[PATCH 0/2] mariadb: use /bin/false as the login shell and add perl to RDEPENDS

[PATCH 0/2] mariadb: use /bin/false as the login shell and add perl to RDEPENDS

[Chong Lu]

The following changes since commit 477ccd867cc71f8277f2670b7be34b3b15300052:

  klibc: restylize a bit the recipes (2014-04-06 13:36:20 +0100)

are available in the git repository at:

  git://git.pokylinux.org/poky-contrib chonglu/mariadb
  http://git.pokylinux.org/cgit.cgi/poky-contrib/log/?h=chonglu/mariadb

Chong Lu (2):
  mariadb: use /bin/false as the login shell
  mariadb: add perl to RDEPENDS

 meta-oe/recipes-support/mysql/mariadb_5.1.67.inc | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

-- 
1.8.1.2

[PATCH 1/2] mariadb: use /bin/false as the login shell

[Chong Lu]

Use /bin/false as the login shell, just like what Ubuntu does,
otherwise there might be secure issue.

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Chong Lu <Chong.Lu@windriver.com>
---
 meta-oe/recipes-support/mysql/mariadb_5.1.67.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta-oe/recipes-support/mysql/mariadb_5.1.67.inc b/meta-oe/recipes-support/mysql/mariadb_5.1.67.inc
index 100b3a7..37a0f0c 100644
--- a/meta-oe/recipes-support/mysql/mariadb_5.1.67.inc
+++ b/meta-oe/recipes-support/mysql/mariadb_5.1.67.inc
@@ -35,7 +35,7 @@ INITSCRIPT_NAME = "mysqld"
 INITSCRIPT_PARAMS = "start 45 5 . stop 45 0 6 1 ."
 
 USERADD_PACKAGES = "${PN}-server"
-USERADD_PARAM_${PN}-server = "--system --home-dir /var/mysql -g nogroup mysql"
+USERADD_PARAM_${PN}-server = "--system --home-dir /var/mysql -g nogroup --shell /bin/false mysql"
 
 
 export ac_cv_path_PS="/bin/ps"
-- 
1.8.1.2

[PATCH 2/2] mariadb: add perl to RDEPENDS

[Chong Lu]

Perl doesn't be installed in small image, but mariadb-server, mariadb-client and
mariadb-leftovers need it in runtime, so we add perl to RDEPENDS.

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Chong Lu <Chong.Lu@windriver.com>
---
 meta-oe/recipes-support/mysql/mariadb_5.1.67.inc | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/meta-oe/recipes-support/mysql/mariadb_5.1.67.inc b/meta-oe/recipes-support/mysql/mariadb_5.1.67.inc
index 37a0f0c..e474b3c 100644
--- a/meta-oe/recipes-support/mysql/mariadb_5.1.67.inc
+++ b/meta-oe/recipes-support/mysql/mariadb_5.1.67.inc
@@ -116,6 +116,10 @@ FILES_${PN} = " "
 RDEPENDS_${PN} = "${PN}-client ${PN}-server"
 ALLOW_EMPTY_${PN} = "1"
 
+RDEPENDS_${PN}-client = "perl"
+RDEPENDS_${PN}-server = "perl"
+RDEPENDS_${PN}-leftovers = "perl"
+
 FILES_libmysqlclient = "\
     ${libdir}/libmysqlclient.so.* \
     ${libdir}/plugin/*.so.*"
-- 
1.8.1.2

Re: [PATCH 2/2] mariadb: add perl to RDEPENDS

[Koen Kooi]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Chong Lu schreef op 14-04-14 09:16:
> Perl doesn't be installed in small image, but mariadb-server,
> mariadb-client and mariadb-leftovers need it in runtime, so we add perl
> to RDEPENDS.

It doesn't need any perl modules to work?

> 
> Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Chong
> Lu <Chong.Lu@windriver.com> --- 
> meta-oe/recipes-support/mysql/mariadb_5.1.67.inc | 4 ++++ 1 file changed,
> 4 insertions(+)
> 
> diff --git a/meta-oe/recipes-support/mysql/mariadb_5.1.67.inc
> b/meta-oe/recipes-support/mysql/mariadb_5.1.67.inc index 37a0f0c..e474b3c
> 100644 --- a/meta-oe/recipes-support/mysql/mariadb_5.1.67.inc +++
> b/meta-oe/recipes-support/mysql/mariadb_5.1.67.inc @@ -116,6 +116,10 @@
> FILES_${PN} = " " RDEPENDS_${PN} = "${PN}-client ${PN}-server" 
> ALLOW_EMPTY_${PN} = "1"
> 
> +RDEPENDS_${PN}-client = "perl" +RDEPENDS_${PN}-server = "perl" 
> +RDEPENDS_${PN}-leftovers = "perl" + FILES_libmysqlclient = "\ 
> ${libdir}/libmysqlclient.so.* \ ${libdir}/plugin/*.so.*"
> 

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Darwin)
Comment: GPGTools - http://gpgtools.org

iD8DBQFTS5GcMkyGM64RGpERAoYVAJ4+8cnpKMHIC7YqhO/N4QZPMAX3DACfaheN
oB0KZz+3h0heDx7RJ5gdiT8=
=ttpI
-----END PGP SIGNATURE-----

Re: [PATCH 2/2] mariadb: add perl to RDEPENDS

[Chong Lu]

On 04/14/2014 03:43 PM, Koen Kooi wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Chong Lu schreef op 14-04-14 09:16:
>> Perl doesn't be installed in small image, but mariadb-server,
>> mariadb-client and mariadb-leftovers need it in runtime, so we add perl
>> to RDEPENDS.
> It doesn't need any perl modules to work?

mariadb-server, mariadb-client and mariadb-leftovers need /usr/bin/perl

rpm -qp -R mariadb-server-5.1.67-r0.core2_64.rpm
warning: mariadb-server-5.1.67-r0.core2_64.rpm: Header V4 DSA/SHA1 Signature, key ID f6cf289c: NOKEY
/usr/bin/perl
...

BR
Chong

>
>> Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Chong
>> Lu <Chong.Lu@windriver.com> ---
>> meta-oe/recipes-support/mysql/mariadb_5.1.67.inc | 4 ++++ 1 file changed,
>> 4 insertions(+)
>>
>> diff --git a/meta-oe/recipes-support/mysql/mariadb_5.1.67.inc
>> b/meta-oe/recipes-support/mysql/mariadb_5.1.67.inc index 37a0f0c..e474b3c
>> 100644 --- a/meta-oe/recipes-support/mysql/mariadb_5.1.67.inc +++
>> b/meta-oe/recipes-support/mysql/mariadb_5.1.67.inc @@ -116,6 +116,10 @@
>> FILES_${PN} = " " RDEPENDS_${PN} = "${PN}-client ${PN}-server"
>> ALLOW_EMPTY_${PN} = "1"
>>
>> +RDEPENDS_${PN}-client = "perl" +RDEPENDS_${PN}-server = "perl"
>> +RDEPENDS_${PN}-leftovers = "perl" + FILES_libmysqlclient = "\
>> ${libdir}/libmysqlclient.so.* \ ${libdir}/plugin/*.so.*"
>>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.5 (Darwin)
> Comment: GPGTools - http://gpgtools.org
>
> iD8DBQFTS5GcMkyGM64RGpERAoYVAJ4+8cnpKMHIC7YqhO/N4QZPMAX3DACfaheN
> oB0KZz+3h0heDx7RJ5gdiT8=
> =ttpI
> -----END PGP SIGNATURE-----
>

Re: [PATCH 2/2] mariadb: add perl to RDEPENDS

[Koen Kooi]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Chong Lu schreef op 14-04-14 10:06:
> 
> On 04/14/2014 03:43 PM, Koen Kooi wrote: Chong Lu schreef op 14-04-14
> 09:16:
>>>> Perl doesn't be installed in small image, but mariadb-server, 
>>>> mariadb-client and mariadb-leftovers need it in runtime, so we add
>>>> perl to RDEPENDS.
> It doesn't need any perl modules to work?
> 
>> mariadb-server, mariadb-client and mariadb-leftovers need
>> /usr/bin/perl
> 
>> rpm -qp -R mariadb-server-5.1.67-r0.core2_64.rpm warning:
>> mariadb-server-5.1.67-r0.core2_64.rpm: Header V4 DSA/SHA1 Signature, 
>> key ID f6cf289c: NOKEY /usr/bin/perl ...

I get that it needs /usr/bin/perl, but you didn't answer my question:

	It doesn't need any perl modules to work?

Does it actually work with only 'perl' installed and not any of the
'perl-module-' packages?
	

> 
>> BR Chong
> 
> 
>>>> Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by:
>>>> Chong Lu <Chong.Lu@windriver.com> --- 
>>>> meta-oe/recipes-support/mysql/mariadb_5.1.67.inc | 4 ++++ 1 file
>>>> changed, 4 insertions(+)
>>>> 
>>>> diff --git a/meta-oe/recipes-support/mysql/mariadb_5.1.67.inc 
>>>> b/meta-oe/recipes-support/mysql/mariadb_5.1.67.inc index
>>>> 37a0f0c..e474b3c 100644 ---
>>>> a/meta-oe/recipes-support/mysql/mariadb_5.1.67.inc +++ 
>>>> b/meta-oe/recipes-support/mysql/mariadb_5.1.67.inc @@ -116,6
>>>> +116,10 @@ FILES_${PN} = " " RDEPENDS_${PN} = "${PN}-client
>>>> ${PN}-server" ALLOW_EMPTY_${PN} = "1"
>>>> 
>>>> +RDEPENDS_${PN}-client = "perl" +RDEPENDS_${PN}-server = "perl" 
>>>> +RDEPENDS_${PN}-leftovers = "perl" + FILES_libmysqlclient = "\ 
>>>> ${libdir}/libmysqlclient.so.* \ ${libdir}/plugin/*.so.*"
>>>> 
>> 
> 

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Darwin)
Comment: GPGTools - http://gpgtools.org

iD8DBQFTS53MMkyGM64RGpERAmN9AJwNYnxwYPqCjlVl01kMy0D3EsU5LgCdEtrJ
mC/STuju9Eo9yAW3XDxsNpI=
=esUj
-----END PGP SIGNATURE-----

Re: [PATCH 2/2] mariadb: add perl to RDEPENDS

[Chong Lu]

On 04/14/2014 04:35 PM, Koen Kooi wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Chong Lu schreef op 14-04-14 10:06:
>> On 04/14/2014 03:43 PM, Koen Kooi wrote: Chong Lu schreef op 14-04-14
>> 09:16:
>>>>> Perl doesn't be installed in small image, but mariadb-server,
>>>>> mariadb-client and mariadb-leftovers need it in runtime, so we add
>>>>> perl to RDEPENDS.
>> It doesn't need any perl modules to work?
>>
>>> mariadb-server, mariadb-client and mariadb-leftovers need
>>> /usr/bin/perl
>>> rpm -qp -R mariadb-server-5.1.67-r0.core2_64.rpm warning:
>>> mariadb-server-5.1.67-r0.core2_64.rpm: Header V4 DSA/SHA1 Signature,
>>> key ID f6cf289c: NOKEY /usr/bin/perl ...
> I get that it needs /usr/bin/perl, but you didn't answer my question:
>
> 	It doesn't need any perl modules to work?
>
> Does it actually work with only 'perl' installed and not any of the
> 'perl-module-' packages?
> 	
>
I don't find more dependencies about perl module. I make a image and 
start mariadb. It works well.
>>> BR Chong
>>
>>>>> Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by:
>>>>> Chong Lu <Chong.Lu@windriver.com> ---
>>>>> meta-oe/recipes-support/mysql/mariadb_5.1.67.inc | 4 ++++ 1 file
>>>>> changed, 4 insertions(+)
>>>>>
>>>>> diff --git a/meta-oe/recipes-support/mysql/mariadb_5.1.67.inc
>>>>> b/meta-oe/recipes-support/mysql/mariadb_5.1.67.inc index
>>>>> 37a0f0c..e474b3c 100644 ---
>>>>> a/meta-oe/recipes-support/mysql/mariadb_5.1.67.inc +++
>>>>> b/meta-oe/recipes-support/mysql/mariadb_5.1.67.inc @@ -116,6
>>>>> +116,10 @@ FILES_${PN} = " " RDEPENDS_${PN} = "${PN}-client
>>>>> ${PN}-server" ALLOW_EMPTY_${PN} = "1"
>>>>>
>>>>> +RDEPENDS_${PN}-client = "perl" +RDEPENDS_${PN}-server = "perl"
>>>>> +RDEPENDS_${PN}-leftovers = "perl" + FILES_libmysqlclient = "\
>>>>> ${libdir}/libmysqlclient.so.* \ ${libdir}/plugin/*.so.*"
>>>>>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.5 (Darwin)
> Comment: GPGTools - http://gpgtools.org
>
> iD8DBQFTS53MMkyGM64RGpERAmN9AJwNYnxwYPqCjlVl01kMy0D3EsU5LgCdEtrJ
> mC/STuju9Eo9yAW3XDxsNpI=
> =esUj
> -----END PGP SIGNATURE-----
>

Re: [PATCH 2/2] mariadb: add perl to RDEPENDS

[Koen Kooi]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Chong Lu schreef op 14-04-14 10:56:
> 
> On 04/14/2014 04:35 PM, Koen Kooi wrote: Chong Lu schreef op 14-04-14
> 10:06:
>>>> On 04/14/2014 03:43 PM, Koen Kooi wrote: Chong Lu schreef op
>>>> 14-04-14 09:16:
>>>>>>> Perl doesn't be installed in small image, but
>>>>>>> mariadb-server, mariadb-client and mariadb-leftovers need it
>>>>>>> in runtime, so we add perl to RDEPENDS.
>>>> It doesn't need any perl modules to work?
>>>> 
>>>>> mariadb-server, mariadb-client and mariadb-leftovers need 
>>>>> /usr/bin/perl rpm -qp -R mariadb-server-5.1.67-r0.core2_64.rpm
>>>>> warning: mariadb-server-5.1.67-r0.core2_64.rpm: Header V4
>>>>> DSA/SHA1 Signature, key ID f6cf289c: NOKEY /usr/bin/perl ...
> I get that it needs /usr/bin/perl, but you didn't answer my question:
> 
> It doesn't need any perl modules to work?
> 
> Does it actually work with only 'perl' installed and not any of the 
> 'perl-module-' packages?
> 
> 
>> I don't find more dependencies about perl module. I make a image and
>> start mariadb. It works well.

Can you describe the difference before and after this patch for the runtime
behaviour? I get the impression that you only silenced output from RPM and
didn't do any real testing or try to understand the problem
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Darwin)
Comment: GPGTools - http://gpgtools.org

iD8DBQFTS6UgMkyGM64RGpERApbOAJ4teUaJa3Owih3cPogWpBuyrJ8V6QCfePw8
G+rAP5C6+rkmP8Nw+loS+CM=
=gMxa
-----END PGP SIGNATURE-----

Re: [PATCH 1/2] mariadb: use /bin/false as the login shell

[Martin Jansa]

[-- Attachment #1: Type: text/plain, Size: 1423 bytes --]

On Mon, Apr 14, 2014 at 03:16:38PM +0800, Chong Lu wrote:
> Use /bin/false as the login shell, just like what Ubuntu does,
> otherwise there might be secure issue.

1/2 Merged, thanks

2/2 has question from koen, which needs to be resolved first

> 
> Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
> Signed-off-by: Chong Lu <Chong.Lu@windriver.com>
> ---
>  meta-oe/recipes-support/mysql/mariadb_5.1.67.inc | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/meta-oe/recipes-support/mysql/mariadb_5.1.67.inc b/meta-oe/recipes-support/mysql/mariadb_5.1.67.inc
> index 100b3a7..37a0f0c 100644
> --- a/meta-oe/recipes-support/mysql/mariadb_5.1.67.inc
> +++ b/meta-oe/recipes-support/mysql/mariadb_5.1.67.inc
> @@ -35,7 +35,7 @@ INITSCRIPT_NAME = "mysqld"
>  INITSCRIPT_PARAMS = "start 45 5 . stop 45 0 6 1 ."
>  
>  USERADD_PACKAGES = "${PN}-server"
> -USERADD_PARAM_${PN}-server = "--system --home-dir /var/mysql -g nogroup mysql"
> +USERADD_PARAM_${PN}-server = "--system --home-dir /var/mysql -g nogroup --shell /bin/false mysql"
>  
>  
>  export ac_cv_path_PS="/bin/ps"
> -- 
> 1.8.1.2
> 
> -- 
> _______________________________________________
> Openembedded-devel mailing list
> Openembedded-devel@lists.openembedded.org
> http://lists.openembedded.org/mailman/listinfo/openembedded-devel

-- 
Martin 'JaMa' Jansa     jabber: Martin.Jansa@gmail.com

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 205 bytes --]