From 074b672b5d94d291afce5f6541f39d68c65caa62 Mon Sep 17 00:00:00 2001
From: Vladislav Vaintroub <wlad@mariadb.com>
Date: Mon, 13 Aug 2018 19:43:59 +0100
Subject: MDEV-16963 Tighten named pipe access control
Use real DACL instead of NULL DACL.
Grant Everyone just read/write access to pipe
(instead of all access like previously with NULL ACL)
---
sql/mysqld.cc | 22 +++++++++++-----------
1 file changed, 11 insertions(+), 11 deletions(-)
(limited to 'sql/mysqld.cc')
diff --git a/sql/mysqld.cc b/sql/mysqld.cc
index 5a9aba7f2e4..aa749e5aaef 100644
--- a/sql/mysqld.cc
+++ b/sql/mysqld.cc
@@ -1195,9 +1195,9 @@ static NTService Service; ///< Service object for WinNT
#endif /* __WIN__ */
#ifdef _WIN32
+#include <sddl.h> /* ConvertStringSecurityDescriptorToSecurityDescriptor */
static char pipe_name[512];
static SECURITY_ATTRIBUTES saPipeSecurity;
-static SECURITY_DESCRIPTOR sdPipeDescriptor;
static HANDLE hPipe = INVALID_HANDLE_VALUE;
#endif
@@ -2238,21 +2238,20 @@ static void network_init(void)
strxnmov(pipe_name, sizeof(pipe_name)-1, "\\\\.\\pipe\\",
mysqld_unix_port, NullS);
- bzero((char*) &saPipeSecurity, sizeof(saPipeSecurity));
- bzero((char*) &sdPipeDescriptor, sizeof(sdPipeDescriptor));
- if (!InitializeSecurityDescriptor(&sdPipeDescriptor,
- SECURITY_DESCRIPTOR_REVISION))
+ /*
+ Create a security descriptor for pipe.
+ - Use low integrity level, so that it is possible to connect
+ from any process.
+ - Give Everyone read/write access to pipe.
+ */
+ if (!ConvertStringSecurityDescriptorToSecurityDescriptor(
+ "S:(ML;; NW;;; LW) D:(A;; FRFW;;; WD)",
+ SDDL_REVISION_1, &saPipeSecurity.lpSecurityDescriptor, NULL))
{
sql_perror("Can't start server : Initialize security descriptor");
unireg_abort(1);
}
- if (!SetSecurityDescriptorDacl(&sdPipeDescriptor, TRUE, NULL, FALSE))
- {
- sql_perror("Can't start server : Set security descriptor");
- unireg_abort(1);
- }
saPipeSecurity.nLength = sizeof(SECURITY_ATTRIBUTES);
- saPipeSecurity.lpSecurityDescriptor = &sdPipeDescriptor;
saPipeSecurity.bInheritHandle = FALSE;
if ((hPipe= CreateNamedPipe(pipe_name,
PIPE_ACCESS_DUPLEX | FILE_FLAG_OVERLAPPED | FILE_FLAG_FIRST_PIPE_INSTANCE,
@@ -5859,6 +5858,7 @@ pthread_handler_t handle_connections_namedpipes(void *arg)
thd->security_ctx->host= my_strdup(my_localhost, MYF(0));
create_new_thread(thd);
}
+ LocalFree(saPipeSecurity.lpSecurityDescriptor);
CloseHandle(connectOverlapped.hEvent);
DBUG_LEAVE;
decrement_handler_count();
--
cgit v1.2.1
From 75dfd4acb995789ca5f86ccbd361fff9d2797e79 Mon Sep 17 00:00:00 2001
From: Julius Goryavsky <sysprg@gmail.com>
Date: Thu, 26 Jul 2018 15:04:11 +0200
Subject: This is patch for the https://jira.mariadb.org/browse/MDEV-9519
issue:
If we have a 2+ node cluster which is replicating from an async master
and the binlog_format is set to STATEMENT and multi-row inserts are executed
on a table with an auto_increment column such that values are automatically
generated by MySQL, then the server node generates wrong auto_increment
values, which are different from what was generated on the async master.
The causes and fixes:
1. We need to improve processing of changing the auto-increment values
after changing the cluster size.
2. If wsrep auto_increment_control switched on during operation of
the node, then we should immediately update the auto_increment_increment
and auto_increment_offset global variables, without waiting of the next
invocation of the wsrep_view_handler_cb() callback. In the current version
these variables retain its initial values if wsrep_auto_increment_control
is switched on during operation of the node, which leads to inconsistent
results on the different nodes in some scenarios.
3. If wsrep auto_increment_control switched off during operation of the node,
then we must return the original values of the auto_increment_increment and
auto_increment_offset global variables, as the user has set. To make this
possible, we need to add a "shadow copies" of these variables (which stores
the latest values set by the user).
---
sql/mysqld.cc | 14 ++++++++++++++
1 file changed, 14 insertions(+)
(limited to 'sql/mysqld.cc')
diff --git a/sql/mysqld.cc b/sql/mysqld.cc
index 1e6e144ccff..d12cdb34e02 100644
--- a/sql/mysqld.cc
+++ b/sql/mysqld.cc
@@ -4193,6 +4193,20 @@ static int init_common_variables()
DBUG_PRINT("info",("%s Ver %s for %s on %s\n",my_progname,
server_version, SYSTEM_TYPE,MACHINE_TYPE));
+#ifdef WITH_WSREP
+ /*
+ We need to initialize auxiliary variables, that will be
+ further keep the original values of auto-increment options
+ as they set by the user. These variables used to restore
+ user-defined values of the auto-increment options after
+ setting of the wsrep_auto_increment_control to 'OFF'.
+ */
+ global_system_variables.saved_auto_increment_increment=
+ global_system_variables.auto_increment_increment;
+ global_system_variables.saved_auto_increment_offset=
+ global_system_variables.auto_increment_offset;
+#endif /* WITH_WSREP */
+
#ifdef HAVE_LARGE_PAGES
/* Initialize large page size */
if (opt_large_pages)
--
cgit v1.2.1