主页 / user-711181

Mr. Wrong's questions

Martin Hope
Mr. Wrong
Asked: 2019-11-03 07:53:59 +0800 CST
  • 2

在此之后在我的 Ubuntu 19 安装中启动 MariaDB 失败：

nov 02 16:40:51 farnsworth systemd[1]: Starting MariaDB 10.3.17 database server...
nov 02 16:40:51 farnsworth mysqld[5328]: 2019-11-02 16:40:51 0 [Note] /usr/sbin/mysqld (mysqld 10.3.17-MariaDB-1) starting as process 5328 ...
nov 02 16:40:52 farnsworth audit[5328]: AVC apparmor="ALLOWED" operation="sendmsg" info="Failed name lookup - disconnected path" error=-13 profile="/usr/sbin/mysqld" name="run/systemd/notify" pid=5328 comm="mysqld" requested_mask="w" denied_mask="w" fsuid=123 ouid=0
nov 02 16:40:52 farnsworth audit[5328]: AVC apparmor="ALLOWED" operation="sendmsg" info="Failed name lookup - disconnected path" error=-13 profile="/usr/sbin/mysqld" name="run/systemd/notify" pid=5328 comm="mysqld" requested_mask="w" denied_mask="w" fsuid=123 ouid=0
nov 02 16:40:52 farnsworth systemd[1]: mariadb.service: Main process exited, code=exited, status=1/FAILURE

我创建了一个 apparmor 配置文件，我试图让它允许/usr/sbin/mysqld在以下位置写入权限run/systemd/notify：

# Last Modified: Fri Nov  1 22:57:29 2019
#include <tunables/global>

# vim:syntax=apparmor
# AppArmor policy for mysqld
# ###AUTHOR###
# Redacted
# ###COPYRIGHT###
# 2019
# ###COMMENT###
# Ubuntu 19/MariaDB
# No template variables specified

/usr/sbin/mysqld flags=(complain) {
  #include <abstractions/base>
  #include <abstractions/evince>
  #include <abstractions/nameservice>

  /etc/mysql/conf.d/ r,
  /etc/mysql/conf.d/mysql.cnf r,
  /etc/mysql/conf.d/mysqldump.cnf r,
  /etc/mysql/mariadb.cnf r,
  /etc/mysql/mariadb.conf.d/ r,
  /etc/mysql/mariadb.conf.d/50-client.cnf r,
  /etc/mysql/mariadb.conf.d/50-mysql-clients.cnf r,
  /etc/mysql/mariadb.conf.d/50-mysqld_safe.cnf r,
  /etc/mysql/mariadb.conf.d/50-server.cnf r,
  /run/systemd/notify w,
  /usr/sbin/mysqld rk,
  /var/lib/mysql/** rw,
  /var/log/mysql/** r,
  owner /var/lib/mysql/ r,
  owner /var/lib/mysql/** rwk,
  owner /var/log/mysql/** rw,
}

有趣的是，MariaDB 需要的文件是（绝对路径），而它请求对（没有起始斜线，所以是相对路径）的/run/systemd/notify写入权限。run/systemd/notify但是删除斜线会使配置文件失败：

$ sudo apparmor_parser -r /etc/apparmor.d/usr.sbin.mysqld 
AppArmor parser error for /etc/apparmor.d/usr.sbin.mysqld in /etc/apparmor.d/usr.sbin.mysqld at line 29: syntax error, unexpected TOK_ID, expecting TOK_MODE

但是，当我将配置文件置于抱怨模式，然后让 apparmor 找出是否需要任何更改时，它没有发现任何问题：

$ sudo aa-complain mysqld
Setting /usr/sbin/mysqld to complain mode.

$ sudo aa-logprof
Reading log entries from /var/log/audit/audit.log.
Updating AppArmor profiles in /etc/apparmor.d.
Complain-mode changes:

有谁知道这个文件的路径设置在哪里？

apparmor mariadb
Martin Hope
Mr. Wrong
Asked: 2018-09-29 06:11:44 +0800 CST
  • 8

为了试用 jdk11 的新功能，我将它安装到 /opt/ 并希望使用 update-alternatives 来使用它，如下所示：

sudo update-alternatives --install /etc/alternatives/java OpenJDK-11 /opt/jdk-11/bin/java 1102

返回：

update-alternatives: using /opt/jdk-11/bin/javac to provide /etc/alternatives/java (OpenJDK-11) in auto mode

但是，当我这样做时

$ sudo update-alternatives --config java

我没有看到我刚刚安装的jdk。相反，我收到警告和已经存在的选择：

update-alternatives: warning: /etc/alternatives/java has been changed (manually or by a script); switching to manual updates only
There are 2 choices for the alternative java (providing /usr/bin/java).

  Selection    Path                                            Priority   Status
------------------------------------------------------------
  0            /usr/lib/jvm/java-11-openjdk-amd64/bin/java      1101      auto mode
  1            /usr/lib/jvm/java-11-openjdk-amd64/bin/java      1101      manual mode
  2            /usr/lib/jvm/java-8-openjdk-amd64/jre/bin/java   1081      manual mode

警告是什么意思，为什么它实际上同时显示自动和手动模式条目？为什么我的jdk11不在里面？

openjdk update-alternatives