MDEV-41140 mariadb-server.postinst chown dereferences symlinks

The postinst, preinst, rpm postin and mysqld_safe scripts followed
symlinks when fixing ownership and permissions under /var/log/mysql
and /var/lib/mysql. Use -h and find -execdir, and let mysqld_safe
write as the mysql user, so symlinks there are no longer dereferenced.

debian/mariadb-server.postinst

@@ -151,9 +151,9 @@ EOF
     # circumstances as it contains scripts that are executed by root.
     set +e
     find $mysql_statedir ! -uid 0 -print0 -or ! -gid 0 -print0 | xargs -0 -r sudo chown 0:0
-    find $mysql_datadir ! -uid "$(id -u mysql)" -print0 | xargs -0 -r chown mysql
+    find $mysql_datadir/ ! -uid "$(id -u mysql)" -execdir chown -h mysql {} +
     chown mysql:adm $mysql_logdir
-    find "$mysql_logdir" -print0 | xargs -0 -r chown mysql:adm
+    find "$mysql_logdir/" -maxdepth 1 -print0 | xargs -0 -r chown -h mysql:adm
     chmod 2750 $mysql_logdir
     set -e
 

debian/mariadb-server.preinst

@@ -254,9 +254,8 @@ fi
 # The "set +e" is necessary as e.g. a ".journal" of a ext3 partition is
 # not chgrp'able (#318435).
 set +e
-find $mysql_datadir ! -uid "$(id -u mysql)" -print0 | xargs -0 -r chown mysql
-find $mysql_datadir -follow -not -group mysql -print0 2>/dev/null \
-  | xargs -0 --no-run-if-empty chgrp mysql
+find $mysql_datadir/ ! -uid "$(id -u mysql)" -execdir chown -h mysql {} +
+find $mysql_datadir/ -not -group mysql -execdir chgrp -h mysql {} + 2>/dev/null
 set -e
 
 db_stop

scripts/mysqld_safe.sh

@@ -226,7 +226,6 @@ wsrep_pick_url() {
 wsrep_start_position_opt=""
 wsrep_recover_position() {
   local mysqld_cmd="$@"
-  local euid=$(id -u)
   local ret=0
 
   local wr_logfile=$(mktemp /tmp/wsrep_recovery.XXXXXX)
@@ -281,10 +280,9 @@ wsrep_recover_position() {
   else
     local wr_logfile_permanent="$DATADIR/wsrep_recovery.fail"
   fi
-  touch $wr_logfile_permanent
-  [ "$euid" = "0" ] && chown $user $wr_logfile_permanent
-  chmod 600 $wr_logfile_permanent
-  cat "$wr_logfile" >> $wr_logfile_permanent
+  if [ "$helper_exist" -eq "0" ]; then
+    (umask 077; "$helper" "$user" log "$wr_logfile_permanent" < "$wr_logfile")
+  fi
   rm -f "$wr_logfile"
 
   return $ret

support-files/rpm/server-postin.sh

@@ -60,7 +60,7 @@ if [ $1 = 1 ] ; then
 
   # Fix permissions for the permission database so that only the user
   # can read them.
-  chmod -R og-rw $datadir/mysql
+  chmod -R og-rw $datadir/mysql/
 fi
 
 # install SELinux files - but don't override existing ones