1

I have an instance of mariadb 10.6.7 on an Ubuntu 22.04 Server and I am trying to do backups of a specific database with mariabackup.

mariabackup --backup --user="my_test_user" --target-dir=/tmp/mdb_test --verbose

But always end up with

[00] 2022-11-07 06:57:13 mariabackup: Generating a list of tablespaces
[00] 2022-11-07 06:57:13 Can't open dir ./testdb

I followed the instructions for creating a backup user as they are shown here: https://mariadb.com/kb/en/mariabackup-overview/#authentication-and-privileges The only difference is that i chose "unix socket" for authentication, in order to omit password files on the system.

The affected user 'my_test_user' is member of the mysql group.

Authentication is successful, however, mariabackup will fail with the following error:

[00] 2022-11-07 06:57:13 Connecting to MariaDB server host: localhost, user: my_test_user, password: not set, port: not set, socket: /run/mysqld/mysqld.sock
[00] 2022-11-07 06:57:13 Using server version 10.6.7-MariaDB-2ubuntu1.1
mariabackup based on MariaDB server 10.6.7-MariaDB debian-linux-gnu (x86_64)
[00] 2022-11-07 06:57:13 uses posix_fadvise().
[00] 2022-11-07 06:57:13 cd to /var/lib/mysql/
[00] 2022-11-07 06:57:13 open files limit requested 0, set to 1024
[00] 2022-11-07 06:57:13 mariabackup: using the following InnoDB configuration:
[00] 2022-11-07 06:57:13 innodb_data_home_dir = 
[00] 2022-11-07 06:57:13 innodb_data_file_path = ibdata1:12M:autoextend
[00] 2022-11-07 06:57:13 innodb_log_group_home_dir = ./
2022-11-07  6:57:13 0 [Note] InnoDB: Number of pools: 1
[00] 2022-11-07 06:57:13 mariabackup: Generating a list of tablespaces
[00] 2022-11-07 06:57:13 Can't open dir ./testdb
[00] 2022-11-07 06:57:13 merror: xb_load_tablespaces() failed with error Generic error.

I can see that the cd to the default datadir is ok, however the database directory cannot be accessed. This is plausible, as /var/liq/mysql/testdb has 700 permissions, so no permissions for group at all. For all I can see, this is the default permission for mysql/mariadb files and folders. I tried to run as mysql

mariabackup --backup --user="mysql" --target-dir=/tmp/mdb_test --verbose

but this also fails for various reasons (no password, no login shell etc.; I guess the mysql user is not meant to be used that way, so...).

Now the official mariadb/mariabackup docs say https://mariadb.com/kb/en/mariabackup-overview/#file-system-permissions

Mariabackup has to read MariaDB's files from the file system. Therefore, when you run Mariabackup as a specific operating system user, you should ensure that user account has sufficient permissions to read those files.

If you are using Linux and if you installed MariaDB with a package manager, then MariaDB's files will probably be owned by the mysql user and the mysql group.

Now I wonder how this can be done "the right way". I have found this https://mariadb.com/kb/en/specifying-permissions-for-schema-data-directories-and-tables/ on the mariadb docs and have already exported the umask_dir=750 variable and restarted the server, but that didn't help so far, still getting the same error.

Maybe someone can help me out on what I am missing. If I change permissions on the testdb directory to 750, everything works fine, but I fear it's not a good idea to to that in a productive scenario.

Any hints are very welcome

badlands
  • 11
  • 2

1 Answers1

1

however the database directory cannot be accessed. This is plausible, as /var/liq/mysql/testdb has 700 permissions, so no permissions for group at all.

Yes, mariabackup requires access to the physical on disk files, so g+rX are needed on directories and files.

exported the umask_dir=750 variable and restarted the server, but that didn't help so far, still getting the same error.

Only affects new directories/databases. And note the systemd exception.

If I change permissions on the testdb directory to 750, everything works fine, but I fear it's not a good idea to to that in a productive scenario.

If the my_test_user is the only one with a mysql group then its harmless.

Alternately make mysql@localhost the "unix socket" authenticated user and run the backup as that user. Then the user file/directory permissions are already correct.

danblack
  • 8,258
  • 2
  • 12
  • 28