1

The data-dir itself has permissions 700 thereby limiting access to the mysql user.

I want other folks who I add to the mysql group to be able to read binlogs and download the *.frm, *.MYI, *.MYD files to their local computer.

My first thought is to run chmod g+rx data-dir.

The database directories and table/binlog files within data-dir have permissions with 770 / 660. So I have to chmod g-w on all of those to prevent accidental tampering or removal of live data.

Unfortunately, as new binlogs are created, and the create database or create table command is used, the g+w permission is automatically added. How can I change this functionality?

1

Well, I found online that the environment variable UMASK and UMASK_DIR must be set, regardless of what the command umask will output.

One must add export UMASK=0640 and export UMASK=0750 to the top of their startup script, immediately before calling mysqld_safe.

The leading zero is important to switch to the octal numbering system.

The first thing I tried was 0027, but that produced files with permissions u=rw,g=w,o=rwx so that is what prompted me to invert the permissions in the environment variable to 0750 (and 0640) to produce the desired results.

I hope my self-answer will help a future visitor. :-)

0

What is the underlying problem you are trying to solve?? UMASK may be the wrong approach.

The files and directories must be fully accessible by the mysql "user", so directories need at least 0700 and files need 0600.

If you want the "world" to be able to read them (but not write them), 0755 and 0644. But why would you want that? And you probably have to have UMASK_DIR=0755 and UMASK=644 to prevent the bottom bits from being turned off by the OS.

MySQL has access control inside MySQL. This is via the GRANT command in MySQL. And MySQL "users" are not the same as OS "users". In particular, the OS 'root' and MySQL's 'root' are independent.

  • 755/644 would be too permissive. That is why I opted for 750 and 640 in my self-answer. (I figured it out after posting the question) "What is the underlying problem you are trying to solve??" When researching problems, the binlogs are very useful. I don't want to have to log in as root to get to them though. But if I'm going to give a user readonly access to binlogs, that's pretty permissive so for consistency, they might as well get the convenience of readonly access to the whole database. The main problem though, was that the files were g=rw, which is over doing it. – Bryan Field Jan 25 '16 at 13:38
  • Certainly this is not for routine production use of MySQL. Certainly one would use GRANT features. My question was specifically regarding the permissions of the underlying files on a UNIX environment. – Bryan Field Jan 25 '16 at 14:47
  • If your "users" can be in the same group as "mysql", then 0750 and 0640 give them readonly access (the '5' and '4'). This may be the minimal way to do your unusual task. – Rick James Jan 25 '16 at 18:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.