[Bug 41353] New: koha-dump failing on mysqldump PROCESS privileges
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41353 Bug ID: 41353 Summary: koha-dump failing on mysqldump PROCESS privileges Initiative type: --- Sponsorship --- status: Product: Koha Version: 25.05 Hardware: All OS: Linux Status: NEW Severity: major Priority: P5 - low Component: Command-line Utilities Assignee: koha-bugs@lists.koha-community.org Reporter: djalel.chefrour@univ-soukahras.dz QA Contact: testopia@bugs.koha-community.org CC: robin@catalyst.net.nz Created attachment 190076 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=190076&action=edit Patch koha-dump to fix mysqldump privs error Hi, I've found this repeating error message(s) from cron: /etc/cron.daily/koha-common: mysqldump: [Warning] Using a password on the command line interface can be insecure. mysqldump: Error: 'Access denied; you need (at least one of) the PROCESS privilege(s) for this operation' when trying to dump tablespaces tar: var/log/koha/lib/opac-access.log: file changed as we read it There is already a report open about the mysql cli password warning. I am not addressing it here. I am not concerned by the tar warning neither. The issue is with the: mysqldump: Error: 'Access denied; you need (at least one of) the PROCESS privilege(s) for this operation' when trying to dump tablespaces I traced it back to koha-dump which is configured to be run in cron.daily. This means these 'automatic' backups are not working on my system, and most likely on other debian or even linux based deployments. Hopefully, I have my own backups for the whole MySQL server covering this corner. As there are other DBs on this MySQL server that hosting Koha too, I do not want to give the koha SQL user (created by koha installation scripts) PROCESS privileges for obvious security reasons. The other alternative I found to fix this issue, and therefore the koha-dump backup, is just to add --no-tablespaces to the mysqldump flags in the koha-dump script. As Koha does not seem to use transportable tablespaces, nor any low-level .ibd file operations! Its backups are logical backups (SQL text). So I figure patching this for every one makes sense. The one liner patch is attached to this bug report. Best regards, -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41353 Djalel CHEFROUR <djalel.chefrour@univ-soukahras.dz> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - low |P3 -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41353 Saiful Amin <saiful@semanticconsulting.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |saiful@semanticconsulting.c | |om --- Comment #1 from Saiful Amin <saiful@semanticconsulting.com> --- (In reply to Djalel CHEFROUR from comment #0)
The other alternative I found to fix this issue, and therefore the koha-dump backup, is just to add --no-tablespaces to the mysqldump flags in the koha-dump script.
You're probably on the right track with that fix. Koha doesn't make use of custom tablespaces as per my knowledge. Just note that changes shouldn't be made to the installed /usr/sbin/koha-dump script. All code modifications must go through the normal Koha development workflow so they can be reviewed and tested across different environments. Relevant docs: https://wiki.koha-community.org/wiki/Development_workflow https://wiki.koha-community.org/wiki/Submitting_A_Patch https://gitlab.com/koha-community/koha-testing-docker The actual file to patch is: debian/scripts/koha-dump Please submit the patch with a test plan and change the status to 'Needs Signoff'. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41353 Jan Kissig <bibliothek@th-wildau.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |bibliothek@th-wildau.de --- Comment #2 from Jan Kissig <bibliothek@th-wildau.de> --- I have a question about this bug: I have several debian 12 (bookworm) installations with koha-common installed and the instances created via 'sudo koha-create --create-db username'. The default backup via /etc/cron.daily/koha-common works out of the box and to my knowledge cron.* is still a standard tool to use and works withing debian/ubuntu environments. I also checked the privileges of one of the created koha users and it does not show the PROCESS privilege, only USAGE is set. On what type of Koha installation and server environment does this error occur? -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41353 --- Comment #3 from Saiful Amin <saiful@semanticconsulting.com> --- (In reply to Jan Kissig from comment #2)
On what type of Koha installation and server environment does this error occur?
This is specific to MySQL 8.0 related. You are most likely using MariaDB. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41353 --- Comment #4 from Jan Kissig <bibliothek@th-wildau.de> --- (In reply to Saiful Amin from comment #3)
(In reply to Jan Kissig from comment #2)
On what type of Koha installation and server environment does this error occur?
This is specific to MySQL 8.0 related. You are most likely using MariaDB.
Thank you for that explanation Saiful, and yes mariadb was running. Now I can confirm on ktd with mysql8.0 running that the error occurs: kohadev-koha@kohadevbox:koha(main)$ sudo koha-run-backups --days 2 --output /var/spool/koha mysqldump: Error: 'Access denied; you need (at least one of) the PROCESS privilege(s) for this operation' when trying to dump tablespaces kohadev-koha@kohadevbox:koha(main)$ -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41353 --- Comment #5 from Saiful Amin <saiful@semanticconsulting.com> --- Created attachment 194002 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=194002&action=edit Bug 41353: koha-dump failing on mysqldump PROCESS privileges Problem: Starting from MySQL 5.7.31 and MySQL 8.0.20, mysqldump requires the PROCESS privilege to access tablespace metadata by default. Without this privilege, backup operations fail with permission errors. Solution: Add the --no-tablespaces flag to the dbflag variable. This prevents mysqldump from attempting to access tablespace metadata, allowing backups to complete successfully without requiring the PROCESS privilege. Test Plan: 1. Set up a MySQL instance (5.7.31+ or 8.0.20+) without PROCESS privilege for the Koha database user 2. Run the koha-dump script for a Koha instance: sudo koha-dump kohadev 3. Notice the backup fails with a PROCESS privilege error 4. Apply the patch 5. Copy debian/scripts/koha-dump to /usr/sbin/koha-dump 6. Repeat step 2 7. Notice the backup now completes successfully without permission errors 8. Test restoring the dump to ensure it's valid: zcat /var/spool/koha/kohadev/kohadev-<date>.sql.gz | tail 9. Sign-off -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41353 Saiful Amin <saiful@semanticconsulting.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |saiful@semanticconsulting.c |ity.org |om Status|NEW |Needs Signoff -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41353 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |david@davidnind.com Keywords| |no-sandbox --- Comment #6 from David Nind <david@davidnind.com> --- Happy to attempt to test. However, could you provide the steps/SQL command to change the privileges? I can start up KTD with MariaDb and MySQL, so no issues with that part. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41353 --- Comment #7 from Saiful Amin <saiful@semanticconsulting.com> --- (In reply to David Nind from comment #6)
However, could you provide the steps/SQL command to change the privileges?
There is no need to change the process privilege. The PROCESS privilege is disabled by default for all users (except root) in MySQL version 8.0.20+. I think `ktd pull` will bring MySQL 8.0.45, if I have to guess. So no extra step needed apart from starting ktd with 'DB_IMAGE=mysql:8.0' -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41353 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #190076|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41353 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41353 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #194002|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41353 --- Comment #8 from David Nind <david@davidnind.com> --- Created attachment 194249 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=194249&action=edit Bug 41353: koha-dump failing on mysqldump PROCESS privileges Problem: Starting from MySQL 5.7.31 and MySQL 8.0.20, mysqldump requires the PROCESS privilege to access tablespace metadata by default. Without this privilege, backup operations fail with permission errors. Solution: Add the --no-tablespaces flag to the dbflag variable. This prevents mysqldump from attempting to access tablespace metadata, allowing backups to complete successfully without requiring the PROCESS privilege. Test Plan: 1. Set up a MySQL instance (5.7.31+ or 8.0.20+) without PROCESS privilege for the Koha database user 2. Run the koha-dump script for a Koha instance: sudo koha-dump kohadev 3. Notice the backup fails with a PROCESS privilege error 4. Apply the patch 5. Copy debian/scripts/koha-dump to /usr/sbin/koha-dump 6. Repeat step 2 7. Notice the backup now completes successfully without permission errors 8. Test restoring the dump to ensure it's valid: zcat /var/spool/koha/kohadev/kohadev-<date>.sql.gz | tail 9. Sign-off Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41353 --- Comment #9 from David Nind <david@davidnind.com> --- Thanks Saiful! Testing notes (using KTD): 1. For step 5: sudo cp debian/scripts/koha-dump /usr/sbin/koha-dump 2. After the patch, database dump works successfully without errors for MySQL and MariaDB Database dump file listing before patch (MySQL): -rw-r----- 1 root kohadev-koha 1064076 Mar 1 19:28 kohadev-2026-03-01.sql.gz -rw-r----- 1 root kohadev-koha 3990254 Mar 1 19:28 kohadev-2026-03-01.tar.gz Database dump file listing after patch (MySQL): -rw-r----- 1 root kohadev-koha 1064077 Mar 1 19:49 kohadev-2026-03-01.sql.gz -rw-r----- 1 root kohadev-koha 3991362 Mar 1 19:49 kohadev-2026-03-01.tar.gz -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41353 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |jonathan.druart@gmail.com |y.org | Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41353 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #194249|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41353 --- Comment #10 from Jonathan Druart <jonathan.druart@gmail.com> --- Created attachment 197770 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=197770&action=edit Bug 41353: koha-dump failing on mysqldump PROCESS privileges Problem: Starting from MySQL 5.7.31 and MySQL 8.0.20, mysqldump requires the PROCESS privilege to access tablespace metadata by default. Without this privilege, backup operations fail with permission errors. Solution: Add the --no-tablespaces flag to the dbflag variable. This prevents mysqldump from attempting to access tablespace metadata, allowing backups to complete successfully without requiring the PROCESS privilege. Test Plan: 1. Set up a MySQL instance (5.7.31+ or 8.0.20+) without PROCESS privilege for the Koha database user 2. Run the koha-dump script for a Koha instance: sudo koha-dump kohadev 3. Notice the backup fails with a PROCESS privilege error 4. Apply the patch 5. Copy debian/scripts/koha-dump to /usr/sbin/koha-dump 6. Repeat step 2 7. Notice the backup now completes successfully without permission errors 8. Test restoring the dump to ensure it's valid: zcat /var/spool/koha/kohadev/kohadev-<date>.sql.gz | tail 9. Sign-off Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41353 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version|25.05 |unspecified -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41353 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to main Version(s)| |26.05.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41353 --- Comment #11 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Nice work everyone! Pushed to main for 26.05 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41353 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Text to go in the| |For those using the MySQL release notes| |database. Starting from | |MySQL 5.7.31 and MySQL | |8.0.20, mysqldump requires | |the PROCESS privilege to | |access tablespace metadata | |by default. Without this | |privilege, backup | |operations fail with | |permission errors. | | | |This fixes this issue by | |adding the --no-tablespaces | |flag to the dbflag | |variable. This prevents | |mysqldump from attempting | |to access tablespace | |metadata, allowing backups | |to complete successfully | |without requiring the | |PROCESS privilege. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41353 Jacob O'Mara <jacob.omara@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |Pushed to stable Version(s)|26.05.00 |26.05.00,25.11.05 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41353 --- Comment #12 from Jacob O'Mara <jacob.omara@openfifth.co.uk> --- Thanks all, pushed to 25.11.x -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org