Skip to content

Commit c7cb77e

Browse files
yosifkityosifkit
committed
Add ability to change host value for root user to secure container
1 parent c207cc1 commit c7cb77e

File tree

8 files changed

+76
-12
lines changed

8 files changed

+76
-12
lines changed

‎5.5/Dockerfile

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,9 @@ RUN mkdir -p /var/lib/mysql /var/run/mysqld \
6868
# ensure that /var/run/mysqld (used for socket and lock files) is writable regardless of the UID our mysqld instance ends up having at runtime
6969
&& chmod 777 /var/run/mysqld
7070

71+
# default root to listen for connections from anywhere
72+
ENV MYSQL_ROOT_HOST %
73+
7174
VOLUME /var/lib/mysql
7275

7376
COPY docker-entrypoint.sh /usr/local/bin/

‎5.5/docker-entrypoint.sh

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -113,14 +113,27 @@ if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then
113113
export MYSQL_ROOT_PASSWORD="$(pwgen -1 32)"
114114
echo "GENERATED ROOT PASSWORD: $MYSQL_ROOT_PASSWORD"
115115
fi
116+
117+
rootCreate=
118+
file_env 'MYSQL_ROOT_HOST'
119+
if [ ! -z "$MYSQL_ROOT_HOST" -a "$MYSQL_ROOT_HOST" != 'localhost' ]; then
120+
# no, we don't care if read finds a terminating character in this heredoc
121+
# https://unix.stackexchange.com/questions/265149/why-is-set-o-errexit-breaking-this-read-heredoc-expression/265151#265151
122+
read -r -d '' rootCreate <<-EOSQL || true
123+
CREATE USER 'root'@'${MYSQL_ROOT_HOST}' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ;
124+
GRANT ALL ON *.* TO 'root'@'${MYSQL_ROOT_HOST}' WITH GRANT OPTION ;
125+
EOSQL
126+
fi
127+
116128
"${mysql[@]}" <<-EOSQL
117129
-- What's done in this file shouldn't be replicated
118130
-- or products like mysql-fabric won't work
119131
SET @@SESSION.SQL_LOG_BIN=0;
120132
121-
DELETE FROM mysql.user ;
122-
CREATE USER 'root'@'%' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ;
123-
GRANT ALL ON *.* TO 'root'@'%' WITH GRANT OPTION ;
133+
DELETE FROM mysql.user WHERE user NOT IN ('mysql.sys', 'mysqlxsys', 'root') OR host NOT IN ('localhost') ;
134+
SET PASSWORD FOR 'root'@'localhost'=PASSWORD('${MYSQL_ROOT_PASSWORD}') ;
135+
GRANT ALL ON *.* TO 'root'@'localhost' WITH GRANT OPTION ;
136+
${rootCreate}
124137
DROP DATABASE IF EXISTS test ;
125138
FLUSH PRIVILEGES ;
126139
EOSQL

‎5.6/Dockerfile

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,9 @@ RUN { \
5353
RUN sed -Ei 's/^(bind-address|log)/#&/' /etc/mysql/my.cnf \
5454
&& echo '[mysqld]\nskip-host-cache\nskip-name-resolve' > /etc/mysql/conf.d/docker.cnf
5555

56+
# default root to listen for connections from anywhere
57+
ENV MYSQL_ROOT_HOST %
58+
5659
VOLUME /var/lib/mysql
5760

5861
COPY docker-entrypoint.sh /usr/local/bin/

‎5.6/docker-entrypoint.sh

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -113,14 +113,27 @@ if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then
113113
export MYSQL_ROOT_PASSWORD="$(pwgen -1 32)"
114114
echo "GENERATED ROOT PASSWORD: $MYSQL_ROOT_PASSWORD"
115115
fi
116+
117+
rootCreate=
118+
file_env 'MYSQL_ROOT_HOST'
119+
if [ ! -z "$MYSQL_ROOT_HOST" -a "$MYSQL_ROOT_HOST" != 'localhost' ]; then
120+
# no, we don't care if read finds a terminating character in this heredoc
121+
# https://unix.stackexchange.com/questions/265149/why-is-set-o-errexit-breaking-this-read-heredoc-expression/265151#265151
122+
read -r -d '' rootCreate <<-EOSQL || true
123+
CREATE USER 'root'@'${MYSQL_ROOT_HOST}' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ;
124+
GRANT ALL ON *.* TO 'root'@'${MYSQL_ROOT_HOST}' WITH GRANT OPTION ;
125+
EOSQL
126+
fi
127+
116128
"${mysql[@]}" <<-EOSQL
117129
-- What's done in this file shouldn't be replicated
118130
-- or products like mysql-fabric won't work
119131
SET @@SESSION.SQL_LOG_BIN=0;
120132
121-
DELETE FROM mysql.user ;
122-
CREATE USER 'root'@'%' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ;
123-
GRANT ALL ON *.* TO 'root'@'%' WITH GRANT OPTION ;
133+
DELETE FROM mysql.user WHERE user NOT IN ('mysql.sys', 'mysqlxsys', 'root') OR host NOT IN ('localhost') ;
134+
SET PASSWORD FOR 'root'@'localhost'=PASSWORD('${MYSQL_ROOT_PASSWORD}') ;
135+
GRANT ALL ON *.* TO 'root'@'localhost' WITH GRANT OPTION ;
136+
${rootCreate}
124137
DROP DATABASE IF EXISTS test ;
125138
FLUSH PRIVILEGES ;
126139
EOSQL

‎5.7/Dockerfile

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,9 @@ RUN { \
5353
RUN sed -Ei 's/^(bind-address|log)/#&/' /etc/mysql/mysql.conf.d/mysqld.cnf \
5454
&& echo '[mysqld]\nskip-host-cache\nskip-name-resolve' > /etc/mysql/conf.d/docker.cnf
5555

56+
# default root to listen for connections from anywhere
57+
ENV MYSQL_ROOT_HOST %
58+
5659
VOLUME /var/lib/mysql
5760

5861
COPY docker-entrypoint.sh /usr/local/bin/

‎5.7/docker-entrypoint.sh

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -113,14 +113,27 @@ if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then
113113
export MYSQL_ROOT_PASSWORD="$(pwgen -1 32)"
114114
echo "GENERATED ROOT PASSWORD: $MYSQL_ROOT_PASSWORD"
115115
fi
116+
117+
rootCreate=
118+
file_env 'MYSQL_ROOT_HOST'
119+
if [ ! -z "$MYSQL_ROOT_HOST" -a "$MYSQL_ROOT_HOST" != 'localhost' ]; then
120+
# no, we don't care if read finds a terminating character in this heredoc
121+
# https://unix.stackexchange.com/questions/265149/why-is-set-o-errexit-breaking-this-read-heredoc-expression/265151#265151
122+
read -r -d '' rootCreate <<-EOSQL || true
123+
CREATE USER 'root'@'${MYSQL_ROOT_HOST}' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ;
124+
GRANT ALL ON *.* TO 'root'@'${MYSQL_ROOT_HOST}' WITH GRANT OPTION ;
125+
EOSQL
126+
fi
127+
116128
"${mysql[@]}" <<-EOSQL
117129
-- What's done in this file shouldn't be replicated
118130
-- or products like mysql-fabric won't work
119131
SET @@SESSION.SQL_LOG_BIN=0;
120132
121-
DELETE FROM mysql.user ;
122-
CREATE USER 'root'@'%' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ;
123-
GRANT ALL ON *.* TO 'root'@'%' WITH GRANT OPTION ;
133+
DELETE FROM mysql.user WHERE user NOT IN ('mysql.sys', 'mysqlxsys', 'root') OR host NOT IN ('localhost') ;
134+
SET PASSWORD FOR 'root'@'localhost'=PASSWORD('${MYSQL_ROOT_PASSWORD}') ;
135+
GRANT ALL ON *.* TO 'root'@'localhost' WITH GRANT OPTION ;
136+
${rootCreate}
124137
DROP DATABASE IF EXISTS test ;
125138
FLUSH PRIVILEGES ;
126139
EOSQL

‎8.0/Dockerfile

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,9 @@ RUN { \
5353
RUN sed -Ei 's/^(bind-address|log)/#&/' /etc/mysql/mysql.conf.d/mysqld.cnf \
5454
&& echo '[mysqld]\nskip-host-cache\nskip-name-resolve' > /etc/mysql/conf.d/docker.cnf
5555

56+
# default root to listen for connections from anywhere
57+
ENV MYSQL_ROOT_HOST %
58+
5659
VOLUME /var/lib/mysql
5760

5861
COPY docker-entrypoint.sh /usr/local/bin/

‎8.0/docker-entrypoint.sh

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -113,14 +113,27 @@ if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then
113113
export MYSQL_ROOT_PASSWORD="$(pwgen -1 32)"
114114
echo "GENERATED ROOT PASSWORD: $MYSQL_ROOT_PASSWORD"
115115
fi
116+
117+
rootCreate=
118+
file_env 'MYSQL_ROOT_HOST'
119+
if [ ! -z "$MYSQL_ROOT_HOST" -a "$MYSQL_ROOT_HOST" != 'localhost' ]; then
120+
# no, we don't care if read finds a terminating character in this heredoc
121+
# https://unix.stackexchange.com/questions/265149/why-is-set-o-errexit-breaking-this-read-heredoc-expression/265151#265151
122+
read -r -d '' rootCreate <<-EOSQL || true
123+
CREATE USER 'root'@'${MYSQL_ROOT_HOST}' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ;
124+
GRANT ALL ON *.* TO 'root'@'${MYSQL_ROOT_HOST}' WITH GRANT OPTION ;
125+
EOSQL
126+
fi
127+
116128
"${mysql[@]}" <<-EOSQL
117129
-- What's done in this file shouldn't be replicated
118130
-- or products like mysql-fabric won't work
119131
SET @@SESSION.SQL_LOG_BIN=0;
120132
121-
DELETE FROM mysql.user ;
122-
CREATE USER 'root'@'%' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ;
123-
GRANT ALL ON *.* TO 'root'@'%' WITH GRANT OPTION ;
133+
DELETE FROM mysql.user WHERE user NOT IN ('mysql.sys', 'mysqlxsys', 'root') OR host NOT IN ('localhost') ;
134+
SET PASSWORD FOR 'root'@'localhost'=PASSWORD('${MYSQL_ROOT_PASSWORD}') ;
135+
GRANT ALL ON *.* TO 'root'@'localhost' WITH GRANT OPTION ;
136+
${rootCreate}
124137
DROP DATABASE IF EXISTS test ;
125138
FLUSH PRIVILEGES ;
126139
EOSQL

0 commit comments

Comments
 (0)