1

I'm following installation/setup instructions in the MySQL Secure Deployment Guide, which say to create the mysql group with:

groupadd -g 27 -o -r mysql

The -o permits adding a group with a non-unique GID. I checked /etc/group on my machine and the sudo group uses GID 27

sudo:x:27:ivan

I also checked another machine that's running a different Linux distro, and it has a different group (dialout) occupying GID 27.

What would the implications be of using a non-unique GID? Why might these instructions recommend doing so?

  • 1
    The mysql user should not have sudo rights. – Rui F Ribeiro Jun 23 '18 at 1:42
  • 1
    This isn't authoritative, but my opinion is that the people writing that document chose 27 as an unused-to-them GID, unaware that other distributions might have a sudo group there. It seems to me to be their intention to create a separate mysql group of GID 27. – Jeff Schaller Jun 23 '18 at 1:42
  • They (and you) didn't ask me, but I wouldn't forcefully create a group of a given GID and also include the -o flag to allow it to share a GID. – Jeff Schaller Jun 23 '18 at 1:46
  • @JeffSchaller I think you're right. I just checked on another Linux machine I have, and it has a different group (dialout) occupying GID 27 – ivan Jun 23 '18 at 1:47
3

My reading of that documentation doesn't lead me to believe that the intention is to share the sudo group. It appears to me that the developers chose 27 because it was unused on their system, and that the intention was to create a new mysql group of GID 27. That belief is undermined by their addition of the -o flag to groupadd, though, as that explicitly allows a new group to share an existing GID, which would not be in the interests of separation of duties, and thus not of security.

If it was me, I would allow groupadd to select the GID; I'm not sure whether a system GID (one less than /etc/login.defs:GID_MIN) is required.

groupadd mysql

or

groupadd -r mysql

and then refer to the group with the mysql name and don't rely on the GID being 27. A quick search of that doc for "27" doesn't come up with any matches other than the page you already found. There are no results for chgrp, and the only hit for chown is in the Post Installation Setup where they use the group name in:

chown mysql:mysql /usr/local/mysql/mysql-files

and

chown mysql:mysql /usr/local/mysql/data

(I've adjusted the commands to show the full paths versus the relative ones from the doc).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.