diff --git a/SOURCES/CVE-2025-13699.patch b/SOURCES/CVE-2025-13699.patch new file mode 100644 index 0000000..b9d1bd1 --- /dev/null +++ b/SOURCES/CVE-2025-13699.patch @@ -0,0 +1,207 @@ +diff --git a/client/mysqldump.c b/client/mysqldump.c +index e7264c07..7a019f97 100644 +--- a/client/mysqldump.c ++++ b/client/mysqldump.c +@@ -1811,6 +1811,26 @@ static char *cover_definer_clause(const char *stmt_str, + return query_str; + } + ++ ++static const char* build_path_for_table(char *to, const char *dir, ++ const char *table, const char *ext) ++{ ++ char filename[FN_REFLEN], tmp_path[FN_REFLEN]; ++ convert_dirname(tmp_path, path, NULL); ++ my_load_path(tmp_path, tmp_path, NULL); ++ if (check_if_legal_tablename(table)) ++ strxnmov(filename, sizeof(filename) - 1, table, "@@@", NULL); ++ else ++ { ++ uint errors, len; ++ len= my_convert(filename, sizeof(filename) - 1, &my_charset_filename, ++ table, (uint32)strlen(table), charset_info, &errors); ++ filename[len]= 0; ++ } ++ return fn_format(to, filename, tmp_path, ext, MYF(MY_UNPACK_FILENAME)); ++} ++ ++ + /* + Open a new .sql file to dump the table or view into + +@@ -1825,12 +1845,9 @@ static char *cover_definer_clause(const char *stmt_str, + */ + static FILE* open_sql_file_for_table(const char* table, int flags) + { +- FILE* res; +- char filename[FN_REFLEN], tmp_path[FN_REFLEN]; +- convert_dirname(tmp_path,path,NullS); +- res= my_fopen(fn_format(filename, table, tmp_path, ".sql", 4), +- flags, MYF(MY_WME)); +- return res; ++ char filename[FN_REFLEN]; ++ return my_fopen(build_path_for_table(filename, path, table, ".sql"), ++ flags, MYF(MY_WME)); + } + + +@@ -4017,15 +4034,9 @@ static void dump_table(const char *table, const char *db, const uchar *hash_key, + + if (path) + { +- char filename[FN_REFLEN], tmp_path[FN_REFLEN]; ++ char filename[FN_REFLEN]; + +- /* +- Convert the path to native os format +- and resolve to the full filepath. +- */ +- convert_dirname(tmp_path,path,NullS); +- my_load_path(tmp_path, tmp_path, NULL); +- fn_format(filename, table, tmp_path, ".txt", MYF(MY_UNPACK_FILENAME)); ++ build_path_for_table(filename, path, table, ".txt"); + + /* Must delete the file that 'INTO OUTFILE' will write to */ + my_delete(filename, MYF(0)); +@@ -4034,7 +4045,6 @@ static void dump_table(const char *table, const char *db, const uchar *hash_key, + to_unix_path(filename); + + /* now build the query string */ +- + dynstr_append_checked(&query_string, "SELECT /*!40001 SQL_NO_CACHE */ "); + dynstr_append_checked(&query_string, select_field_names.str); + dynstr_append_checked(&query_string, " INTO OUTFILE '"); +diff --git a/client/mysqlimport.c b/client/mysqlimport.c +index 687fd8c2..402affcf 100644 +--- a/client/mysqlimport.c ++++ b/client/mysqlimport.c +@@ -317,7 +317,17 @@ static int write_to_table(char *filename, MYSQL *mysql) + DBUG_ENTER("write_to_table"); + DBUG_PRINT("enter",("filename: %s",filename)); + +- fn_format(tablename, filename, "", "", 1 | 2); /* removes path & ext. */ ++ fn_format(tablename, filename, "", "", MYF(MY_REPLACE_DIR | MY_REPLACE_EXT)); ++ if (strchr(tablename, '@')) ++ { ++ uint errors, len; ++ CHARSET_INFO *cs= ++ get_charset_by_csname(default_charset, MY_CS_PRIMARY, MYF(0)); ++ len= my_convert(escaped_name, sizeof(escaped_name) - 1, cs, tablename, ++ (uint32)strlen(tablename), &my_charset_filename, &errors); ++ if (!errors) ++ strmake(tablename, escaped_name, len); ++ } + if (!opt_local_file) + strmov(hard_path,filename); + else +@@ -466,7 +476,7 @@ static MYSQL *db_connect(char *host, char *database, + mysql_options(mysql, MYSQL_DEFAULT_AUTH, opt_default_auth); + if (!strcmp(default_charset,MYSQL_AUTODETECT_CHARSET_NAME)) + default_charset= (char *)my_default_csname(); +- mysql_options(mysql, MYSQL_SET_CHARSET_NAME, my_default_csname()); ++ mysql_options(mysql, MYSQL_SET_CHARSET_NAME, default_charset); + mysql_options(mysql, MYSQL_OPT_CONNECT_ATTR_RESET, 0); + mysql_options4(mysql, MYSQL_OPT_CONNECT_ATTR_ADD, + "program_name", "mysqlimport"); +diff --git a/mysql-test/main/mysqldump.result b/mysql-test/main/mysqldump.result +index 8e8e342d..4a9c1b50 100644 +--- a/mysql-test/main/mysqldump.result ++++ b/mysql-test/main/mysqldump.result +@@ -6624,3 +6624,48 @@ SET character_set_client = @saved_cs_client; + drop view `v'1"2`; + drop table t1; + # End of 10.5 tests ++# ++# MDEV-37483 mariadb-dump -T doesn't convert table names ++# ++create database foo; ++use foo; ++create table `con_schöne_grüße` (a int) select 1 as a; ++create table `con` (b int) select 2 as b; ++create table `con/bar` (c int) select 3 as c; ++create table `con@fame` (d int) select 4 as d; ++drop database foo; ++use test; ++con@002fbar.sql ++con@002fbar.txt ++con@@@.sql ++con@@@.txt ++con@fame.sql ++con@fame.txt ++con_sch@1ine_gr@1o@1je.sql ++con_sch@1ine_gr@1o@1je.txt ++show tables; ++Tables_in_test ++con ++con/bar ++con@fame ++con_schöne_grüße ++test.con: Records: 1 Deleted: 0 Skipped: 0 Warnings: 0 ++test.con/bar: Records: 1 Deleted: 0 Skipped: 0 Warnings: 0 ++test.con@fame: Records: 1 Deleted: 0 Skipped: 0 Warnings: 0 ++select * from `con_schöne_grüße`; ++a ++1 ++select * from `con`; ++b ++2 ++select * from `con/bar`; ++c ++3 ++select * from `con@fame`; ++d ++4 ++drop table `con_schöne_grüße`; ++drop table `con`; ++drop table `con/bar`; ++drop table `con@fame`; ++# End of 10.6 tests +diff --git a/mysql-test/main/mysqldump.test b/mysql-test/main/mysqldump.test +index 58790c15..6dc3eff5 100644 +--- a/mysql-test/main/mysqldump.test ++++ b/mysql-test/main/mysqldump.test +@@ -3033,3 +3033,44 @@ drop view `v'1"2`; # "' + drop table t1; + + --echo # End of 10.5 tests ++ ++--echo # ++--echo # MDEV-37483 mariadb-dump -T doesn't convert table names ++--echo # ++create database foo; ++use foo; ++ ++create table `con_schöne_grüße` (a int) select 1 as a; ++create table `con` (b int) select 2 as b; ++create table `con/bar` (c int) select 3 as c; ++create table `con@fame` (d int) select 4 as d; ++exec $MYSQL_DUMP foo --tab $MYSQLTEST_VARDIR/tmp; ++drop database foo; ++use test; ++move_file $MYSQLTEST_VARDIR/tmp/con@0040fame.sql $MYSQLTEST_VARDIR/tmp/con@fame.sql; ++move_file $MYSQLTEST_VARDIR/tmp/con@0040fame.txt $MYSQLTEST_VARDIR/tmp/con@fame.txt; ++list_files $MYSQLTEST_VARDIR/tmp con*; ++exec $MYSQL test < $MYSQLTEST_VARDIR/tmp/con@@@.sql; ++exec $MYSQL test < $MYSQLTEST_VARDIR/tmp/con@002fbar.sql; ++exec $MYSQL test < $MYSQLTEST_VARDIR/tmp/con_sch@1ine_gr@1o@1je.sql; ++exec $MYSQL test < $MYSQLTEST_VARDIR/tmp/con@fame.sql; ++show tables; ++exec $MYSQL_IMPORT test $MYSQLTEST_VARDIR/tmp/con@@@.txt; ++exec $MYSQL_IMPORT test $MYSQLTEST_VARDIR/tmp/con@002fbar.txt; ++if (`select @@version like '10.6.%'`) { ++# utf8 console output on Windows is fixed in MDEV-26713, until then ++--disable_result_log ++} ++exec $MYSQL_IMPORT --default-character-set=utf8mb4 test $MYSQLTEST_VARDIR/tmp/con_sch@1ine_gr@1o@1je.txt; ++--enable_result_log ++exec $MYSQL_IMPORT test $MYSQLTEST_VARDIR/tmp/con@fame.txt; ++select * from `con_schöne_grüße`; ++select * from `con`; ++select * from `con/bar`; ++select * from `con@fame`; ++drop table `con_schöne_grüße`; ++drop table `con`; ++drop table `con/bar`; ++drop table `con@fame`; ++ ++--echo # End of 10.6 tests diff --git a/SOURCES/mariadb-mdev-37899-selinux-avc.patch b/SOURCES/mariadb-mdev-37899-selinux-avc.patch new file mode 100644 index 0000000..f9286b0 --- /dev/null +++ b/SOURCES/mariadb-mdev-37899-selinux-avc.patch @@ -0,0 +1,78 @@ +From 5a8cd03f0f3ae9fbcc3b6f33843d030d840f6e2f Mon Sep 17 00:00:00 2001 +From: Daniel Black +Date: Mon, 20 Oct 2025 18:45:56 +1100 +Subject: [PATCH] MDEV-37899 galera sst generates numerous selinux AVCs when + starting + +From downstream bug RHEL-116757, the use of ss to map all the +usage of ports to pids and process names under selinux is rather +limited by the mysqld_exec_t limitations. + +The checking of the mapping is a bit excessive in a selinux +environment where binding is limited. + +We replace the use of ss under selinux to raw reading of the +/proc/tcp{,} interfaces of the linux that aren't selinux restricted. +--- + scripts/wsrep_sst_common.sh | 13 ++++++++++++- + scripts/wsrep_sst_rsync.sh | 9 +++++++-- + 2 files changed, 19 insertions(+), 3 deletions(-) + +diff --git a/scripts/wsrep_sst_common.sh b/scripts/wsrep_sst_common.sh +index f23707c497acd..db6415b5d1e3a 100644 +--- a/scripts/wsrep_sst_common.sh ++++ b/scripts/wsrep_sst_common.sh +@@ -1230,6 +1230,13 @@ check_sockets_utils() + lsof_available=0 + sockstat_available=0 + ss_available=0 ++ raw_socket_check=0 ++ ++ if [ -n "$(commandex selinuxenabled)" ] && selinuxenabled; then ++ raw_socket_check=1 ++ wsrep_log_info "/proc/net/tcp{,6} is being used directly to avoid excessive selinux AVC notices" ++ return 0 ++ fi + + socket_utility="$(commandex ss)" + if [ -n "$socket_utility" ]; then +@@ -1298,7 +1305,11 @@ check_port() + + local rc=2 # ENOENT + +- if [ $ss_available -ne 0 ]; then ++ if [ $raw_socket_check -ne 0 ]; then ++ for key in $(awk -v p="$port" 'BEGIN { hex_port = sprintf(":%04X", p) } $2 ~ hex_port && $4 == "0A" { print $10 }' /proc/net/tcp /proc/net/tcp6); do ++ return 0 ++ done ++ elif [ $ss_available -ne 0 ]; then + $socket_utility $ss_opts -t "( sport = :$port )" 2>/dev/null | \ + grep -q -E "[[:space:]]users:[[:space:]]?\\(.*\\(\"($utils)[^[:space:]]*\"[^)]*,pid=$pid(,[^)]*)?\\)" && rc=0 + elif [ $sockstat_available -ne 0 ]; then +diff --git a/scripts/wsrep_sst_rsync.sh b/scripts/wsrep_sst_rsync.sh +index 361cef4a9fc67..5b7efbf3b60d9 100644 +--- a/scripts/wsrep_sst_rsync.sh ++++ b/scripts/wsrep_sst_rsync.sh +@@ -105,7 +105,9 @@ check_pid_and_port() + local final + + if ! check_port $pid "$port" "$utils"; then +- if [ $ss_available -ne 0 -o $sockstat_available -ne 0 ]; then ++ if [ $raw_socket_check -ne 0 ]; then ++ return 1 ++ elif [ $ss_available -ne 0 -o $sockstat_available -ne 0 ]; then + if [ $ss_available -ne 0 ]; then + port_info=$($socket_utility $ss_opts -t "( sport = :$port )" 2>/dev/null | \ + grep -E '[[:space:]]users:[[:space:]]?\(' | \ +@@ -163,7 +165,10 @@ check_pid_and_port() + fi + fi + +- check_pid "$pid_file" && [ $CHECK_PID -eq $pid ] ++ if [ $raw_socket_check -ne 0 ]; then ++ return 0 ++ fi ++ check_pid "$pid_file" && [ "$CHECK_PID" -eq "$pid" ] + } + + get_binlog diff --git a/SOURCES/mariadb.tmpfiles.d.in b/SOURCES/mariadb.tmpfiles.d.in index 9e6b6e8..e59968a 100644 --- a/SOURCES/mariadb.tmpfiles.d.in +++ b/SOURCES/mariadb.tmpfiles.d.in @@ -1,3 +1,8 @@ # Do not edit this file. # To override this, put /etc/tmpfiles.d/mariadb.conf instead. d @PID_FILE_DIR@ 0755 mysql mysql - + +# Rules for ephemeral file systems (ImageMode) +d /var/lib/mysql 0755 mysql mysql - +d /var/log/mariadb 0750 mysql mysql - +f /var/log/mariadb/mariadb.log 0660 mysql mysql - diff --git a/SOURCES/rh-skipped-tests-base.list b/SOURCES/rh-skipped-tests-base.list index 0ca3aa0..7d5666b 100644 --- a/SOURCES/rh-skipped-tests-base.list +++ b/SOURCES/rh-skipped-tests-base.list @@ -107,3 +107,4 @@ mariabackup.rpl_clone_slave : # Fails on 10.5.27 main.timezone : +main.alter_table_combinations : diff --git a/SPECS/mariadb.spec b/SPECS/mariadb.spec index 345c61a..93fd674 100644 --- a/SPECS/mariadb.spec +++ b/SPECS/mariadb.spec @@ -158,7 +158,7 @@ ExcludeArch: %{ix86} Name: mariadb Version: 10.5.29 -Release: 1%{?with_debug:.debug}%{?dist} +Release: 5%{?with_debug:.debug}%{?dist} Epoch: 3 Summary: A very fast and robust SQL database server @@ -226,6 +226,12 @@ Patch10: %{pkgnamepatch}-ssl-cipher-tests.patch # Patch14: make MTR port calculation reasonably predictable Patch14: %{pkgnamepatch}-mtr.patch +Patch18: CVE-2025-13699.patch + +# Patch19: avoid AVC denials during Galera SST, upstream commit +# Upstream commit: 5a8cd03f0f3ae9fbcc3b6f33843d030d840f6e2f +Patch19: %{pkgnamepatch}-mdev-37899-selinux-avc.patch + BuildRequires: make BuildRequires: cmake gcc-c++ BuildRequires: multilib-rpm-config @@ -757,6 +763,8 @@ rm -r storage/rocksdb/ # Keeping the patch commented out, need to revisit # once the test is re-enabled by upstream in some future release #%%patch10 -p1 +%patch18 -p1 +%patch19 -p1 # generate a list of tests that fail, but are not disabled by upstream cat %{SOURCE50} | tee -a mysql-test/unstable-tests @@ -777,6 +785,12 @@ cat %{SOURCE53} | tee -a mysql-test/unstable-tests cp %{SOURCE2} %{SOURCE3} %{SOURCE10} %{SOURCE11} %{SOURCE12} \ %{SOURCE14} %{SOURCE15} %{SOURCE16} %{SOURCE18} %{SOURCE70} %{SOURCE73} scripts +# Create a sysusers.d config file +# To enforce UID 27 for Image Mode +cat > support-files/sysusers.conf.in << EOF +u mysql 27 'MariaDB and MySQL Server' %{dbdatadir} - +EOF + %if %{with galera} # prepare selinux policy mkdir selinux @@ -993,9 +1007,6 @@ install -p -m 644 %{_vpath_builddir}/scripts/mariadb-scripts-common %{buildroot} # Install downstream version of tmpfiles install -D -p -m 0644 %{_vpath_builddir}/scripts/mariadb.tmpfiles.d %{buildroot}%{_tmpfilesdir}/%{name}.conf -%if 0%{?mysqld_pid_dir:1} -echo "d %{pidfiledir} 0755 mysql mysql -" >>%{buildroot}%{_tmpfilesdir}/%{name}.conf -%endif # install additional galera selinux policy %if %{with galera} @@ -1518,6 +1529,7 @@ fi %{_libexecdir}/mariadb-check-upgrade %{_libexecdir}/mariadb-scripts-common +# Remember to also update the mariadb.tmpfiles.d.in file when updating these permissions %attr(0755,mysql,mysql) %dir %{pidfiledir} %attr(0755,mysql,mysql) %dir %{dbdatadir} %attr(0750,mysql,mysql) %dir %{logfiledir} @@ -1655,6 +1667,19 @@ fi %endif %changelog +* Wed Aug 05 2026 Nikola Davidova - 3:10.5.29-5 +- Backport MDEV-37899 to prevent excessive SELinux AVC denials during Galera SST +- Resolves: INFRASERV-1809 + +* Tue Apr 28 2026 Petr Khartskhaev - 3:10.5.29-4 +- Bump release for tmpfiles.d change + +* Tue Dec 02 2025 Pavol Sloboda - 3:10.5.29-3 +- Release bump for rebuild + +* Wed Oct 01 2025 Pavol Sloboda - 3:10.5.29-2 +- Release bump for rebuild + * Mon Aug 25 2025 Pavol Sloboda - 3:10.5.29-1 - Rebase to 10.5.29