summaryrefslogtreecommitdiff
path: root/include
diff options
context:
space:
mode:
authorJon Olav Hauglid <jon.hauglid@oracle.com>2016-08-16 15:35:19 +0200
committerJon Olav Hauglid <jon.hauglid@oracle.com>2016-08-19 09:09:07 +0200
commit033b11912121ad2c1dbd4a93202eeac196124801 (patch)
tree7027148b568b465c2a2ed0a93461663d8f931c3e /include
parent8b1f4d84cafe393e92f942278f9f020a62ceb5b9 (diff)
downloadmariadb-git-033b11912121ad2c1dbd4a93202eeac196124801.tar.gz
Bug#24388746: PRIVILEGE ESCALATION AND RACE CONDITION USING CREATE TABLE
During REPAIR TABLE of a MyISAM table, a temporary data file (.TMD) is created. When repair finishes, this file is renamed to the original .MYD file. The problem was that during this rename, we copied the stats from the old file to the new file with chmod/chown. If a user managed to replace the temporary file before chmod/chown was executed, it was possible to get an arbitrary file with the privileges of the mysql user. This patch fixes the problem by not copying stats from the old file to the new file. This is not needed as the new file was created with the correct stats. This fix only changes server behavior - external utilities such as myisamchk still does chmod/chown. No test case provided since the problem involves synchronization with file system operations.
Diffstat (limited to 'include')
-rw-r--r--include/my_sys.h3
-rw-r--r--include/myisam.h11
2 files changed, 8 insertions, 6 deletions
diff --git a/include/my_sys.h b/include/my_sys.h
index b1b8bf15be3..472c2ba5ca0 100644
--- a/include/my_sys.h
+++ b/include/my_sys.h
@@ -1,4 +1,4 @@
-/* Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.
+/* Copyright (c) 2000, 2016, Oracle and/or its affiliates. All rights reserved.
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
@@ -83,6 +83,7 @@ typedef struct my_aio_result {
#define MY_RESOLVE_LINK 128 /* my_realpath(); Only resolve links */
#define MY_HOLD_ORIGINAL_MODES 128 /* my_copy() holds to file modes */
#define MY_REDEL_MAKE_BACKUP 256
+#define MY_REDEL_NO_COPY_STAT 512 /* my_redel() doesn't call my_copystat() */
#define MY_SEEK_NOT_DONE 32 /* my_lock may have to do a seek */
#define MY_DONT_WAIT 64 /* my_lock() don't wait if can't lock */
#define MY_ZEROFILL 32 /* my_malloc(), fill array with zero */
diff --git a/include/myisam.h b/include/myisam.h
index 85d37a81bc6..a9fcd7e4369 100644
--- a/include/myisam.h
+++ b/include/myisam.h
@@ -1,5 +1,5 @@
/*
- Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.
+ Copyright (c) 2000, 2016, Oracle and/or its affiliates. All rights reserved.
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
@@ -426,12 +426,13 @@ int chk_size(MI_CHECK *param, MI_INFO *info);
int chk_key(MI_CHECK *param, MI_INFO *info);
int chk_data_link(MI_CHECK *param, MI_INFO *info,int extend);
int mi_repair(MI_CHECK *param, register MI_INFO *info,
- char * name, int rep_quick);
-int mi_sort_index(MI_CHECK *param, register MI_INFO *info, char * name);
+ char * name, int rep_quick, my_bool no_copy_stat);
+int mi_sort_index(MI_CHECK *param, register MI_INFO *info, char * name,
+ my_bool no_copy_stat);
int mi_repair_by_sort(MI_CHECK *param, register MI_INFO *info,
- const char * name, int rep_quick);
+ const char * name, int rep_quick, my_bool no_copy_stat);
int mi_repair_parallel(MI_CHECK *param, register MI_INFO *info,
- const char * name, int rep_quick);
+ const char * name, int rep_quick, my_bool no_copy_stat);
int change_to_newfile(const char * filename, const char * old_ext,
const char * new_ext, myf myflags);
int lock_file(MI_CHECK *param, File file, my_off_t start, int lock_type,