Skip to content

Add 'FLUSH PRIVILEGES;' to avoid creating 'root'@'${MYSQL_ROOT_HOST}' to be failed when MYSQL_ROOT_HOST isn't '%' #549

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 3 commits into from
Closed

Add 'FLUSH PRIVILEGES;' to avoid creating 'root'@'${MYSQL_ROOT_HOST}' to be failed when MYSQL_ROOT_HOST isn't '%' #549

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
2ea828a
Add 'FLUSH PRIVILEGES;' to avoid creating 'root'@'${MYSQL_ROOT_HOST}'…
Mar 10, 2019
a411161
'FLUSH PRIVILEGES;' is unnecessary for MySQL 5.7+ after creating the …
Mar 13, 2019
36a3e7b
Remove the redundant 'FLUSH PRIVILEGES', only 'DELETE FROM' or 'DROP …
Mar 14, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions 5.5/docker-entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,6 +158,7 @@ if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then
DELETE FROM mysql.user WHERE user NOT IN ('mysql.sys', 'mysqlxsys', 'root') OR host NOT IN ('localhost') ;
SET PASSWORD FOR 'root'@'localhost'=PASSWORD('${MYSQL_ROOT_PASSWORD}') ;
GRANT ALL ON *.* TO 'root'@'localhost' WITH GRANT OPTION ;
FLUSH PRIVILEGES ;
${rootCreate}
DROP DATABASE IF EXISTS test ;
FLUSH PRIVILEGES ;
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why do we need to do this twice?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Because ERROR 1396 (HY000) at line 8: Operation CREATE USER failed for 'root'@'127.0.0.1' will be thrown when trying to create 'root'@'127.0.0.1' if we do not FLUSH PRIVILEGES; after 'root'@'localhost' is created.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not sure where the 127.0.0.1 is coming from. Are you setting MYSQL_ROOT_HOST to 127.0.0.1?

That works fine here (but means only root connections from within the container's network namespace):

$ docker run -d -e MYSQL_ROOT_HOST=127.0.0.1 -e MYSQL_ROOT_PASSWORD=12345 mysql:8
23d1a83c2da46239b5d3cb08cd24aa0c51ea210b9c5899ace59ce4baa383abff
$ docker logs 23d1a83c2da46239b5d3cb08cd24aa0c51ea210b9c5899ace59ce4baa383abff
Initializing database
2019-03-12T21:43:22.651362Z 0 [Warning] [MY-011070] [Server] 'Disabling symbolic links using --skip-symbolic-links (or equivalent) is the default. Consider not using this option as it' is deprecated and will be removed in a future release.
2019-03-12T21:43:22.651431Z 0 [System] [MY-013169] [Server] /usr/sbin/mysqld (mysqld 8.0.15) initializing of server in progress as process 29
2019-03-12T21:43:24.578807Z 5 [Warning] [MY-010453] [Server] root@localhost is created with an empty password ! Please consider switching off the --initialize-insecure option.
2019-03-12T21:43:25.344101Z 0 [System] [MY-013170] [Server] /usr/sbin/mysqld (mysqld 8.0.15) initializing of server has completed
Database initialized
MySQL init process in progress...
mbind: Operation not permitted
2019-03-12T21:43:26.821818Z 0 [Warning] [MY-011070] [Server] 'Disabling symbolic links using --skip-symbolic-links (or equivalent) is the default. Consider not using this option as it' is deprecated and will be removed in a future release.
2019-03-12T21:43:26.821888Z 0 [System] [MY-010116] [Server] /usr/sbin/mysqld (mysqld 8.0.15) starting as process 80
2019-03-12T21:43:27.174191Z 0 [Warning] [MY-010068] [Server] CA certificate ca.pem is self signed.
2019-03-12T21:43:27.177027Z 0 [Warning] [MY-011810] [Server] Insecure configuration for --pid-file: Location '/var/run/mysqld' in the path is accessible to all OS users. Consider choosing a different directory.
2019-03-12T21:43:27.209833Z 0 [System] [MY-010931] [Server] /usr/sbin/mysqld: ready for connections. Version: '8.0.15'  socket: '/var/run/mysqld/mysqld.sock'  port: 0  MySQL Community Server - GPL.
2019-03-12T21:43:27.305865Z 0 [System] [MY-011323] [Server] X Plugin ready for connections. Socket: '/var/run/mysqld/mysqlx.sock'
Warning: Unable to load '/usr/share/zoneinfo/iso3166.tab' as time zone. Skipping it.
Warning: Unable to load '/usr/share/zoneinfo/leap-seconds.list' as time zone. Skipping it.
Warning: Unable to load '/usr/share/zoneinfo/zone.tab' as time zone. Skipping it.
Warning: Unable to load '/usr/share/zoneinfo/zone1970.tab' as time zone. Skipping it.

2019-03-12T21:43:30.755816Z 0 [System] [MY-010910] [Server] /usr/sbin/mysqld: Shutdown complete (mysqld 8.0.15)  MySQL Community Server - GPL.

MySQL init process done. Ready for start up.

2019-03-12T21:43:31.061395Z 0 [Warning] [MY-011070] [Server] 'Disabling symbolic links using --skip-symbolic-links (or equivalent) is the default. Consider not using this option as it' is deprecated and will be removed in a future release.
2019-03-12T21:43:31.061459Z 0 [System] [MY-010116] [Server] /usr/sbin/mysqld (mysqld 8.0.15) starting as process 1
2019-03-12T21:43:31.418610Z 0 [Warning] [MY-010068] [Server] CA certificate ca.pem is self signed.
2019-03-12T21:43:31.420085Z 0 [Warning] [MY-011810] [Server] Insecure configuration for --pid-file: Location '/var/run/mysqld' in the path is accessible to all OS users. Consider choosing a different directory.
2019-03-12T21:43:31.432530Z 0 [System] [MY-010931] [Server] /usr/sbin/mysqld: ready for connections. Version: '8.0.15'  socket: '/var/run/mysqld/mysqld.sock'  port: 3306  MySQL Community Server - GPL.
2019-03-12T21:43:31.552062Z 0 [System] [MY-011323] [Server] X Plugin ready for connections. Socket: '/var/run/mysqld/mysqlx.sock' bind-address: '::' port: 33060
$ docker exec -it 23d1a83c2da46239b5d3cb08cd24aa0c51ea210b9c5899ace59ce4baa383abff mysql -uroot -p12345 -h127.0.0.1
mysql: [Warning] Using a password on the command line interface can be insecure.
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 9
Server version: 8.0.15 MySQL Community Server - GPL

Copyright (c) 2000, 2019, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> select * from mysql.user;
....(contents of the user table)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

After a bit more research, it looks like this is limited to 5.5 and 5.6 when using 127.0.0.1 for MYSQL_ROOT_HOST.

It seems that the GRANT and SET PASSWORD are fine, since "If you modify the grant tables indirectly using an account-management statement, the server notices these changes and loads the grant tables into memory again immediately" (mysql docs).

The problem stems from using DELETE FROM mysql.user rather than DROP USER. So either the DELETE FROM needs a FLUSH or we switch to DROP USER (https://stackoverflow.com/a/12343178).

Ah! Does this not affect 5.7+ because they don't have mysql_install_db and the baggage of [email protected] being pre-created?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@yosifkit Yes, that's right. FLUSH PRIVILEGES isn't necessary for MySQL 5.7+. I will update the PR.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Instead of adding another flush privileges, it should be enough to just move the existing one up, since as you say the DELETE FROM statement is the only one that needs a flush

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ltangvald Thanks, I have already removed the redundant flush statement.

Expand Down
1 change: 1 addition & 0 deletions 5.6/docker-entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,6 +158,7 @@ if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then
DELETE FROM mysql.user WHERE user NOT IN ('mysql.sys', 'mysqlxsys', 'root') OR host NOT IN ('localhost') ;
SET PASSWORD FOR 'root'@'localhost'=PASSWORD('${MYSQL_ROOT_PASSWORD}') ;
GRANT ALL ON *.* TO 'root'@'localhost' WITH GRANT OPTION ;
FLUSH PRIVILEGES ;
${rootCreate}
DROP DATABASE IF EXISTS test ;
FLUSH PRIVILEGES ;
Expand Down
1 change: 1 addition & 0 deletions 5.7/docker-entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -163,6 +163,7 @@ if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then

SET PASSWORD FOR 'root'@'localhost'=PASSWORD('${MYSQL_ROOT_PASSWORD}') ;
GRANT ALL ON *.* TO 'root'@'localhost' WITH GRANT OPTION ;
FLUSH PRIVILEGES ;
${rootCreate}
DROP DATABASE IF EXISTS test ;
FLUSH PRIVILEGES ;
Expand Down
1 change: 1 addition & 0 deletions 8.0/docker-entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -165,6 +165,7 @@ if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then

ALTER USER 'root'@'localhost' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ;
GRANT ALL ON *.* TO 'root'@'localhost' WITH GRANT OPTION ;
FLUSH PRIVILEGES ;
${rootCreate}
DROP DATABASE IF EXISTS test ;
FLUSH PRIVILEGES ;
Expand Down