MDEV-35904/MDEV-37726/MDEV-15502 - systemd environment files for service, selinux fix + Deb

cmake/install_layout.cmake

@@ -163,6 +163,7 @@ SET(INSTALL_UNIX_ADDRDIR_RPM            "${INSTALL_MYSQLDATADIR_RPM}/mysql.sock"
 SET(INSTALL_SYSTEMD_UNITDIR_RPM         "/usr/lib/systemd/system")
 SET(INSTALL_SYSTEMD_SYSUSERSDIR_RPM     "/usr/lib/sysusers.d")
 SET(INSTALL_SYSTEMD_TMPFILESDIR_RPM     "/usr/lib/tmpfiles.d")
+SET(INSTALL_RUNDATADIR_RPM              "/run/mariadb")
 SET(INSTALL_PAMDIR_RPM                  "/${INSTALL_LIBDIR_RPM}/security")
 SET(INSTALL_PAMDATADIR_RPM              "/etc/security")
 
@@ -197,6 +198,7 @@ SET(INSTALL_UNIX_ADDRDIR_DEB            "/run/mysqld/mysqld.sock")
 SET(INSTALL_SYSTEMD_UNITDIR_DEB         "/lib/systemd/system")
 SET(INSTALL_SYSTEMD_SYSUSERSDIR_DEB     "/usr/lib/sysusers.d")
 SET(INSTALL_SYSTEMD_TMPFILESDIR_DEB     "/usr/lib/tmpfiles.d")
+SET(INSTALL_RUNDATADIR_DEB              "/run/mariadb")
 SET(INSTALL_PAMDIR_DEB                  "/lib/${CMAKE_CXX_LIBRARY_ARCHITECTURE}/security")
 SET(INSTALL_PAMDATADIR_DEB              "/etc/security")
 
@@ -257,3 +259,7 @@ IF(NOT MYSQL_UNIX_ADDR)
   SET(MYSQL_UNIX_ADDR ${INSTALL_UNIX_ADDRDIR})
 ENDIF()
 
+IF(NOT INSTALL_RUNDATADIR)
+  get_filename_component(MYSQL_UNIX_DIR ${MYSQL_UNIX_ADDR} DIRECTORY)
+  SET(INSTALL_RUNDATADIR "${MYSQL_UNIX_DIR}" CACHE FILEPATH "Rundata installation directory" ${FORCE})
+ENDIF()

cmake/systemd.cmake

@@ -50,8 +50,7 @@ MACRO(CHECK_SYSTEMD)
           SET(SYSTEMD_SCRIPTS ${SYSTEMD_SCRIPTS} galera_new_cluster galera_recovery)
         ENDIF()
         IF(DEB)
-          SET(SYSTEMD_EXECSTARTPRE "ExecStartPre=/usr/bin/install -m 755 -o mysql -g root -d /var/run/mysqld")
-          SET(SYSTEMD_EXECSTARTPOST "ExecStartPost=/etc/mysql/debian-start")
+          SET(SYSTEMD_EXECSTARTPOST "ExecStartPost=!/etc/mysql/debian-start")
         ENDIF()
 	IF(URING_FOUND)
 	  SET(SYSTEMD_LIMIT "# For liburing and io_uring_setup()

debian/mariadb-server.install

@@ -16,6 +16,7 @@ lib/systemd/system/mariadb@.socket
 lib/systemd/system/mysql.service
 lib/systemd/system/mysqld.service
 support-files/rpm/enable_encryption.preset etc/mysql/mariadb.conf.d/99-enable-encryption.cnf.preset
+usr/lib/tmpfiles.d/mariadb.conf
 usr/bin/aria_chk
 usr/bin/aria_dump_log
 usr/bin/aria_ftdump

debian/not-installed

@@ -24,7 +24,6 @@ usr/bin/uca-dump
 usr/bin/wsrep_sst_backup
 usr/lib/mysql/plugin/type_test.so
 usr/lib/sysusers.d/mariadb.conf # Not used (yet) in Debian systemd
-usr/lib/tmpfiles.d/mariadb.conf # Not used (yet) in Debian systemd
 usr/sbin/rcmysql
 usr/share/doc/mariadb-server/COPYING (related file: "debian/tmp/usr/share/mysql/mroonga/COPYING")
 usr/share/doc/mariadb-server/CREDITS

scripts/galera_new_cluster.sh

@@ -21,11 +21,11 @@ EOF
     exit 0
 fi
 
-systemctl set-environment _WSREP_NEW_CLUSTER='--wsrep-new-cluster' && \
-    systemctl restart ${1:-mariadb}
+echo _WSREP_NEW_CLUSTER='--wsrep-new-cluster' > "@INSTALL_RUNDATADIR@/wsrep-new-cluster" && \
+    systemctl restart mariadb.service
 
 extcode=$?
 
-systemctl set-environment _WSREP_NEW_CLUSTER=''
+rm -f "@INSTALL_RUNDATADIR@/wsrep-new-cluster"
 
 exit $extcode

support-files/CMakeLists.txt

@@ -210,8 +210,17 @@ IF(UNIX AND NOT WITHOUT_SERVER)
             RENAME mariadb.conf COMPONENT Server)
   ENDIF()
 
-  IF((HAVE_SYSTEMD OR INSTALL_SYSTEMD_TMPUSERS) AND INSTALL_SYSTEMD_TMPFILESDIR)
+  IF((HAVE_SYSTEMD OR INSTALL_SYSTEMD_TMPUSERS) AND INSTALL_SYSTEMD_TMPFILESDIR
+     AND INSTALL_RUNDATADIR)
+    IF(MYSQL_DATADIR STREQUAL INSTALL_RUNDATADIR)
+      SET(DISABLE_RUNDATADIR "#")
+    ENDIF()
     get_filename_component(MYSQL_UNIX_DIR ${MYSQL_UNIX_ADDR} DIRECTORY)
+    IF(MYSQL_UNIX_DIR STREQUAL MYSQL_DATADIR OR MYSQL_UNIX_DIR STREQUAL INSTALL_RUNDATADIR)
+      SET(DISABLE_MYSQL_UNIX_ADDRDIR "#")
+    ENDIF()
+
+    SET(MYSQL_UNIX_ADDRDIR ${MYSQL_UNIX_DIR})
     CONFIGURE_FILE(tmpfiles.conf.in
             ${CMAKE_CURRENT_BINARY_DIR}/tmpfiles.conf @ONLY)
     INSTALL(FILES ${CMAKE_CURRENT_BINARY_DIR}/tmpfiles.conf

support-files/mariadb.service.in

@@ -66,23 +66,24 @@ ProtectSystem=full
 # Prevent accessing /home, /root and /run/user
 ProtectHome=true
 
-# Execute pre and post scripts as root, otherwise it does it as User=
-PermissionsStartOnly=true
+# Use an environment file to pass variable _WSREP_NEW_CLUSTER
+EnvironmentFile=-@INSTALL_RUNDATADIR@/wsrep-new-cluster
 
-@SYSTEMD_EXECSTARTPRE@
+# Use an environment file to pass variable _WSREP_START_POSITION
+EnvironmentFile=-@INSTALL_RUNDATADIR@/wsrep-start-position
 
 # Perform automatic wsrep recovery. When server is started without wsrep,
 # galera_recovery simply returns an empty string. In any case, however,
 # the script is not expected to return with a non-zero status.
-# It is always safe to unset _WSREP_START_POSITION environment variable.
+# It is always safe to remove @INSTALL_RUNDATADIR@/wsrep-start-position
+# environment file.
 # Do not panic if galera_recovery script is not available. (MDEV-10538)
-ExecStartPre=/bin/sh -c "systemctl unset-environment _WSREP_START_POSITION"
 ExecStartPre=/bin/sh -c "[ ! -e @bindir@/galera_recovery ] && VAR= || \
  VAR=`@bindir@/galera_recovery`; [ $? -eq 0 ] \
- && systemctl set-environment _WSREP_START_POSITION=$VAR || exit 1"
+ && echo _WSREP_START_POSITION=$VAR > @INSTALL_RUNDATADIR@/wsrep-start-position || exit 1"
 
 # Needed to create system tables etc.
-# ExecStartPre=@scriptdir@/mariadb-install-db -u mysql
+# ExecStartPre=@scriptdir@/mariadb-install-db
 
 # Start main service
 # MYSQLD_OPTS here is for users to set in /etc/systemd/system/mariadb.service.d/MY_SPECIAL.conf
@@ -91,8 +92,8 @@ ExecStartPre=/bin/sh -c "[ ! -e @bindir@/galera_recovery ] && VAR= || \
 # _WSREP_NEW_CLUSTER is for the exclusive use of the script galera_new_cluster
 ExecStart=@sbindir@/mariadbd $MYSQLD_OPTS $_WSREP_NEW_CLUSTER $_WSREP_START_POSITION
 
-# Unset _WSREP_START_POSITION environment variable.
-ExecStartPost=/bin/sh -c "systemctl unset-environment _WSREP_START_POSITION"
+# Unset _WSREP_START_POSITION/_WSREP_NEW_CLUSTER environment variable.
+ExecStartPost=/bin/rm -f @INSTALL_RUNDATADIR@/wsrep-start-position @INSTALL_RUNDATADIR@/wsrep-new-cluster
 
 @SYSTEMD_EXECSTARTPOST@
 

support-files/tmpfiles.conf.in

@@ -1 +1,16 @@
-d @MYSQL_UNIX_DIR@ 0755 @MYSQLD_USER@ @MYSQLD_USER@ -
+# This is the directory where the unix socket
+# of MariaDB may be created.
+#
+# Under Galera this is where an envfile of
+# the Galera start position is stored.
+#
+# Other temporary directories can be created here like:
+# * tmpdir
+# * innodb_tmpdir
+# * innodb_temp_data_file_path
+# * rocksdb_tmpdir
+# etc.
+# It shouldn't be used for datadir which is why it
+# may be disabled.
+@DISABLE_RUNDATADIR@d @INSTALL_RUNDATADIR@ 0755 @MYSQLD_USER@ @MYSQLD_USER@ -
+@DISABLE_MYSQL_UNIX_ADDRDIR@d @MYSQL_UNIX_ADDRDIR@ 0755 @MYSQLD_USER@ root -