Debian’s latest MySQL packages are compiled with --with-mysqld-ldflags = -all-static
.
That means libc.so.6
is linked statically now. But glibc’s getpwnam
and getpwuid
implementations still need the shared libraries. The needed libraries must be copied into the chroot because mysqld
calls those functions after calling chroot
. I’ve updated the mysql-chroot
script accordingly.
(The rest of the chroot setup procedure still works as described in Chrooting MySQL on Debian.)
By the way, I’ve filed a wishlist bug at Debian’s BTS (#299265). mysqld
should do all /etc/passwd
lookups before calling chroot
. That way chrooting would work without $CHROOT/etc/passwd
and with copying any libraries into the chroot. That’s how Apache and Bind 9 do it.
March 17th, 2005: Debian has removed the -all-static
flag again. I’m leaving the additional bits in the chroot script however, just in case the maintainers decide to add the flag again.
[…] Updated MySQL Chroot Script (tags: database mysql sysadmin security) […]