Sequel-ace: Authentication plugin 'dialog' cannot be loaded - file system sandbox blocked open

[mtdavidson]

• Sequel Ace Version: 2.1.1 ( Build 2053 )
• macOS Version: 10.13.6
• MySQL Version: 10.3.18-MariaDB-1:10.3.18+maria~bionic-log

Description
When trying to authenticate to a server with PAM authentication the following error is received

MySQL said: Authentication plugin 'dialog' cannot be loaded: dlopen(/usr/local/mysql/lib/plugin/dialog.so, 2): no suitable image found.  Did find:
    file system sandbox blocked open() of '/usr/local/mysql/lib/plugin/dialog.so'
    /usr/local/mysql/lib/plugin/dialog.so: stat() failed with errno=1

This previously worked in Sequel Pro version 1.1.2

I believe the issue is to do with the App Sandbox being configured.

<key>com.apple.security.app-sandbox</key>

Steps To Reproduce

1. Try to authenticate to a server using PAM authentication

Expected Behaviour
Succesful PAM authentication

Is Issue Present in Latest Beta?
Yes the issue still occurs in 2.1.2-beta4

Additional Context

[mtdavidson]

After reading about the sandbox I figured that there may be someway to grant access to the plugin I found this in the preferences

however, this results in a different error of Incompatible Client Plugin Interface

[Jason-Morcos]

Incompatible Client Plugin Interface

Is it possible that the version of the plugin you have locally is incompatible with our version of MySQL Client? Sequel Ace is running a newer MySQL client than Sequel Pro in order to support MySQL 8.
In general, I don't know if the dialog plugin is supported or will work at all. Perhaps others have used/do use the dialog plugin?

[jamesstout]

what happens if you start SA like this:

LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN=1 /Applications/Sequel\ Ace.app/Contents/MacOS/Sequel\ Ace

[jamesstout]

is it a local database? Or any chance of a test account? I just tried to configure a server, but cannot. Checked the docs:

MySQL Enterprise Edition supports an authentication method that enables MySQL Server to use PAM (Pluggable Authentication Modules)

[mtdavidson]

Thanks, both for your replies.

Still getting the same issue when using LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN, it's not a local database and is behind a firewall so unfortunately, I can't provide a test account. However, I'll try to make a docker image to recreate this and will share that with you.

[Jason-Morcos]

Perhaps this fix the Sequel Pro team was toying with would be applicable?
https://github.com/sequelpro/sequelpro/issues/2996#issuecomment-379089685
https://github.com/sequelpro/sequelpro/commits/callback-auth
@jamesstout

[churnd]

I'm having the same issue. We authenticate via LDAP by way of PAM. I have to install some mariadb packages via brew to get dialog.so on my system; I usually just install mariadb-server. I did add the dialog.so to the list of files Sequel Ace has access to:

The error I'm getting is that dialog.so isn't code signed, which I'm sure has to do with the sandboxing:

I should mention this works fine with the last nightly of Sequel Pro. Side question: would it be too much trouble to provide a non App Store build along with the App Store build?

[nbelisle11]

I'm also stuck on the same issue as above, copying the text for future searchability

MySQL said: Authentication plugin 'dialog' cannot be loaded: dlopen(/usr/local/mysql/lib/plugin/dialog.so, 2): no suitable image found. Did find:
/usr/local/mysql/lib/plugin/dialog.so: code signature in (/usr/local/mysql/lib/plugin/dialog.so) not valid for use in process using Library Validation: mapped file has no cdhash, completely unsigned? Code has to be at least ad-hoc signed.
/usr/local/mysql/lib/plugin/dialog.so: stat() failed with errno=1

[churnd]

I tried to ad-hoc codesign the dialog.so file: codesign --force --deep -s - /usr/local/Cellar/mariadb/10.4.13/lib/plugin/dialog.so

but that gave me a new error:

MySQL said: Authentication plugin 'dialog' cannot be loaded: dlopen(/usr/local/mysql/lib/plugin/dialog.so, 2): no suitable image found.  Did find:
    /usr/local/mysql/lib/plugin/dialog.so: code signature in (/usr/local/mysql/lib/plugin/dialog.so) not valid for use in process using Library Validation: mapped file has no Team ID and is not a platform binary (signed with custom identity or adhoc?)
    /usr/local/mysql/lib/plugin/dialog.so: stat() failed with errno=1

I think we're just gonna need a non-sandboxed version of the app to get around it, or I wonder if dialog.so can be included in the app?

[snappieT]

Here's the commit where sandboxing was enabled. The last release before that commit was 2.0-beta6. I confirmed that my setup (with dialog.so) worked correctly with that release.

I agree it'd be great if we could have a branch/fork with the latest fixes, but that boolean flipped. I started going down the path of building it myself, but having an official binary would be ideal.

[Jason-Morcos]

I would rather not support both a sandboxed and non-sandboxed version of the app. I think it introduces a plethora of situations in the future where there is a bug in one version or the other and opens a big can of worms. You are welcome to continue to build your own non-sandboxed build, but I do not think we will build one or support one at this time.

On the other hand, adding support for the dialog plugin is something worth investigating and exploring. We should be able to do so from within the sandbox. The issue is not impossibility, it's just that nobody has had the bandwidth to fully dig into this yet.

@Sequel-Ace/all

[mbroo]

I get the same 'incompatible client plugin interface' error for all current maria offerings in brew (eg 10.1, 10.2, 10.3, 10.4 and 10.5). Doesn't matter if I am using the App Store version or the community release via cask.