Re: [Maria-discuss] Why does MariaDB needs SELinux capability for setuid/setgid?

Hi, Lukas!

I found that setuid/setgid is used inside mysqld_safe_helper (mariadbd-safe-helper). Are there any other cases when MariaDB uses these functions?

Yes, in the server. If the server is started with --memlock it does mlockall(MCL_CURRENT) to prevent itself from being swapped. This needs root, and the server uses setuid/setgid to drop root privileges after mlockall. Regards, Sergei VP of MariaDB Server Engineering and security@mariadb.org