi

if [ "$MYSQL_USER" -a "$MYSQL_PASSWORD" ]; then
echo "CREATE USER '$MYSQL_USER'@'%' IDENTIFIED BY '$MYSQL_PASSWORD' ;" >> "$tempSqlFile"
echo "CREATE USER '"$MYSQL_USER"'@'%' IDENTIFIED BY '"$MYSQL_PASSWORD"' ;" >> "$tempSqlFile"

if [ "$MYSQL_DATABASE" ]; then
echo "GRANT ALL ON \`$MYSQL_DATABASE\`.* TO '$MYSQL_USER'@'%' ;" >> "$tempSqlFile"
echo "GRANT ALL ON \`"$MYSQL_DATABASE"\`.* TO '"$MYSQL_USER"'@'%' ;" >> "$tempSqlFile"
fi
fi

echo 'FLUSH PRIVILEGES ;' >> "$tempSqlFile"

set -- "$@" --init-file="$tempSqlFile"

mysql -uroot < "$tempSqlFile"
rm -f "$tempSqlFile"
kill $(cat $PIDFILE)
for i in $(seq 30 -1 0); do
[ -f "$PIDFILE" ] || break
echo 'MySQL init process in progress...'
sleep 1
done
if [ $i = 0 ]; then
echo >&2 'MySQL hangs during init process.'
exit 1
fi
echo 'MySQL init process done. Ready for start up.'
fi

chown -R mysql:mysql "$DATADIR"
fi

exec "$@"