主页 / ubuntu / 问题 / 1185710
Accepted
Mr. Wrong
Asked: 2019-11-03 07:53:59 +0800 CST

尽管 apparmor 配置文件，MariaDB 还是失败了

  • 772

在此之后在我的 Ubuntu 19 安装中启动 MariaDB 失败：

nov 02 16:40:51 farnsworth systemd[1]: Starting MariaDB 10.3.17 database server...
nov 02 16:40:51 farnsworth mysqld[5328]: 2019-11-02 16:40:51 0 [Note] /usr/sbin/mysqld (mysqld 10.3.17-MariaDB-1) starting as process 5328 ...
nov 02 16:40:52 farnsworth audit[5328]: AVC apparmor="ALLOWED" operation="sendmsg" info="Failed name lookup - disconnected path" error=-13 profile="/usr/sbin/mysqld" name="run/systemd/notify" pid=5328 comm="mysqld" requested_mask="w" denied_mask="w" fsuid=123 ouid=0
nov 02 16:40:52 farnsworth audit[5328]: AVC apparmor="ALLOWED" operation="sendmsg" info="Failed name lookup - disconnected path" error=-13 profile="/usr/sbin/mysqld" name="run/systemd/notify" pid=5328 comm="mysqld" requested_mask="w" denied_mask="w" fsuid=123 ouid=0
nov 02 16:40:52 farnsworth systemd[1]: mariadb.service: Main process exited, code=exited, status=1/FAILURE

我创建了一个 apparmor 配置文件，我试图让它允许/usr/sbin/mysqld在以下位置写入权限run/systemd/notify：

# Last Modified: Fri Nov  1 22:57:29 2019
#include <tunables/global>

# vim:syntax=apparmor
# AppArmor policy for mysqld
# ###AUTHOR###
# Redacted
# ###COPYRIGHT###
# 2019
# ###COMMENT###
# Ubuntu 19/MariaDB
# No template variables specified

/usr/sbin/mysqld flags=(complain) {
  #include <abstractions/base>
  #include <abstractions/evince>
  #include <abstractions/nameservice>

  /etc/mysql/conf.d/ r,
  /etc/mysql/conf.d/mysql.cnf r,
  /etc/mysql/conf.d/mysqldump.cnf r,
  /etc/mysql/mariadb.cnf r,
  /etc/mysql/mariadb.conf.d/ r,
  /etc/mysql/mariadb.conf.d/50-client.cnf r,
  /etc/mysql/mariadb.conf.d/50-mysql-clients.cnf r,
  /etc/mysql/mariadb.conf.d/50-mysqld_safe.cnf r,
  /etc/mysql/mariadb.conf.d/50-server.cnf r,
  /run/systemd/notify w,
  /usr/sbin/mysqld rk,
  /var/lib/mysql/** rw,
  /var/log/mysql/** r,
  owner /var/lib/mysql/ r,
  owner /var/lib/mysql/** rwk,
  owner /var/log/mysql/** rw,
}

有趣的是，MariaDB 需要的文件是（绝对路径），而它请求对（没有起始斜线，所以是相对路径）的/run/systemd/notify写入权限。run/systemd/notify但是删除斜线会使配置文件失败：

$ sudo apparmor_parser -r /etc/apparmor.d/usr.sbin.mysqld 
AppArmor parser error for /etc/apparmor.d/usr.sbin.mysqld in /etc/apparmor.d/usr.sbin.mysqld at line 29: syntax error, unexpected TOK_ID, expecting TOK_MODE

但是，当我将配置文件置于抱怨模式，然后让 apparmor 找出是否需要任何更改时，它没有发现任何问题：

$ sudo aa-complain mysqld
Setting /usr/sbin/mysqld to complain mode.

$ sudo aa-logprof
Reading log entries from /var/log/audit/audit.log.
Updating AppArmor profiles in /etc/apparmor.d.
Complain-mode changes:

有谁知道这个文件的路径设置在哪里？

apparmor mariadb

2 个回答

  1. Best Answer

    好的，我遇到了完全相同的问题，刚刚解决了！

    在您的 apparmor 配置中添加：

    # Allow Systemd notify access                                                                                                                                                                                                                       
/{,var/}run/systemd/notify w,

    并将以下行从

    /usr/sbin/mysqld flags=(complain) {

    至

    /usr/sbin/mysqld flags=(attach_disconnected,complain) {

    然后给它一个好的 ole

    sudo /etc/init.d/apparmor reload && sudo systemctl restart mysqld && sudo systemctl status mysqld

    这是我usr.sbin.mysqld正在使用 MariaDB 10.3.20 的 18.04的副本

    # vim:syntax=apparmor
# Last Modified: Tue Feb 09 15:28:30 2016
#include <tunables/global>

/usr/sbin/mysqld flags=(attach_disconnected,complain) {
  #include <abstractions/base>
  #include <abstractions/nameservice>
  #include <abstractions/user-tmp>
  #include <abstractions/mysql>
  #include <abstractions/winbind>

# Allow system resource access
  /sys/devices/system/cpu/ r,
  capability sys_resource,
  capability dac_override,
  capability setuid,
  capability setgid,

# Allow network access
  network tcp,

  /etc/hosts.allow r,
  /etc/hosts.deny r,

# Allow config access
  /etc/mysql/** r,

# Allow pid, socket, socket lock file access
  /var/run/mysqld/mysqld.pid rw,
  /var/run/mysqld/mysqld.sock rw,
  /var/run/mysqld/mysqld.sock.lock rw,
  /run/mysqld/mysqld.pid rw,
  /run/mysqld/mysqld.sock rw,
  /run/mysqld/mysqld.sock.lock rw,

# Allow execution of server binary
  /usr/sbin/mysqld mr,
  /usr/sbin/mysqld-debug mr,

# Allow plugin access
  /usr/lib/mysql/plugin/ r,
  /usr/lib/mysql/plugin/*.so* mr,

# Allow error msg and charset access
  /usr/share/mysql/ r,
  /usr/share/mysql/** r,

# Allow data dir access
  /var/lib/mysql/ r,
  /var/lib/mysql/** rwk,

# Allow data files dir access
  /var/lib/mysql-files/ r,
  /var/lib/mysql-files/** rwk,

# Allow keyring dir access
  /var/lib/mysql-keyring/ r,
  /var/lib/mysql-keyring/** rwk,

# Allow log file access
  /var/log/mysql.err rw,
  /var/log/mysql.log rw,
  /var/log/mysql/ r,
  /var/log/mysql/** rw,

# Allow SystemD ACCESS
  /{,var/}run/systemd/notify w,

  # Site-specific additions and overrides. See local/README for details.
}
    • 6

  2. 看来他们搞砸了。我今天刚刚测试过，Apparmor 配置（19.10）包含一个免责声明，即 mysqld 是“故意为空的”，因为它不会提供任何好处。但是，mysqld-akonadi 的配置有几个规则集。Akonadi 有效，普通的 MariaDB 无效。无赖！

    • 0

相关问题