search

trellix-enterprise / mysql-audit

AUDIT Plugin for MySQL. See wiki and readme for description. If you find the plugin useful, please star us on GitHub. We love stars and it's a great way to show your feedback.
Other
239 stars 57 forks source link

About offset-extract.sh ? #181

Closed RingsC closed 6 years ago

RingsC commented 7 years ago

As we known, the offset values are gotten by offset-extract.sh. and I think that we can get the those values in our plugin source code. as the following: (char)&((T)nullptr->member) - (char)nullptr; or by using offsetof to retrieve the offset values of all fields. Why do we using the script to get these values. it's inconvenience when we use release version, which mysqld does not have symbols table. or there is no GDB available now.

aoisososola commented 6 years ago

Server version:5.7.20-log MySQL Community Server (GPL) ./offset-extract.sh /usr/sbin/mysqld //offsets for: /usr/sbin/mysqld (5.7.20) {"5.7.20","66b3dd74a7593d3c8bb5f18c5c14f2a3"offsets.gdb:7: Error in sourced command file: No symbol table is loaded. Use the "file" command.,

aharonrobbins commented 6 years ago

HI. Apologies for the late response. There was a snafu with my email address and I did not see this issue.

If one compiles the plugin against source code for the version of interest, every time, then one could indeed simply use offsetof(). However, for our binary releases we compile against the earliest full-release version of a particular major release, so that we need release only one version of the plugin per major release of MySQL each time we make a release of the plugin.

This is the reason for the offsets; structure definitions can change between minor releases, and members within structures can move around. Thus an offsetof() call made against the headers used to compile the plugin becomes incorrect if that plugin is loaded into a newer version where the member moved to a different location.

The latest version of the plugin is up to date with MySQL releases, so you should be able to go back to using our binary releases.

Hope this helps.