Skip to content

Commit f1b05ac

Browse files
tianontianon
committed
Merge pull request #53 from mysql/master
Prevent root password from being accessible by normal users on first run
2 parents 2a2b721 + 0fd8c68 commit f1b05ac

File tree

3 files changed

+164
-49
lines changed

3 files changed

+164
-49
lines changed

‎5.5/docker-entrypoint.sh

Lines changed: 56 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,57 @@
11
#!/bin/bash
22
set -e
33

4+
get_option () {
5+
local section=$1
6+
local option=$2
7+
local default=$3
8+
ret=$(my_print_defaults $section | grep '^--'${option}'=' | cut -d= -f2-)
9+
[ -z $ret ] && ret=$default
10+
echo $ret
11+
}
12+
413
# if command starts with an option, prepend mysqld
514
if [ "${1:0:1}" = '-' ]; then
615
set -- mysqld "$@"
716
fi
817

918
if [ "$1" = 'mysqld' ]; then
10-
# read DATADIR from the MySQL config
19+
# Get config
1120
DATADIR="$("$@" --verbose --help 2>/dev/null | awk '$1 == "datadir" { print $2; exit }')"
12-
21+
SOCKET=$(get_option mysqld socket "/tmp/mysql.sock")
22+
HOSTNAME=$(hostname)
23+
PIDFILE=$(get_option mysqld pid-file "$DATADIR/mysqld.pid")
24+
1325
if [ ! -d "$DATADIR/mysql" ]; then
1426
if [ -z "$MYSQL_ROOT_PASSWORD" -a -z "$MYSQL_ALLOW_EMPTY_PASSWORD" ]; then
1527
echo >&2 'error: database is uninitialized and MYSQL_ROOT_PASSWORD not set'
1628
echo >&2 ' Did you forget to add -e MYSQL_ROOT_PASSWORD=... ?'
1729
exit 1
1830
fi
19-
20-
echo 'Running mysql_install_db ...'
21-
mysql_install_db --datadir="$DATADIR" --basedir=/usr/local/mysql
31+
32+
mkdir -p "$DATADIR"
33+
chown -R mysql:mysql "$DATADIR"
34+
35+
echo 'Running mysql_install_db'
36+
mysql_install_db --user=mysql --datadir="$DATADIR" --rpm --basedir=/usr/local/mysql
2237
echo 'Finished mysql_install_db'
23-
38+
39+
mysqld --user=mysql --datadir="$DATADIR" --skip-networking --basedir=/usr/local/mysql --pid-file="$PIDFILE" &
40+
for i in $(seq 30 -1 0); do
41+
[ -S "$SOCKET" ] && break
42+
echo 'MySQL init process in progress...'
43+
sleep 1
44+
done
45+
if [ $i = 0 ]; then
46+
echo >&2 'MySQL init process failed.'
47+
exit 1
48+
fi
49+
2450
# These statements _must_ be on individual lines, and _must_ end with
2551
# semicolons (no line breaks or comments are permitted).
2652
# TODO proper SQL escaping on ALL the things D:
27-
28-
tempSqlFile='/tmp/mysql-first-time.sql'
53+
54+
tempSqlFile=$(mktemp /tmp/mysql-first-time.XXXXXX.sql)
2955
cat > "$tempSqlFile" <<-EOSQL
3056
-- What's done in this file shouldn't be replicated
3157
-- or products like mysql-fabric won't work
@@ -36,24 +62,37 @@ if [ "$1" = 'mysqld' ]; then
3662
GRANT ALL ON *.* TO 'root'@'%' WITH GRANT OPTION ;
3763
DROP DATABASE IF EXISTS test ;
3864
EOSQL
39-
65+
4066
if [ "$MYSQL_DATABASE" ]; then
4167
echo "CREATE DATABASE IF NOT EXISTS \`$MYSQL_DATABASE\` ;" >> "$tempSqlFile"
4268
fi
43-
69+
4470
if [ "$MYSQL_USER" -a "$MYSQL_PASSWORD" ]; then
45-
echo "CREATE USER '$MYSQL_USER'@'%' IDENTIFIED BY '$MYSQL_PASSWORD' ;" >> "$tempSqlFile"
46-
71+
echo "CREATE USER '"$MYSQL_USER"'@'%' IDENTIFIED BY '"$MYSQL_PASSWORD"' ;" >> "$tempSqlFile"
72+
4773
if [ "$MYSQL_DATABASE" ]; then
48-
echo "GRANT ALL ON \`$MYSQL_DATABASE\`.* TO '$MYSQL_USER'@'%' ;" >> "$tempSqlFile"
74+
echo "GRANT ALL ON \`"$MYSQL_DATABASE"\`.* TO '"$MYSQL_USER"'@'%' ;" >> "$tempSqlFile"
4975
fi
5076
fi
51-
77+
5278
echo 'FLUSH PRIVILEGES ;' >> "$tempSqlFile"
53-
54-
set -- "$@" --init-file="$tempSqlFile"
79+
80+
mysql -uroot < "$tempSqlFile"
81+
82+
rm -f "$tempSqlFile"
83+
kill $(cat $PIDFILE)
84+
for i in $(seq 30 -1 0); do
85+
[ -f "$PIDFILE" ] || break
86+
echo 'MySQL init process in progress...'
87+
sleep 1
88+
done
89+
if [ $i = 0 ]; then
90+
echo >&2 'MySQL hangs during init process.'
91+
exit 1
92+
fi
93+
echo 'MySQL init process done. Ready for start up.'
5594
fi
56-
95+
5796
chown -R mysql:mysql "$DATADIR"
5897
fi
5998

‎5.6/docker-entrypoint.sh

Lines changed: 55 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,56 @@
11
#!/bin/bash
22
set -e
33

4+
get_option () {
5+
local section=$1
6+
local option=$2
7+
local default=$3
8+
ret=$(my_print_defaults $section | grep '^--'${option}'=' | cut -d= -f2-)
9+
[ -z $ret ] && ret=$default
10+
echo $ret
11+
}
12+
413
# if command starts with an option, prepend mysqld
514
if [ "${1:0:1}" = '-' ]; then
615
set -- mysqld "$@"
716
fi
817

918
if [ "$1" = 'mysqld' ]; then
10-
# read DATADIR from the MySQL config
19+
# Get config
1120
DATADIR="$("$@" --verbose --help 2>/dev/null | awk '$1 == "datadir" { print $2; exit }')"
12-
21+
SOCKET=$(get_option mysqld socket "$DATADIR/mysql.sock")
22+
PIDFILE=$(get_option mysqld pid-file "/var/run/mysqld/mysqld.pid")
23+
1324
if [ ! -d "$DATADIR/mysql" ]; then
1425
if [ -z "$MYSQL_ROOT_PASSWORD" -a -z "$MYSQL_ALLOW_EMPTY_PASSWORD" ]; then
1526
echo >&2 'error: database is uninitialized and MYSQL_ROOT_PASSWORD not set'
1627
echo >&2 ' Did you forget to add -e MYSQL_ROOT_PASSWORD=... ?'
1728
exit 1
1829
fi
19-
20-
echo 'Running mysql_install_db ...'
21-
mysql_install_db --datadir="$DATADIR"
30+
31+
mkdir -p "$DATADIR"
32+
chown -R mysql:mysql "$DATADIR"
33+
34+
echo 'Running mysql_install_db'
35+
mysql_install_db --user=mysql --datadir="$DATADIR" --rpm --keep-my-cnf
2236
echo 'Finished mysql_install_db'
23-
37+
38+
mysqld --user=mysql --datadir="$DATADIR" --skip-networking &
39+
for i in $(seq 30 -1 0); do
40+
[ -S "$SOCKET" ] && break
41+
echo 'MySQL init process in progress...'
42+
sleep 1
43+
done
44+
if [ $i = 0 ]; then
45+
echo >&2 'MySQL init process failed.'
46+
exit 1
47+
fi
48+
2449
# These statements _must_ be on individual lines, and _must_ end with
2550
# semicolons (no line breaks or comments are permitted).
2651
# TODO proper SQL escaping on ALL the things D:
27-
28-
tempSqlFile='/tmp/mysql-first-time.sql'
52+
53+
tempSqlFile=$(mktemp /tmp/mysql-first-time.XXXXXX.sql)
2954
cat > "$tempSqlFile" <<-EOSQL
3055
-- What's done in this file shouldn't be replicated
3156
-- or products like mysql-fabric won't work
@@ -36,24 +61,37 @@ if [ "$1" = 'mysqld' ]; then
3661
GRANT ALL ON *.* TO 'root'@'%' WITH GRANT OPTION ;
3762
DROP DATABASE IF EXISTS test ;
3863
EOSQL
39-
64+
4065
if [ "$MYSQL_DATABASE" ]; then
4166
echo "CREATE DATABASE IF NOT EXISTS \`$MYSQL_DATABASE\` ;" >> "$tempSqlFile"
4267
fi
43-
68+
4469
if [ "$MYSQL_USER" -a "$MYSQL_PASSWORD" ]; then
45-
echo "CREATE USER '$MYSQL_USER'@'%' IDENTIFIED BY '$MYSQL_PASSWORD' ;" >> "$tempSqlFile"
46-
70+
echo "CREATE USER '"$MYSQL_USER"'@'%' IDENTIFIED BY '"$MYSQL_PASSWORD"' ;" >> "$tempSqlFile"
71+
4772
if [ "$MYSQL_DATABASE" ]; then
48-
echo "GRANT ALL ON \`$MYSQL_DATABASE\`.* TO '$MYSQL_USER'@'%' ;" >> "$tempSqlFile"
73+
echo "GRANT ALL ON \`"$MYSQL_DATABASE"\`.* TO '"$MYSQL_USER"'@'%' ;" >> "$tempSqlFile"
4974
fi
5075
fi
51-
76+
5277
echo 'FLUSH PRIVILEGES ;' >> "$tempSqlFile"
53-
54-
set -- "$@" --init-file="$tempSqlFile"
78+
79+
mysql -uroot < "$tempSqlFile"
80+
81+
rm -f "$tempSqlFile"
82+
kill $(cat $PIDFILE)
83+
for i in $(seq 30 -1 0); do
84+
[ -f "$PIDFILE" ] || break
85+
echo 'MySQL init process in progress...'
86+
sleep 1
87+
done
88+
if [ $i = 0 ]; then
89+
echo >&2 'MySQL hangs during init process.'
90+
exit 1
91+
fi
92+
echo 'MySQL init process done. Ready for start up.'
5593
fi
56-
94+
5795
chown -R mysql:mysql "$DATADIR"
5896
fi
5997

‎5.7/docker-entrypoint.sh

Lines changed: 53 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,56 @@
11
#!/bin/bash
22
set -e
33

4+
get_option () {
5+
local section=$1
6+
local option=$2
7+
local default=$3
8+
ret=$(my_print_defaults $section | grep '^--'${option}'=' | cut -d= -f2-)
9+
[ -z $ret ] && ret=$default
10+
echo $ret
11+
}
12+
413
# if command starts with an option, prepend mysqld
514
if [ "${1:0:1}" = '-' ]; then
615
set -- mysqld "$@"
716
fi
817

918
if [ "$1" = 'mysqld' ]; then
10-
# read DATADIR from the MySQL config
19+
# Get config
1120
DATADIR="$("$@" --verbose --help 2>/dev/null | awk '$1 == "datadir" { print $2; exit }')"
12-
21+
SOCKET=$(get_option mysqld socket "$DATADIR/mysql.sock")
22+
PIDFILE=$(get_option mysqld pid-file "/var/run/mysqld/mysqld.pid")
23+
1324
if [ ! -d "$DATADIR/mysql" ]; then
1425
if [ -z "$MYSQL_ROOT_PASSWORD" -a -z "$MYSQL_ALLOW_EMPTY_PASSWORD" ]; then
1526
echo >&2 'error: database is uninitialized and MYSQL_ROOT_PASSWORD not set'
1627
echo >&2 ' Did you forget to add -e MYSQL_ROOT_PASSWORD=... ?'
1728
exit 1
1829
fi
19-
30+
31+
mkdir -p "$DATADIR"
32+
chown -R mysql:mysql "$DATADIR"
33+
2034
echo 'Initializing database'
2135
mysqld --initialize-insecure=on --datadir="$DATADIR"
2236
echo 'Database initialized'
23-
37+
38+
mysqld --user=mysql --datadir="$DATADIR" --skip-networking &
39+
for i in $(seq 30 -1 0); do
40+
[ -S $SOCKET ] && break
41+
echo 'MySQL init process in progress...'
42+
sleep 1
43+
done
44+
if [ $i = 0 ]; then
45+
echo >&2 'MySQL init process failed.'
46+
exit 1
47+
fi
48+
2449
# These statements _must_ be on individual lines, and _must_ end with
2550
# semicolons (no line breaks or comments are permitted).
2651
# TODO proper SQL escaping on ALL the things D:
27-
28-
tempSqlFile='/tmp/mysql-first-time.sql'
52+
53+
tempSqlFile=$(mktemp /tmp/mysql-first-time.XXXXXX.sql)
2954
cat > "$tempSqlFile" <<-EOSQL
3055
-- What's done in this file shouldn't be replicated
3156
-- or products like mysql-fabric won't work
@@ -36,25 +61,38 @@ if [ "$1" = 'mysqld' ]; then
3661
GRANT ALL ON *.* TO 'root'@'%' WITH GRANT OPTION ;
3762
DROP DATABASE IF EXISTS test ;
3863
EOSQL
39-
64+
4065
if [ "$MYSQL_DATABASE" ]; then
4166
echo "CREATE DATABASE IF NOT EXISTS \`$MYSQL_DATABASE\` ;" >> "$tempSqlFile"
4267
fi
43-
68+
4469
if [ "$MYSQL_USER" -a "$MYSQL_PASSWORD" ]; then
45-
echo "CREATE USER '$MYSQL_USER'@'%' IDENTIFIED BY '$MYSQL_PASSWORD' ;" >> "$tempSqlFile"
46-
70+
echo "CREATE USER '"$MYSQL_USER"'@'%' IDENTIFIED BY '"$MYSQL_PASSWORD"' ;" >> "$tempSqlFile"
71+
4772
if [ "$MYSQL_DATABASE" ]; then
48-
echo "GRANT ALL ON \`$MYSQL_DATABASE\`.* TO '$MYSQL_USER'@'%' ;" >> "$tempSqlFile"
73+
echo "GRANT ALL ON \`"$MYSQL_DATABASE"\`.* TO '"$MYSQL_USER"'@'%' ;" >> "$tempSqlFile"
4974
fi
5075
fi
51-
76+
5277
echo 'FLUSH PRIVILEGES ;' >> "$tempSqlFile"
53-
54-
set -- "$@" --init-file="$tempSqlFile"
78+
79+
mysql -uroot < "$tempSqlFile"
80+
rm -f "$tempSqlFile"
81+
kill $(cat $PIDFILE)
82+
for i in $(seq 30 -1 0); do
83+
[ -f "$PIDFILE" ] || break
84+
echo 'MySQL init process in progress...'
85+
sleep 1
86+
done
87+
if [ $i = 0 ]; then
88+
echo >&2 'MySQL hangs during init process.'
89+
exit 1
90+
fi
91+
echo 'MySQL init process done. Ready for start up.'
5592
fi
56-
93+
5794
chown -R mysql:mysql "$DATADIR"
5895
fi
5996

6097
exec "$@"
98+

0 commit comments

Comments
 (0)