GrimUncle
commented
1 year ago i'm not familiar with the code, seems like when to install the mysql plugin, failed at the init check as below,
static int audit_plugin_init(void *p) {
DBUG_ENTER("audit_plugin_init"); const bool compat_init_ok = compat::init(); ------> personally thinking a 'false' is returned in my case if (!compat_init_ok) ------> as "false" is returned, this part of code is executed. { sql_print_error("%s unable to init compatibility layer. Aborting.", log_prefix); DBUG_RETURN(1); }
so i checked the init() function as below,
static inline bool init() {
if !defined(MARIADB_BASE_VERSION) && MYSQL_VERSION_ID >= 80000 --> since my installed mysql version is 8.0.30, so i think this if sentence is matched
return init_vio_socket_connect() && init_str_session();elif defined(HAVE_SESS_CONNECT_ATTRS) && defined(MARIADB_BASE_VERSION)
return init_PFS_thread_get_current_thread();else
return true;endif
}
then, i checked the function init_vio_socket_connect() and init_str_session() respectively,
static inline bool init_vio_socket_connect() { void* handle = dlopen(NULL, RTLD_LAZY); if (!handle) return false; _vio_socket_connect = (decltype(_vio_socket_connect))dlsym(handle, "_Z18vio_socket_connectP3VioP8sockaddrji"); _vio_socket_connect_80016 = (decltype(_vio_socket_connect_80016))dlsym(handle, "_Z18vio_socket_connectP3VioP8sockaddrjbi"); _vio_socket_connect_80020 = (decltype(_vio_socket_connect_80020))dlsym(handle, "_Z18vio_socket_connectP3VioP8sockaddrjbiPb"); dlclose(handle); return _vio_socket_connect || _vio_socket_connect_80016 || _vio_socket_connect_80020; }
the mysql i installed on my server has this "_Z18vio_socket_connectP3VioP8sockaddrjbiPb", so this function will return 'true'
[root@localhost ~]# nm -D /usr/sbin/mysqld | grep -i "_Z18vio" 0000000001a42a10 T _Z18vio_socket_connectP3VioP8sockaddrjbiPb 0000000001a428c0 T _Z18vio_socket_io_waitP3Vio17enum_vio_io_event 0000000001a3aaf0 T _Z18vio_socket_timeoutP3Viojb
static inline bool init_str_session() { void* handle = dlopen(NULL, RTLD_LAZY); if (!handle) return false; _command_name = (decltype(_command_name))dlsym(handle, "command_name"); _str_session_80026 = (decltype(_str_session_80026))dlsym(handle, "_ZN13Command_names11str_sessionE19enum_server_command"); dlclose(handle); return _command_name || _str_session_80026; }
unfortunately, there is no "command_name" and "_ZN13Command_names11str_sessionE19enum_server_command" found in my mysql server, so this function will return 'false'
[root@localhost ~]# nm -D /usr/sbin/mysqld | grep -i "_ZN13command_name" 00000000009b7830 T _ZN13Command_names10str_globalB5cxx11E19enum_server_command 00000000009b7780 T _ZN13Command_names11str_sessionB5cxx11E19enum_server_command ----> this one is similar to the ""_ZN13Command_names11str_sessionE19enum_server_command""
00000000035aad20 B _ZN13Command_names13m_replace_strB5cxx11E 0000000003592860 B _ZN13Command_names7m_namesB5cxx11E 00000000009b7750 T _ZN13Command_names9translateB5cxx11ERK16System_variables [root@localhost ~]# nm -D /usr/sbin/mysqld | grep "command_name" [root@localhost ~]#
because of this, function init() does an operation "init_vio_socket_connect() && init_str_session();" then returns a 'false'. maybe that's why mysql server fails to pass the init check and reports an error "Trellix Audit Plugin: unable to init compatibility layer. Aborting."
no clue if my guess is correct.
Hi, Greetings. I'm getting the following error trying to install libaudit_plugin.so. Appreciate any ideas. Thank you.
Error messages:
Audit plugin version(i see the plugin description says it starts to support MySQL 64-bit 8.0.30, so I installed the MYSQL community server 8.0.30, however, i didn't get luck to make it successfully be installed on my redhat 9.0 server):
OS version:
MYSQL version: [
My.cnf settings:
offset values (it matches the one added in the my.cnf):
Entire error logs (logs are captured whilerunning systemctl restart mysqld):