server icon indicating copy to clipboard operation
server copied to clipboard
verified publisher icon MariaDB

MDEV-37197 - Install PAM modules and systemd units from /lib to /usr/lib

Open ottok opened this issue 7 months ago • 18 comments

Description

Since Fedora 17 and about 2012, the directory /lib has been a symlink to /usr/lib. Debian started a similar migration in 2019. Nowadays all major Linux distributions have a merged /usr, and the canonical location for files should be /usr/lib instead of just /lib.

The location of PAM modules and systemd files is the last remaining part in MariaDB to fully complete the usr merge migration. Stable releases should not move files around, so target MariaDB 11.8 as the first release to have the /usr merge fully completed.

References:

  • https://fedoraproject.org/wiki/Features/UsrMove
  • https://www.debian.org/releases/bookworm/amd64/release-notes/ch-information.en.html#a-merged-usr-is-now-required
  • https://www.freedesktop.org/wiki/Software/systemd/TheCaseForTheUsrMerge/

Release Notes

  • Install PAM modules and systemd units from are now installed to /usr/lib instead of /lib

How can this PR be tested?

CI should continue to be green for builds, installs and upgrades.

Basing the PR against the correct MariaDB version

  • [x] This is a bug fix, and the PR is based against the earliest maintained branch in which the bug can be reproduced.

PR quality check

  • [x] I checked the CODING_STANDARDS.md file and my PR conforms to this where appropriate.
  • [x] For any trivial modifications to the PR, I am ok with the reviewer making the changes themselves.

ottok avatar May 25 '25 04:05 ottok

Job buildbot/amd64-debian-11-debug-ps-embedded failed on test unrelated to changes in this PR:

main.vector2                             w8 [ fail ]
        Test ended at 2025-05-25 08:30:34
CURRENT_TEST: main.vector2
Warning: /home/buildbot/amd64-debian-11-debug-ps-embedded/build/libmysqld/examples/mariadb-test-embedded: unknown option '--loose-disable-ssl-verify-server-cert'
Warning: /home/buildbot/amd64-debian-11-debug-ps-embedded/build/libmysqld/examples/mariadb-test-embedded: unknown variable 'loose-ssl-ca=/home/buildbot/amd64-debian-11-debug-ps-embedded/build/mysql-test/std_data/cacert.pem'
Warning: /home/buildbot/amd64-debian-11-debug-ps-embedded/build/libmysqld/examples/mariadb-test-embedded: unknown variable 'loose-ssl-cert=/home/buildbot/amd64-debian-11-debug-ps-embedded/build/mysql-test/std_data/client-cert.pem'
Warning: /home/buildbot/amd64-debian-11-debug-ps-embedded/build/libmysqld/examples/mariadb-test-embedded: unknown variable 'loose-ssl-key=/home/buildbot/amd64-debian-11-debug-ps-embedded/build/mysql-test/std_data/client-key.pem'
Warning: /home/buildbot/amd64-debian-11-debug-ps-embedded/build/libmysqld/examples/mariadb-test-embedded: unknown option '--loose-skip-ssl'
--- /home/buildbot/amd64-debian-11-debug-ps-embedded/build/mysql-test/main/vector2.result	2025-05-25 08:22:14.000000000 +0000
+++ /home/buildbot/amd64-debian-11-debug-ps-embedded/build/mysql-test/main/vector2.reject	2025-05-25 08:30:34.044000000 +0000
@@ -339,7 +339,6 @@
 15	[33]
 2	[33]
 28	[28]
-29	[29]
 3	[33]
 30	[30]
 31	[31]
@@ -349,6 +348,7 @@
 35	[35]
 36	[36]
 37	[37]
+38	[38]
 4	[33]
 5	[33]
 6	[33]
Result content mismatch

ottok avatar May 25 '25 08:05 ottok

Job buildbot/amd64-ubuntu-2004-debug failed on test unrelated to changes in this PR:

rpl.rpl_gtid_startpos 'stmt'             w15 [ fail ]
        Test ended at 2025-05-25 08:35:24
CURRENT_TEST: rpl.rpl_gtid_startpos
mysqltest: In included file "./include/wait_for_purge.inc": 
included from /home/buildbot/amd64-ubuntu-2004-debug/build/mysql-test/suite/rpl/t/rpl_gtid_startpos.test at line 233:
At line 53: ERROR: failed while waiting for binlog purge to master-bin.000004

ottok avatar May 25 '25 16:05 ottok

OpenSUSE implemented the /usr merge in 2021: https://en.opensuse.org/openSUSE:Usr_merge

I don't have access to a SUSE system to check, but pretty sure if has it already.

Fedora did the change in 2012 and presumably RHEL 7 in 2014 had it (10+ years ago).

ottok avatar May 26 '25 04:05 ottok

ack.

Interesting not visible in the BCI which I thought was SLES based:

$ podman run -ti  registry.suse.com/bci/bci-base:15.7
Trying to pull registry.suse.com/bci/bci-base:15.7...
Getting image source signatures
Copying blob 974449b21a84 done   | 
Copying config 4652df9563 done   | 
Writing manifest to image destination
73bfceae7edc:/ # ls -lad  /bin /sbin /lib*
drwxr-xr-x. 2 root root 4096 May  7 19:18 /bin
drwxr-xr-x. 5 root root 4096 May  7 19:18 /lib
drwxr-xr-x. 3 root root 4096 May  7 19:18 /lib64
drwxr-xr-x. 2 root root 4096 May  7 19:18 /sbin
73bfceae7edc:/ # ls -lad  /usr/bin /usr/sbin /usr/lib*
drwxr-xr-x.  2 root root 12288 May  7 19:18 /usr/bin
drwxr-xr-x. 25 root root  4096 May  7 19:18 /usr/lib
drwxr-xr-x. 10 root root 12288 May  7 19:18 /usr/lib64
drwxr-xr-x.  2 root root  4096 May  7 19:18 /usr/sbin
73bfceae7edc:/ # ls /bin | wc -l
52
73bfceae7edc:/ # ls usr/bin | wc -l
299
``

grooverdan avatar May 26 '25 07:05 grooverdan

Rebased and changed target to 'main' as this by now surely missed the 11.8 window.

ottok avatar Jun 04 '25 11:06 ottok

CI job buildbot/amd64-debian-12 failed test that is unrelated to this change:

main.aborted_clients                     w3 [ fail ]
        Test ended at 2025-06-04 11:42:41
CURRENT_TEST: main.aborted_clients
--- /home/buildbot/amd64-debian-12/build/mysql-test/main/aborted_clients.result	2025-06-04 11:36:23.000000000 +0000
+++ /home/buildbot/amd64-debian-12/build/mysql-test/main/aborted_clients.reject	2025-06-04 11:42:41.481132515 +0000
@@ -4,7 +4,7 @@
 connection default;
 SELECT VARIABLE_VALUE FROM INFORMATION_SCHEMA.GLOBAL_STATUS WHERE VARIABLE_NAME='aborted_clients';
 VARIABLE_VALUE
-0
+3
 connect con2,localhost,root,,;
 KILL CONNECTION_ID();
 ERROR 70100: Connection was killed
@@ -12,5 +12,5 @@
 connection default;
 SELECT VARIABLE_VALUE FROM INFORMATION_SCHEMA.GLOBAL_STATUS WHERE VARIABLE_NAME='aborted_clients';
 VARIABLE_VALUE
-1
+4
 FLUSH STATUS;
Result content mismatch

CI job continuous-integration/appveyor/pr also failed on unrelated issue:

main.mysql_client_test                   w5 [ fail ]  timeout after 240 seconds
        Test ended at 2025-06-04 12:33:15
Test case timeout after 240 seconds
== C:/projects/server/_build/mysql-test/var/5/log/mysql_client_test.log == 
  - 4: name: 'possible_keys'/''; table: ''/''; db: ''; catalog: 'def'; length: 12288; max_length: 0; type: 253; decimals: 39
  - 5: name: 'key'/''; table: ''/''; db: ''; catalog: 'def'; length: 192; max_length: 0; type: 253; decimals: 39
  - 6: name: 'key_len'/''; table: ''/''; db: ''; catalog: 'def'; length: 12288; max_length: 0; type: 253; decimals: 39
  - 7: name: 'ref'/''; table: ''/''; db: ''; catalog: 'def'; length: 6144; max_length: 0; type: 253; decimals: 39
  - 8: name: 'rows'/''; table: ''/''; db: ''; catalog: 'def'; length: 192; max_length: 0; type: 253; decimals: 39
  - 9: name: 'r_rows'/''; table: ''/''; db: ''; catalog: 'def'; length: 192; max_length: 0; type: 253; decimals: 39
  - 10: name: 'filtered'/''; table: ''/''; db: ''; catalog: 'def'; length: 4; max_length: 0; type: 5; decimals: 2
  - 11: name: 'r_filtered'/''; table: ''/''; db: ''; catalog: 'def'; length: 4; max_length: 0; type: 5; decimals: 2
  - 12: name: 'Extra'/''; table: ''/''; db: ''; catalog: 'def'; length: 765; max_length: 0; type: 253; decimals: 39
ANALYZE JSON DELETE number of fields: 1
  - 0: name: 'ANALYZE'/''; table: ''/''; db: ''; catalog: 'def'; length: 234; max_length: 0; type: 253; decimals: 39
# ------------------------------------
SET @@global.general_log= @old_general_log;
SET @@global.slow_query_log= @old_slow_query_log;
SET @@global.character_set_server= @save_character_set_server;
SET @@global.collation_server= @save_collation_server;
SET @@global.character_set_client= @save_character_set_client;
SET @@global.collation_connection= @save_collation_connection;
FOUND 1 /Aborted connection.*'u' host: '192.0.2.1' real ip: '(localhost|::1)'/ in mysqld.1.err
 == C:/projects/server/_build/mysql-test/var/5/tmp/analyze-timeout-mysqld.1.err ==

ottok avatar Jun 04 '25 15:06 ottok

CI job amd64-ubuntu-2204-debug-ps triggered by Daniel Black failed on unrelated issue:

innodb.innodb-lock-inherit-read_commited w3 [ fail ]
        Test ended at 2025-06-13 06:48:32
CURRENT_TEST: innodb.innodb-lock-inherit-read_commited
mysqltest: At line 110: query 'reap' failed with wrong errno ER_LOCK_DEADLOCK (1213): 'Deadlock found when trying to get lock; try restarting transaction', instead of  (0)...

ottok avatar Jun 27 '25 15:06 ottok

Otto, thanks for the PR. Always good to get through migrations.

You mentioned the Debian /usr merge started a while back. If you want to take to to 11.8 or 11.4 that's ok by me if those correspond to the Debian 11/12 (?) version that MariaDB has where the merge/move occurred. There's sufficient tests around PAM and systemd checks in CI to catch if anything is amiss.

As its probably release note worthy the MDEV-37197 has been created for this task.

Can you reword the commit message a bit, you're doing Debian/Ubuntu only changes but reading the commit message it reads looks like you're doing it for everyone. The RPM changes become very dependant on distro which needs more investigation to be done relliably.

grooverdan avatar Jul 10 '25 08:07 grooverdan

This is modifying cmake/install_layout.cmake, hence this is not Debian-only. I rebased on latest main now. I propose we put this in the dev version first, and backport to 11.4+ in 6-9 months if there are no regressions. I would prefer not to put this change directly in a maintenance branch as it is not a critical bugfix.

ottok avatar Jul 10 '25 12:07 ottok

Note to self: After rebase on July 10th, CI fully green :heavy_check_mark:

ottok avatar Jul 10 '25 19:07 ottok

This is modifying cmake/install_layout.cmake, hence this is not Debian-only. I rebased on latest main now.

INSTALL_SYSTEMD_UNITDIR_DEB and INSTALL_PAMDIR_DEB definitely are Debian only, or applies to those with -DDEB or -DINSTALL_LAYOUT=DEB.

I propose we put this in the dev version first, and backport to 11.4+ in 6-9 months if there are no regressions. I would prefer not to put this change directly in a maintenance branch as it is not a critical bugfix.

sure, ok. Commit message should reflect this.

grooverdan avatar Jul 11 '25 00:07 grooverdan

Rebased on latest 'main' now.

CI job buildbot/amd64-msan-clang-20 failed on:

plugins.server_audit                     w11 [ fail ]
        Test ended at 2025-08-06 17:45:26
CURRENT_TEST: plugins.server_audit
--- /home/buildbot/amd64-msan-clang-20/build/mysql-test/suite/plugins/r/server_audit.result	2025-08-06 17:38:12.000000000 +0000
+++ /home/buildbot/amd64-msan-clang-20/build/mysql-test/suite/plugins/r/server_audit.reject	2025-08-06 17:45:26.132959694 +0000
@@ -538,7 +538,6 @@
 TIME,HOSTNAME,ssl_user1,localhost:PORT,ID,0,CONNECT,sa_db,TLS_VERSION,0
 TIME,HOSTNAME,ssl_user1,localhost:PORT,ID,ID,QUERY,sa_db,'SHOW STATUS LIKE \'Ssl_version\'',0
 TIME,HOSTNAME,ssl_user1,localhost:PORT,ID,ID,QUERY,sa_db,'select variable_value > \'\' as \'have_ssl\' from information_schema.session_status where variable_name=\'ssl_cipher\'',0
-TIME,HOSTNAME,ssl_user1,localhost:PORT,ID,0,DISCONNECT,sa_db,TLS_VERSION,0
 TIME,HOSTNAME,root,localhost:PORT,ID,ID,WRITE,mysql,db,
 TIME,HOSTNAME,root,localhost:PORT,ID,ID,WRITE,mysql,tables_priv,
 TIME,HOSTNAME,root,localhost:PORT,ID,ID,WRITE,mysql,columns_priv,
@@ -547,6 +546,7 @@
 TIME,HOSTNAME,root,localhost:PORT,ID,ID,WRITE,mysql,roles_mapping,
 TIME,HOSTNAME,root,localhost:PORT,ID,ID,WRITE,mysql,global_priv,
 TIME,HOSTNAME,root,localhost:PORT,ID,ID,QUERY,sa_db,'DROP USER ssl_user1@localhost',0
+TIME,HOSTNAME,ssl_user1,localhost:PORT,ID,0,DISCONNECT,sa_db,TLS_VERSION,0
 TIME,HOSTNAME,root,localhost:PORT,ID,ID,QUERY,sa_db,'set global serv',0
 TIME,HOSTNAME,root,localhost:PORT,ID,ID,QUERY,sa_db,'select (1), (2)',0
 TIME,HOSTNAME,root,localhost:PORT,ID,ID,QUERY,sa_db,'select \'A\', ',0
Result content mismatch

CI job continuous-integration/appveyor/pr failed on:

main.connect                             w4 [ fail ]
        Test ended at 2025-08-06 18:00:24
CURRENT_TEST: main.connect
--- C:/projects/server/mysql-test/main/connect.result	2025-08-06 17:35:49.412225900 +0000
+++ "C:\\projects\\server\\mysql-test\\main\\connect.reject"	2025-08-06 18:00:22.824856400 +0000
@@ -287,7 +287,7 @@
 
 SHOW STATUS LIKE 'max_used_connections';
 Variable_name	Value
-Max_used_connections	1
+Max_used_connections	2
 
 # -- Starting Event Scheduler...
 SET GLOBAL event_scheduler = ON;
Result content mismatch

Neither are due to my change - both are due to the current 'main' branch already being broken and/or CI having unstable tests.

ottok avatar Aug 06 '25 21:08 ottok

Rebased on latest 'main' now.

CI job continuous-integration/appveyor/pr failed on:

main.sp-bugs2                            w1 [ fail ]  timeout after 240 seconds
        Test ended at 2025-11-17 02:30:04
Test case timeout after 240 seconds

This is not a regression from this PR, but due to the current 'main' branch already being broken and/or CI having unstable tests.

ottok avatar Nov 17 '25 06:11 ottok

https://github.com/MariaDB/server/pull/4065#issuecomment-3059639663 is still unaddressed. Commit message is general but implementation is Debian specific. INSTALL_SYSTEMD_UNITDIR_RPM is already has /usr however INSTALL_PAMDIR_RPM would need a /usr prefix to be consistent with the commit message. _STANDALONE and _SRV4 can remain unchanged.

Can you put the MDEV in the commit message too please.

grooverdan avatar Nov 17 '25 07:11 grooverdan

Ack, commit prefixed with MDEV-37197 and body explains it is only for Debian.

ottok avatar Nov 17 '25 07:11 ottok

Rebased on latest 'main' now.

CI job continuous-integration/appveyor/pr failed on:

main.sp-bugs2                            w7 [ fail ]  timeout after 240 seconds
        Test ended at 2025-11-17 10:20:26
Test case timeout after 240 seconds

CI job buildbot/amd64-ubuntu-2204-debug-ps failed on:

innodb.gap_locks                         w17 [ fail ]
        Test ended at 2025-11-17 08:03:34
CURRENT_TEST: innodb.gap_locks
--- /home/buildbot/amd64-ubuntu-2204-debug-ps/build/mysql-test/suite/innodb/r/gap_locks.result	2025-11-17 07:49:39.000000000 +0000
+++ /home/buildbot/amd64-ubuntu-2204-debug-ps/build/mysql-test/suite/innodb/r/gap_locks.reject	2025-11-17 08:03:34.403062648 +0000
@@ -8,28 +8,28 @@
 DELETE FROM t1 WHERE b='2' AND c=2;
 SHOW ENGINE INNODB STATUS;
 Type	Name	Status
-InnoDB		2 lock struct(s), 1 row lock(s)
+InnoDB		0 lock struct(s), 0 row lock(s)
 ROLLBACK;
 SET TRANSACTION ISOLATION LEVEL REPEATABLE READ;
 BEGIN;
 DELETE FROM t1 WHERE b='2' AND c=2;
 SHOW ENGINE INNODB STATUS;
 Type	Name	Status
-InnoDB		2 lock struct(s), 1 row lock(s)
+InnoDB		0 lock struct(s), 0 row lock(s)
 ROLLBACK;
 SET TRANSACTION ISOLATION LEVEL READ COMMITTED;
 BEGIN;
 DELETE FROM t1 WHERE b='2' AND c=2;
 SHOW ENGINE INNODB STATUS;
 Type	Name	Status
-InnoDB		1 lock struct(s), 0 row lock(s)
+InnoDB		0 lock struct(s), 0 row lock(s)
 ROLLBACK;
 SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
 BEGIN;
 DELETE FROM t1 WHERE b='2' AND c=2;
 SHOW ENGINE INNODB STATUS;
 Type	Name	Status
-InnoDB		1 lock struct(s), 0 row lock(s)
+InnoDB		0 lock struct(s), 0 row lock(s)
 ROLLBACK;
 SET GLOBAL INNODB_STATUS_OUTPUT_LOCKS = @save_locks;
 DROP TABLE t1;
Result content mismatch

Neither are due to my change - both are due to the current 'main' branch already being broken and/or CI having unstable tests.

ottok avatar Nov 17 '25 17:11 ottok

Rebased on latest 'main'. Can somebody please approve this? I don't see any objections or reasons not to merge.

ottok avatar Nov 27 '25 03:11 ottok

Now CI job Build on Windows ARM64 / build (pull_request) failed on:

innodb.innodb_buffer_pool_load_now       w15 [ fail ]
        Test ended at 2025-11-27 04:34:21

CURRENT_TEST: innodb.innodb_buffer_pool_load_now
my_create_minidump : Minidump written to mariadbd.dmp, directory C:\a\server\server\mysql-test
--- C:/a/server/server/mysql-test/suite/innodb/r/innodb_buffer_pool_load_now.result	2025-11-27 04:04:16.178613400 +0000
+++ C:\a\server\server\mysql-test\suite\innodb\r\innodb_buffer_pool_load_now.reject	2025-11-27 04:34:17.889201000 +0000
@@ -37,7 +37,7 @@
 as async_reads_grow
 from information_schema.global_status where variable_name='innodb_async_reads_total_count';
 async_reads_grow
-1
+0
 SELECT COUNT(*) FROM information_schema.innodb_buffer_page_lru
 WHERE table_name = '`test`.`ib_bp_test`';
 COUNT(*)

Result content mismatch

And CI job buildbot/amd64-ubuntu-2204-debug failed on:

main.lock_sync                           w20 [ fail ]  timeout after 900 seconds
        Test ended at 2025-11-27 04:46:01
Test case timeout after 900 seconds
== /home/buildbot/amd64-ubuntu-2204-debug/build/mysql-test/var/20/log/lock_sync.log == 
# MDEV-28567 Assertion `0' in open_tables upon function-related operation
#
CREATE TABLE t1 (a INT);
CREATE TABLE t2 (b INT);
CREATE TRIGGER tr1 BEFORE INSERT ON t1 FOR EACH ROW UPDATE t2 SET b = 0;
CREATE TRIGGER tr2 BEFORE INSERT ON t2 FOR EACH ROW UPDATE t1 SET a = 6;
CREATE VIEW v1 AS SELECT * FROM t1;
SET AUTOCOMMIT=OFF;
SELECT * FROM t1;
a
connect  con1,localhost,root,,test;
DROP TRIGGER tr1;
connection default;
INSERT INTO t2 SELECT * FROM t2;
SELECT f() FROM t2;
ERROR 42000: FUNCTION test.f does not exist
connect  con2,localhost,root,,test;
set debug_sync= 'after_open_table_mdl_shared signal s1';
ALTER VIEW v1 AS SELECT f() FROM t1;
connection con1;
 == /home/buildbot/amd64-ubuntu-2204-debug/build/mysql-test/var/20/tmp/analyze-timeout-mysqld.1.err ==
mysqltest: Could not open connection 'default' after 500 attempts: 2002 Can't connect to local server through socket '/home/buildbot/amd64-ubuntu-2204-debug/build/mysql-test/var/tmp/' (111)

Both failures unrelated to this PR contents.

ottok avatar Nov 27 '25 05:11 ottok