Move the `shellQuote` helper out of `clickhouse install` into
`Common/shellQuote.h` so it can be reused. Apply it to two more
shell-command construction sites:
- `formatWithSudo` on FreeBSD wraps the inner command in `su -c '...'`.
All current callers pass static literals, but an embedded single
quote would break the wrapper. Quote the command via `shellQuote`
so future callers can pass arbitrary strings safely.
- `clickhouse git-import` interpolates a commit hash parsed from
`git log --pretty=%H` into `git show ... {hash}` and runs it via
`/bin/sh -c`. `%H` is hex-only today, but a hand-crafted hash list
or a future format change should not be able to inject shell
syntax through the input.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
`changeOwnership`, `createGroup`, `createUser`, and the `setcap`
invocation in `clickhouse install` interpolated CLI-controlled values
(`--user`, `--group`, `--log-path`, `--data-path`, `--pid-path`,
`--config-path`, `--binary-path`, `--prefix`) directly into shell
command strings passed to `/bin/sh -c`. The `shellQuote` helper
already used by the sudo invocation in the same file was not applied
elsewhere. Wrap every interpolated value in `shellQuote` so shell
metacharacters in CLI arguments cannot be interpreted by the shell.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
`--group` for `clickhouse start` / `restart` had a default value of
`clickhouse` purely for documentation. The launcher applied it
unconditionally on the `sudo` path, so
clickhouse start --user alice
was silently expanded to `sudo --preserve-env -u alice -g clickhouse ...`.
That fails when `alice` is not a member of the `clickhouse` group,
which is a behavior regression for users who only ever passed `--user`.
Clear `group` in `mainEntryClickHouseStart` and `mainEntryClickHouseRestart`
when `options["group"].defaulted()` is true, so the default is shown in
`--help` but not applied to the spawned server. The `no-sudo` path then
runs `clickhouse su user:`, where `setUserAndGroup` falls back to the
user's primary group.
The `--group` option for `clickhouse start` / `restart` was only honored on
the `--no-sudo` branch (`clickhouse su user:group ...`). On the default path
the command was built as `sudo --preserve-env -u <user> ...`, with no `-g`,
so the group was silently ignored.
Pass `-g <group>` to `sudo` (shell-quoted) when `group` is non-empty so the
advertised CLI option takes effect on both code paths.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
The previous attempt to harden the `--no-sudo` and `sudo` paths in
`clickhouse start` wrapped interpolated `user`, `group`, and binary
paths in single quotes only. This is insufficient: a value containing
a single quote (e.g. `bob';rm -rf /;'`) still breaks out because
single quotes do not nest.
Introduce a POSIX-compliant `shellQuote` helper in `Install.cpp` and
apply it to every user-controlled field interpolated into the `su` /
`sudo` command strings: `executable`, `config`, `pid_file`,
`binary`, `user`, and `group`. The helper replaces any `'` inside
the value with `'\''` before re-wrapping, which is the standard POSIX
idiom and safe against arbitrary byte content.
While CLI arguments to `clickhouse start` are not typically attacker
controlled (the caller already runs the binary), defense-in-depth is
worthwhile: these commands go through `/bin/sh -c` via
`ShellCommand::execute`, and unquoted interpolation has been flagged
as a hazard in code review.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
- `printHelp` now takes an `std::ostream &` parameter: explicit `help`
writes to stdout, while `printHelpOnError` (mistyped commands) writes
to stderr, preserving the error-output contract for scripts.
- Shell-quote binary path and user:group in the `--no-sudo` branch of
`clickhouse start` to prevent command injection via crafted CLI args.
- Make the keeper availability check in the help return codes test more
precise: match `clickhouse keeper [args]` exactly instead of bare
`keeper` which could false-match `keeper-converter` etc.
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
The original PR #96025 was reverted (#98038) because:
1. The install completion message showed wrong relative paths like
`var/run/clickhouse-server` instead of absolute `/var/run/clickhouse-server`.
This happened because `options.contains()` returns true even for options
with default values in boost::program_options. Fix: use `defaulted()`
to only include options that the user explicitly specified.
2. The install completion message did not suggest `sudo` for the
start/restart command. This happened because `getuid() != 0` is false
when install runs as root via sudo, but the user returns to their
unprivileged shell afterward. Fix: always suggest sudo (matching the
original behavior).
Also address review feedback:
- Fix `clickhouse-client` help: remove misleading "initial table definition"
(a `clickhouse-local` concept) from usage line
- Fix typo: "as command line tool" → "as a command line tool"
- Fix `clickhouse-local` help grammar: "After you can execute" → "After that,
you can execute", "in first query" → "in the first query"
- Make keeper `--help` test robust for builds without `ENABLE_CLICKHOUSE_KEEPER`
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
Add `static` to file-local functions and forward declarations
for cross-TU functions to satisfy `-Wmissing-prototypes`.
This ensures all functions have visible prototypes before their
definitions, improving code quality and catching accidental
linkage issues.
Reference: https://github.com/ClickHouse/ClickHouse/issues/76944
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
- Remove "CMake doesn't recognize changes in #embed-ed files" comments
from all files, since this PR now tracks those dependencies.
- Add conditional `OBJECT_DEPENDS` for `FrequencyHolder.cpp` NLP blobs
(guarded by `if (EXISTS ...)` for when the submodule is not checked out).
- Add `OBJECT_DEPENDS` for `attachInformationSchemaTables.cpp` which was
also missing dependency tracking for its embedded SQL files.
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
Extract `ErrnoException` into `Common/ErrnoException.h` to reduce the
include footprint of `Exception.h`. This removes `<base/errnoToString.h>`
and `<cerrno>` from `Exception.h`, which is included by ~95% of all
translation units.
All files referencing `ErrnoException` now include the new header
directly. Files that used `errnoToString` without `ErrnoException`
got an explicit `<base/errnoToString.h>` include.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
- Add --group option to start and restart commands
- Use clickhouse su instead of sudo when --no-sudo is set
- Pass --prefix, --pid-path, --config-path, --binary-path, --user, --group
from install to the suggested start/restart command
Co-Authored-By: Claude Opus 4.5 <[email protected]>
This commit improves the help output for all ClickHouse applications:
- Add `clickhouse help` command that lists all available subcommands
- Return exit code 0 for all help messages (previously some returned 1)
- Output help messages to stdout instead of stderr
- Use "clickhouse <cmd>" format instead of argv[0] in help messages
- Add dynamic `app_name` detection for `clickhouse client` and `clickhouse local`
to show correct invocation name based on how the binary was called
- Add `--no-sudo` option for `clickhouse start` and `clickhouse restart`
for environments without sudo (e.g., Docker containers)
- Add detailed help headers and footers for client and local with usage examples
Closes#58244
Co-Authored-By: Claude Opus 4.5 <[email protected]>
Previously it was only shipped as part of the client package, now it
will be bundled into the binary, and will be available as:
- clickhouse chdig
- clickhouse-chdig
- chdig
Note, that since now chdig will not be linked, we can remove all
quirks for this, that has been done in #79666
Components like client/server/... are very generic, and there is no
point in disabling them, since it does not reduce amount of compiled
code a lot anyway (just a few modules for entrypoints, everything else
is already included in the clickhouse binary), and eventually they are
just symlinks to the clickhouse binary.
But there are few, that requires extra libraries, like ODBC bridge or
keeper components (and there is also standalone keeper binary compiled
with musl), those had been kept.
Also add some descriptions for some utils and change exit code to 0 for
--help.
Signed-off-by: Azat Khuzhin <[email protected]>
