'/var/lib/mysql/mysql.sock' (13 "Permission denied") when accessing the socket as non mysql user

Question

I am trying to connect to local mysql server I use for development

The server starts fine, but I can not connect to it as a non-root user.

[root@somepc ]# mysql -u [someuser] -p[somepass]
ERROR 2002 (HY000): Can't connect to local MySQL server through socket '/var/lib/mysql/mysql.sock' (13 "Permission denied")

As root, this works as expected. So that user does have permissions to access mysql.

mysql -u [user] -p[password]
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 2
Server version: 10.1.30-MariaDB MariaDB Server

Copyright (c) 2000, 2017, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

When I check the permission of as my user

stat /var/lib/mysql/mysql.sock
stat: cannot stat '/var/lib/mysql/mysql.sock': Permission denied

What should these permission be for a non-root user?

Answer 1

The problem was related to the error on permissions on the socket file

namei -l /var/lib/mysql/mysql.sock                                                                                                                                               Wed 07 Feb 2018 12:53:54 SAST
f: /var/lib/mysql/mysql.sock
drwxr-xr-x root  root  /
drwxr-xr-x root  root  var
drwxr-xr-x root  root  lib
drwx------ mysql mysql mysql
                       mysql.sock - No such file or directory

As root I can see that the permissions on the socket file are

 ll /var/lib/mysql/mysql.sock
 srwxrwxrwx 1 mysql mysql 0 07.02.2018 12:42 /var/lib/mysql/mysql.sock=

So the problem is the directory for mysql as can be seen above.

drwx------ mysql mysql mysql

I fixed this by giving everybody access. As this is my local machine used for development.

sudo chmod go+rx /var/lib/mysql/

On a production machine, I would consider the correct users to the mysql group.

sudo chmod g+rx /var/lib/mysql/

grep mysql /etc/group
mysql:x:89:[someusers]

Please use common sense and replace whatever you need between the [] above

This now works as expected

mysql -u [user] -p[password]
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 2
Server version: 10.1.30-MariaDB MariaDB Server

Copyright (c) 2000, 2017, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

Answer 2

Another solution to this problem was to not use the socket when connecting.

mysql -u [aaron] -p[aarw] -h 127.0.0.1
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 2
Server version: 10.1.30-MariaDB MariaDB Server

Copyright (c) 2000, 2017, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

Your user would need to have the correct grants to connect to the server. Either of these could work.

-- Grants for '[username]'@'localhost'
GRANT ALL PRIVILEGES ON *.* TO '[username]'@'localhost' IDENTIFIED BY PASSWORD '*somehash' WITH GRANT OPTION;
GRANT ALL PRIVILEGES ON `%`.* TO '[username]'@'localhost' WITH GRANT OPTION;

You need to understand the security implications of what that does before you run it. Allow all hosts to connect, include anywhere on the internet.

-- Grants for '[username]'@'%'
GRANT ALL PRIVILEGES ON *.* TO '[username]'@'%' IDENTIFIED BY PASSWORD '*somehash' WITH GRANT OPTION;
GRANT ALL PRIVILEGES ON `%`.* TO '[username]'@'%' WITH GRANT OPTION;