• Shishir Jaiswal's avatar
    Bug#26585560 - MYSQL DAEMON SHOULD CREATE ITS PID FILE AS · ecc5a078
    Shishir Jaiswal authored
                   ROOT
    
    DESCRIPTION
    ===========
    If the .pid file is created at a world-writable location,
    it can be compromised by replacing the server's pid with
    another running server's (or some other non-mysql process)
    PID causing abnormal behaviour.
    
    ANALYSIS
    ========
    In such a case, user should be warned that .pid file is
    being created at a world-writable location.
    
    FIX
    ===
    A new function is_file_or_dir_world_writable() is defined
    and it is called in create_pid_file() before .pid file
    creation. If the location is world-writable, a relevant
    warning is thrown.
    
    NOTE
    ====
    1. PID file is always created with permission bit 0664, so
    for outside world its read-only.
    2. Ignoring the case when permission is denied to get the
    dir stats since the .pid file creation would fail anyway in
    such a case.
    ecc5a078
sql_common.h 4.53 KB