1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
|
From 2ea0c033b0c60f825b212157352d75c7a803e274 Mon Sep 17 00:00:00 2001
From: Christian Hesse <mail@eworm.de>
Date: Wed, 19 Feb 2020 13:10:17 +0100
Subject: [PATCH 1/5] service: enable PrivateTmp for a little bit more security
---
support-files/mariadb.service.in | 2 +-
support-files/mariadb@.service.in | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/support-files/mariadb.service.in b/support-files/mariadb.service.in
index a18716fc856..66b9921816a 100644
--- a/support-files/mariadb.service.in
+++ b/support-files/mariadb.service.in
@@ -122,7 +122,7 @@ UMask=007
# If you don't use the /tmp directory for SELECT ... OUTFILE and
# LOAD DATA INFILE you can enable PrivateTmp=true for a little more security.
-PrivateTmp=false
+PrivateTmp=true
# Set an explicit Start and Stop timeout of 900 seconds (15 minutes!)
# this is the same value as used in SysV init scripts in the past
diff --git a/support-files/mariadb@.service.in b/support-files/mariadb@.service.in
index b2b90ab7f81..df3900491d8 100644
--- a/support-files/mariadb@.service.in
+++ b/support-files/mariadb@.service.in
@@ -240,7 +240,7 @@ UMask=007
# If you don't use the /tmp directory for SELECT ... OUTFILE and
# LOAD DATA INFILE you can enable PrivateTmp=true for a little more security.
-PrivateTmp=false
+PrivateTmp=true
# Set an explicit Start and Stop timeout of 900 seconds (15 minutes!)
# this is the same value as used in SysV init scripts in the past
From e304475ba97cac2c126a4bdf7b94689724e921a2 Mon Sep 17 00:00:00 2001
From: Christian Hesse <mail@eworm.de>
Date: Wed, 19 Feb 2020 13:10:46 +0100
Subject: [PATCH 2/5] service: force preloading jemalloc for memory management
---
support-files/mariadb.service.in | 1 +
support-files/mariadb@.service.in | 1 +
2 files changed, 2 insertions(+)
diff --git a/support-files/mariadb.service.in b/support-files/mariadb.service.in
index 66b9921816a..a88752662a3 100644
--- a/support-files/mariadb.service.in
+++ b/support-files/mariadb.service.in
@@ -158,6 +158,7 @@ LimitNOFILE=32768
# Library substitutions. previously [mysqld_safe] malloc-lib with explicit paths
# (in LD_LIBRARY_PATH) and library name (in LD_PRELOAD).
# Environment="LD_LIBRARY_PATH=/path1 /path2" "LD_PRELOAD="
+Environment="LD_PRELOAD=/usr/lib/libjemalloc.so"
# Flush caches. previously [mysqld_safe] flush-caches=1
# ExecStartPre=sync
diff --git a/support-files/mariadb@.service.in b/support-files/mariadb@.service.in
index df3900491d8..e67ffc725b8 100644
--- a/support-files/mariadb@.service.in
+++ b/support-files/mariadb@.service.in
@@ -287,6 +287,7 @@ LimitNOFILE=32768
# Library substitutions. previously [mysqld_safe] malloc-lib with explicit paths
# (in LD_LIBRARY_PATH) and library name (in LD_PRELOAD).
# Environment="LD_LIBRARY_PATH=/path1 /path2" "LD_PRELOAD="
+Environment="LD_PRELOAD=/usr/lib/libjemalloc.so"
# Flush caches. previously [mysqld_safe] flush-caches=1
# ExecStartPre=sync
From 8e29feef2f5c8fd48dbbd738784e504cba02c950 Mon Sep 17 00:00:00 2001
From: Christian Hesse <mail@eworm.de>
Date: Wed, 19 Feb 2020 13:11:31 +0100
Subject: [PATCH 3/5] tmpfiles: create MYSQL_DATADIR
This is a no-op if the directory exists, but makes sure it is created by
systemd-tmpfiles with proper permissions otherwise.
This solves packaging issues when the user MYSQLD_USER is created by
systemd-sysusers and uid is not known in advance.
Also this now sets the No_COW attribute.
---
support-files/tmpfiles.conf.in | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/support-files/tmpfiles.conf.in b/support-files/tmpfiles.conf.in
index e41585c08a8..d28ff43d0d9 100644
--- a/support-files/tmpfiles.conf.in
+++ b/support-files/tmpfiles.conf.in
@@ -7,6 +7,10 @@
# * innodb_temp_data_file_path
# * rocksdb_tmpdir
# etc.
-# It shouldn't be used for datadir which is why it
-# may be disabled.
@DISABLE_MYSQL_UNIX_ADDRDIR@d @MYSQL_UNIX_ADDRDIR@ 0755 @MYSQLD_USER@ root -
+
+# Create the data directory
+# Upstream thinks this is a bad idea, mainly because the mechanism has "tmp"
+# in its name. We do it anyway - no-op if exists, and works just fine. :)
+d @MYSQL_DATADIR@ 0700 @MYSQLD_USER@ @MYSQLD_USER@ -
+h @MYSQL_DATADIR@ - - - - +C
From c84b97b4d1a9b37784bb631dbba2b4acfdf65eb7 Mon Sep 17 00:00:00 2001
From: Christian Hesse <mail@eworm.de>
Date: Wed, 1 Jan 2025 22:30:45 +0100
Subject: [PATCH 4/5] sysusers: create a fully locked system account
https://github.com/systemd/systemd/blob/v257/NEWS#L767-L777
https://www.freedesktop.org/software/systemd/man/latest/sysusers.d.html#u
---
support-files/sysusers.conf.in | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/support-files/sysusers.conf.in b/support-files/sysusers.conf.in
index a975b29476a..e2d1608bc6e 100644
--- a/support-files/sysusers.conf.in
+++ b/support-files/sysusers.conf.in
@@ -1 +1 @@
-u @MYSQLD_USER@ - "MariaDB" @MYSQL_DATADIR@
+u! @MYSQLD_USER@ - "MariaDB" @MYSQL_DATADIR@
From 2df22e4dbac2be8b3b2a033412cb5d7548cdc926 Mon Sep 17 00:00:00 2001
From: Christian Hesse <mail@eworm.de>
Date: Mon, 18 May 2026 13:20:26 +0200
Subject: [PATCH 5/5] scripts: make aware of being a package
---
scripts/mysql_install_db.sh | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/scripts/mysql_install_db.sh b/scripts/mysql_install_db.sh
index 5049e833e92..5ce1886f22e 100644
--- a/scripts/mysql_install_db.sh
+++ b/scripts/mysql_install_db.sh
@@ -35,7 +35,7 @@ silent_startup="--silent-startup"
log_error=""
force=0
-in_rpm=0
+in_rpm=1
ip_only=0
cross_bootstrap=0
do_resolve=0
|