Skip to content

Commit dc23407

Browse files
author
Daniel Blanchard
committed
WL#12445 Improve Windows named pipe access control
Limit default permissions granted to Everyone on the named pipe, introduce a new system variable/command line option named_pipe_full_access_group defaulted to 'everyone' to allow users of older clients to continue to access the named pipe. RB: rb#21000
1 parent fd229c0 commit dc23407

18 files changed

+578
-107
lines changed

‎mysql-test/r/mysqld--help-win.result

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -371,6 +371,9 @@ The following options may be given as the first argument:
371371
NULLS_EQUAL (emulate 4.0 behavior), and NULLS_IGNORED
372372
--myisam-use-mmap Use memory mapping for reading and writing MyISAM tables
373373
--named-pipe Enable the named pipe (NT)
374+
--named-pipe-full-access-group=name
375+
Name of Windows group granted full access to the named
376+
pipe
374377
--net-buffer-length=#
375378
Buffer length for TCP/IP and socket communication
376379
--net-read-timeout=#
@@ -873,6 +876,7 @@ myisam-sort-buffer-size 8388608
873876
myisam-stats-method nulls_unequal
874877
myisam-use-mmap FALSE
875878
named-pipe FALSE
879+
named-pipe-full-access-group everyone
876880
net-buffer-length 16384
877881
net-read-timeout 30
878882
net-retry-count 10

‎mysql-test/suite/perfschema/include/binlog_common.inc

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,8 @@ select count(*) > 0 from performance_schema.setup_instruments;
1010
# to ensure the expected output in the binlog is predictable.
1111
update performance_schema.setup_instruments set enabled='NO'
1212
where name like "wait/synch/rwlock/sql/%"
13-
and name not in ("wait/synch/rwlock/sql/CRYPTO_dynlock_value::lock");
13+
and name not in ("wait/synch/rwlock/sql/CRYPTO_dynlock_value::lock",
14+
"wait/synch/rwlock/sql/LOCK_named_pipe_full_access_group");
1415

1516
select count(*) > 0 from performance_schema.events_waits_current;
1617

@@ -28,14 +29,16 @@ insert into test.t1
2829
insert into test.t2
2930
select name from performance_schema.setup_instruments
3031
where name like "wait/synch/rwlock/sql/%"
31-
and name not in ("wait/synch/rwlock/sql/CRYPTO_dynlock_value::lock");
32+
and name not in ("wait/synch/rwlock/sql/CRYPTO_dynlock_value::lock",
33+
"wait/synch/rwlock/sql/LOCK_named_pipe_full_access_group");
3234

3335
drop table test.t1;
3436
drop table test.t2;
3537

3638
update performance_schema.setup_instruments set enabled='YES'
3739
where name like "wait/synch/rwlock/sql/%"
38-
and name not in ("wait/synch/rwlock/sql/CRYPTO_dynlock_value::lock");
40+
and name not in ("wait/synch/rwlock/sql/CRYPTO_dynlock_value::lock",
41+
"wait/synch/rwlock/sql/LOCK_named_pipe_full_access_group");
3942

4043
--source include/show_binlog_events.inc
4144

‎mysql-test/suite/perfschema/r/binlog_mix.result

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,8 @@ count(*) > 0
55
1
66
update performance_schema.setup_instruments set enabled='NO'
77
where name like "wait/synch/rwlock/sql/%"
8-
and name not in ("wait/synch/rwlock/sql/CRYPTO_dynlock_value::lock");
8+
and name not in ("wait/synch/rwlock/sql/CRYPTO_dynlock_value::lock",
9+
"wait/synch/rwlock/sql/LOCK_named_pipe_full_access_group");
910
select count(*) > 0 from performance_schema.events_waits_current;
1011
count(*) > 0
1112
1
@@ -18,12 +19,14 @@ select thread_id from performance_schema.events_waits_current;
1819
insert into test.t2
1920
select name from performance_schema.setup_instruments
2021
where name like "wait/synch/rwlock/sql/%"
21-
and name not in ("wait/synch/rwlock/sql/CRYPTO_dynlock_value::lock");
22+
and name not in ("wait/synch/rwlock/sql/CRYPTO_dynlock_value::lock",
23+
"wait/synch/rwlock/sql/LOCK_named_pipe_full_access_group");
2224
drop table test.t1;
2325
drop table test.t2;
2426
update performance_schema.setup_instruments set enabled='YES'
2527
where name like "wait/synch/rwlock/sql/%"
26-
and name not in ("wait/synch/rwlock/sql/CRYPTO_dynlock_value::lock");
28+
and name not in ("wait/synch/rwlock/sql/CRYPTO_dynlock_value::lock",
29+
"wait/synch/rwlock/sql/LOCK_named_pipe_full_access_group");
2730
show binlog events from <binlog_start>;
2831
Log_name Pos Event_type Server_id End_log_pos Info
2932
master-bin.000001 # Query # # BEGIN

‎mysql-test/suite/perfschema/r/binlog_row.result

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,8 @@ count(*) > 0
55
1
66
update performance_schema.setup_instruments set enabled='NO'
77
where name like "wait/synch/rwlock/sql/%"
8-
and name not in ("wait/synch/rwlock/sql/CRYPTO_dynlock_value::lock");
8+
and name not in ("wait/synch/rwlock/sql/CRYPTO_dynlock_value::lock",
9+
"wait/synch/rwlock/sql/LOCK_named_pipe_full_access_group");
910
select count(*) > 0 from performance_schema.events_waits_current;
1011
count(*) > 0
1112
1
@@ -18,12 +19,14 @@ select thread_id from performance_schema.events_waits_current;
1819
insert into test.t2
1920
select name from performance_schema.setup_instruments
2021
where name like "wait/synch/rwlock/sql/%"
21-
and name not in ("wait/synch/rwlock/sql/CRYPTO_dynlock_value::lock");
22+
and name not in ("wait/synch/rwlock/sql/CRYPTO_dynlock_value::lock",
23+
"wait/synch/rwlock/sql/LOCK_named_pipe_full_access_group");
2224
drop table test.t1;
2325
drop table test.t2;
2426
update performance_schema.setup_instruments set enabled='YES'
2527
where name like "wait/synch/rwlock/sql/%"
26-
and name not in ("wait/synch/rwlock/sql/CRYPTO_dynlock_value::lock");
28+
and name not in ("wait/synch/rwlock/sql/CRYPTO_dynlock_value::lock",
29+
"wait/synch/rwlock/sql/LOCK_named_pipe_full_access_group");
2730
show binlog events from <binlog_start>;
2831
Log_name Pos Event_type Server_id End_log_pos Info
2932
master-bin.000001 # Query # # BEGIN

‎mysql-test/suite/perfschema/r/binlog_stmt.result

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,8 @@ count(*) > 0
66
1
77
update performance_schema.setup_instruments set enabled='NO'
88
where name like "wait/synch/rwlock/sql/%"
9-
and name not in ("wait/synch/rwlock/sql/CRYPTO_dynlock_value::lock");
9+
and name not in ("wait/synch/rwlock/sql/CRYPTO_dynlock_value::lock",
10+
"wait/synch/rwlock/sql/LOCK_named_pipe_full_access_group");
1011
Warnings:
1112
Note 1592 Unsafe statement written to the binary log using statement format since BINLOG_FORMAT = STATEMENT. The statement is unsafe because it uses the general log, slow query log, or performance_schema table(s). This is unsafe because system tables may differ on slaves.
1213
select count(*) > 0 from performance_schema.events_waits_current;
@@ -23,22 +24,25 @@ Note 1592 Unsafe statement written to the binary log using statement format sinc
2324
insert into test.t2
2425
select name from performance_schema.setup_instruments
2526
where name like "wait/synch/rwlock/sql/%"
26-
and name not in ("wait/synch/rwlock/sql/CRYPTO_dynlock_value::lock");
27+
and name not in ("wait/synch/rwlock/sql/CRYPTO_dynlock_value::lock",
28+
"wait/synch/rwlock/sql/LOCK_named_pipe_full_access_group");
2729
Warnings:
2830
Note 1592 Unsafe statement written to the binary log using statement format since BINLOG_FORMAT = STATEMENT. The statement is unsafe because it uses the general log, slow query log, or performance_schema table(s). This is unsafe because system tables may differ on slaves.
2931
drop table test.t1;
3032
drop table test.t2;
3133
update performance_schema.setup_instruments set enabled='YES'
3234
where name like "wait/synch/rwlock/sql/%"
33-
and name not in ("wait/synch/rwlock/sql/CRYPTO_dynlock_value::lock");
35+
and name not in ("wait/synch/rwlock/sql/CRYPTO_dynlock_value::lock",
36+
"wait/synch/rwlock/sql/LOCK_named_pipe_full_access_group");
3437
Warnings:
3538
Note 1592 Unsafe statement written to the binary log using statement format since BINLOG_FORMAT = STATEMENT. The statement is unsafe because it uses the general log, slow query log, or performance_schema table(s). This is unsafe because system tables may differ on slaves.
3639
show binlog events from <binlog_start>;
3740
Log_name Pos Event_type Server_id End_log_pos Info
3841
master-bin.000001 # Query # # BEGIN
3942
master-bin.000001 # Query # # use `test`; update performance_schema.setup_instruments set enabled='NO'
4043
where name like "wait/synch/rwlock/sql/%"
41-
and name not in ("wait/synch/rwlock/sql/CRYPTO_dynlock_value::lock")
44+
and name not in ("wait/synch/rwlock/sql/CRYPTO_dynlock_value::lock",
45+
"wait/synch/rwlock/sql/LOCK_named_pipe_full_access_group")
4246
master-bin.000001 # Query # # COMMIT
4347
master-bin.000001 # Query # # use `test`; DROP TABLE IF EXISTS `t1` /* generated by server */
4448
master-bin.000001 # Query # # use `test`; DROP TABLE IF EXISTS `t2` /* generated by server */
@@ -52,12 +56,14 @@ master-bin.000001 # Query # # BEGIN
5256
master-bin.000001 # Query # # use `test`; insert into test.t2
5357
select name from performance_schema.setup_instruments
5458
where name like "wait/synch/rwlock/sql/%"
55-
and name not in ("wait/synch/rwlock/sql/CRYPTO_dynlock_value::lock")
59+
and name not in ("wait/synch/rwlock/sql/CRYPTO_dynlock_value::lock",
60+
"wait/synch/rwlock/sql/LOCK_named_pipe_full_access_group")
5661
master-bin.000001 # Query # # COMMIT
5762
master-bin.000001 # Query # # use `test`; DROP TABLE `t1` /* generated by server */
5863
master-bin.000001 # Query # # use `test`; DROP TABLE `t2` /* generated by server */
5964
master-bin.000001 # Query # # BEGIN
6065
master-bin.000001 # Query # # use `test`; update performance_schema.setup_instruments set enabled='YES'
6166
where name like "wait/synch/rwlock/sql/%"
62-
and name not in ("wait/synch/rwlock/sql/CRYPTO_dynlock_value::lock")
67+
and name not in ("wait/synch/rwlock/sql/CRYPTO_dynlock_value::lock",
68+
"wait/synch/rwlock/sql/LOCK_named_pipe_full_access_group")
6369
master-bin.000001 # Query # # COMMIT

‎mysql-test/suite/perfschema/r/dml_setup_instruments.result

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,9 @@ wait/synch/mutex/sql/LOCK_crypt YES YES
1616
wait/synch/mutex/sql/LOCK_delayed_create YES YES
1717
select * from performance_schema.setup_instruments
1818
where name like 'Wait/Synch/Rwlock/sql/%'
19-
and name not in ('wait/synch/rwlock/sql/CRYPTO_dynlock_value::lock')
19+
and name not in (
20+
'wait/synch/rwlock/sql/CRYPTO_dynlock_value::lock',
21+
'wait/synch/rwlock/sql/LOCK_named_pipe_full_access_group')
2022
order by name limit 10;
2123
NAME ENABLED TIMED
2224
wait/synch/rwlock/sql/LOCK_dboptions YES YES

‎mysql-test/suite/perfschema/t/dml_setup_instruments.test

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,9 @@ select * from performance_schema.setup_instruments
2525

2626
select * from performance_schema.setup_instruments
2727
where name like 'Wait/Synch/Rwlock/sql/%'
28-
and name not in ('wait/synch/rwlock/sql/CRYPTO_dynlock_value::lock')
28+
and name not in (
29+
'wait/synch/rwlock/sql/CRYPTO_dynlock_value::lock',
30+
'wait/synch/rwlock/sql/LOCK_named_pipe_full_access_group')
2931
order by name limit 10;
3032

3133
# COND_handler_count is dependent on the build (Windows only)

‎mysql-test/suite/sys_vars/r/named_pipe_full_access_group_basic.result

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
select @@global.named_pipe_full_access_group;
2+
@@global.named_pipe_full_access_group
3+
everyone
4+
select @@session.named_pipe_full_access_group;
5+
ERROR HY000: Variable 'named_pipe_full_access_group' is a GLOBAL variable
6+
show global variables like 'named_pipe_full_access_group';
7+
Variable_name Value
8+
named_pipe_full_access_group everyone
9+
show session variables like 'named_pipe_full_access_group';
10+
Variable_name Value
11+
named_pipe_full_access_group everyone
12+
select * from information_schema.global_variables where variable_name='named_pipe_full_access_group';
13+
VARIABLE_NAME VARIABLE_VALUE
14+
NAMED_PIPE_FULL_ACCESS_GROUP everyone
15+
select * from information_schema.session_variables where variable_name='named_pipe_full_access_group';
16+
VARIABLE_NAME VARIABLE_VALUE
17+
NAMED_PIPE_FULL_ACCESS_GROUP everyone

‎mysql-test/suite/sys_vars/t/named_pipe_full_access_group_basic.test

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
--source include/windows.inc
2+
--source include/not_embedded.inc
3+
#
4+
# only global
5+
#
6+
select @@global.named_pipe_full_access_group;
7+
--error ER_INCORRECT_GLOBAL_LOCAL_VAR
8+
select @@session.named_pipe_full_access_group;
9+
show global variables like 'named_pipe_full_access_group';
10+
show session variables like 'named_pipe_full_access_group';
11+
--disable_warnings
12+
select * from information_schema.global_variables where variable_name='named_pipe_full_access_group';
13+
select * from information_schema.session_variables where variable_name='named_pipe_full_access_group';
14+
--enable_warnings
15+

‎mysys/my_windac.c

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* Copyright (c) 2000, 2010, Oracle and/or its affiliates. All rights reserved.
1+
/* Copyright (c) 2000, 2018, Oracle and/or its affiliates. All rights reserved.
22
33
This program is free software; you can redistribute it and/or modify
44
it under the terms of the GNU General Public License as published by
@@ -214,6 +214,22 @@ void my_security_attr_free(SECURITY_ATTRIBUTES *sa)
214214
{
215215
My_security_attr *attr= (My_security_attr*)
216216
(((char*)sa) + ALIGN_SIZE(sizeof(*sa)));
217+
218+
PACL dacl_from_descriptor= NULL;
219+
BOOL dacl_present_in_descriptor= FALSE;
220+
BOOL dacl_defaulted= FALSE;
221+
// If the DACL in the descriptor is not the same as that in the
222+
// My_security_attr, it will have been created by a call to SetEntriesInAcl
223+
// and thus must be freed by a call to LocalFree.
224+
if (GetSecurityDescriptorDacl(sa->lpSecurityDescriptor,
225+
&dacl_present_in_descriptor,
226+
&dacl_from_descriptor, &dacl_defaulted) &&
227+
dacl_present_in_descriptor && !dacl_defaulted &&
228+
attr->dacl != dacl_from_descriptor)
229+
{
230+
LocalFree(dacl_from_descriptor);
231+
}
232+
217233
FreeSid(attr->everyone_sid);
218234
my_free(attr->dacl);
219235
my_free(sa);

‎sql-common/client.c

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -429,12 +429,13 @@ HANDLE create_named_pipe(MYSQL *mysql, uint connect_timeout, char **arg_host,
429429
for (i=0 ; i < 100 ; i++) /* Don't retry forever */
430430
{
431431
if ((hPipe = CreateFile(pipe_name,
432-
GENERIC_READ | GENERIC_WRITE,
433-
0,
434-
NULL,
435-
OPEN_EXISTING,
436-
FILE_FLAG_OVERLAPPED,
437-
NULL )) != INVALID_HANDLE_VALUE)
432+
FILE_READ_ATTRIBUTES | FILE_READ_DATA |
433+
FILE_WRITE_ATTRIBUTES | FILE_WRITE_DATA,
434+
0,
435+
NULL,
436+
OPEN_EXISTING,
437+
FILE_FLAG_OVERLAPPED,
438+
NULL )) != INVALID_HANDLE_VALUE)
438439
break;
439440
if (GetLastError() != ERROR_PIPE_BUSY)
440441
{

‎sql/CMakeLists.txt

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,11 @@ SET (SQL_SOURCE
8282
${CONF_SOURCES}
8383
${MYSYS_LIBWRAP_SOURCE})
8484

85+
IF(WIN32)
86+
LIST(APPEND SQL_SOURCE named_pipe.cc)
87+
ENDIF()
88+
89+
8590
# These files have unused result errors, so we skip Werror
8691
CHECK_C_COMPILER_FLAG("-Werror" HAVE_WERROR_FLAG)
8792
IF(HAVE_WERROR_FLAG)

0 commit comments

Comments
 (0)