4c9e15b94e
Drop root privileges for mariadb. This isn't perfect. If somemone breaks out of the container and can run sudo within the contianer, it would be possible to replace the root credentials of the database. Any container that uses sudo suffers from some extra attack vector related to the sudo command. That said, the sudo commands are locked down to minimize harm. Change-Id: I4b3573725d940bb8aa90d43a6235d8cf7d30fc64 Partially-Implements: blueprint drop-root
24 lines
828 B
Bash
24 lines
828 B
Bash
#!/bin/bash
|
|
|
|
function bootstrap_db {
|
|
mysqld_safe --wsrep-new-cluster &
|
|
|
|
# Waiting for deamon
|
|
sleep 10
|
|
sudo -E kolla_security_reset
|
|
|
|
mysql -u root --password="${DB_ROOT_PASSWORD}" -e "GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' IDENTIFIED BY '${DB_ROOT_PASSWORD}' WITH GRANT OPTION;"
|
|
mysql -u root --password="${DB_ROOT_PASSWORD}" -e "GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' IDENTIFIED BY '${DB_ROOT_PASSWORD}' WITH GRANT OPTION;"
|
|
mysqladmin -uroot -p"${DB_ROOT_PASSWORD}" shutdown
|
|
}
|
|
|
|
sudo chown mysql: /var/lib/mysql
|
|
|
|
# This catches all cases of the BOOTSTRAP variable being set, including empty
|
|
if [[ "${!KOLLA_BOOTSTRAP[@]}" ]] && [[ ! -e /var/lib/mysql/cluster.exists ]]; then
|
|
ARGS="--wsrep-new-cluster"
|
|
touch /var/lib/mysql/cluster.exists
|
|
mysql_install_db
|
|
bootstrap_db
|
|
fi
|