Home / ubuntu / Questions / 1185710
Accepted
Mr. Wrong
Asked: 2019-11-03 07:53:59 +0800 CST

MariaDB fails despite apparmor profile

  • 772

Starting MariaDB fails on my Ubuntu 19 installation after this:

nov 02 16:40:51 farnsworth systemd[1]: Starting MariaDB 10.3.17 database server...
nov 02 16:40:51 farnsworth mysqld[5328]: 2019-11-02 16:40:51 0 [Note] /usr/sbin/mysqld (mysqld 10.3.17-MariaDB-1) starting as process 5328 ...
nov 02 16:40:52 farnsworth audit[5328]: AVC apparmor="ALLOWED" operation="sendmsg" info="Failed name lookup - disconnected path" error=-13 profile="/usr/sbin/mysqld" name="run/systemd/notify" pid=5328 comm="mysqld" requested_mask="w" denied_mask="w" fsuid=123 ouid=0
nov 02 16:40:52 farnsworth audit[5328]: AVC apparmor="ALLOWED" operation="sendmsg" info="Failed name lookup - disconnected path" error=-13 profile="/usr/sbin/mysqld" name="run/systemd/notify" pid=5328 comm="mysqld" requested_mask="w" denied_mask="w" fsuid=123 ouid=0
nov 02 16:40:52 farnsworth systemd[1]: mariadb.service: Main process exited, code=exited, status=1/FAILURE

I have created an apparmor profile where I'm trying to make it allow /usr/sbin/mysqld writing rights on run/systemd/notify:

# Last Modified: Fri Nov  1 22:57:29 2019
#include <tunables/global>

# vim:syntax=apparmor
# AppArmor policy for mysqld
# ###AUTHOR###
# Redacted
# ###COPYRIGHT###
# 2019
# ###COMMENT###
# Ubuntu 19/MariaDB
# No template variables specified

/usr/sbin/mysqld flags=(complain) {
  #include <abstractions/base>
  #include <abstractions/evince>
  #include <abstractions/nameservice>

  /etc/mysql/conf.d/ r,
  /etc/mysql/conf.d/mysql.cnf r,
  /etc/mysql/conf.d/mysqldump.cnf r,
  /etc/mysql/mariadb.cnf r,
  /etc/mysql/mariadb.conf.d/ r,
  /etc/mysql/mariadb.conf.d/50-client.cnf r,
  /etc/mysql/mariadb.conf.d/50-mysql-clients.cnf r,
  /etc/mysql/mariadb.conf.d/50-mysqld_safe.cnf r,
  /etc/mysql/mariadb.conf.d/50-server.cnf r,
  /run/systemd/notify w,
  /usr/sbin/mysqld rk,
  /var/lib/mysql/** rw,
  /var/log/mysql/** r,
  owner /var/lib/mysql/ r,
  owner /var/lib/mysql/** rwk,
  owner /var/log/mysql/** rw,
}

The funny thing is, the file MariaDB needs is /run/systemd/notify (absolute path) while it requests writing rights to run/systemd/notify (no starting slash, so relative path). But removing the slash makes the profile fail:

$ sudo apparmor_parser -r /etc/apparmor.d/usr.sbin.mysqld 
AppArmor parser error for /etc/apparmor.d/usr.sbin.mysqld in /etc/apparmor.d/usr.sbin.mysqld at line 29: syntax error, unexpected TOK_ID, expecting TOK_MODE

However, when I put the profile in complain mode and then let apparmor find out if any changes are needed, it doesn't find any problems:

$ sudo aa-complain mysqld
Setting /usr/sbin/mysqld to complain mode.

$ sudo aa-logprof
Reading log entries from /var/log/audit/audit.log.
Updating AppArmor profiles in /etc/apparmor.d.
Complain-mode changes:

Does anyone know where the path to this this file is set?

apparmor mariadb

2 Answers

  1. Best Answer

    Ok, I had the exact same issue and just fixed it!

    In your apparmor config add:

    # Allow Systemd notify access                                                                                                                                                                                                                       
/{,var/}run/systemd/notify w,

    And change the follwoing line from

    /usr/sbin/mysqld flags=(complain) {

    to

    /usr/sbin/mysqld flags=(attach_disconnected,complain) {

    Then give it a good ole

    sudo /etc/init.d/apparmor reload && sudo systemctl restart mysqld && sudo systemctl status mysqld

    Here is a copy of my usr.sbin.mysqld that is working on 18.04 w/ MariaDB 10.3.20

    # vim:syntax=apparmor
# Last Modified: Tue Feb 09 15:28:30 2016
#include <tunables/global>

/usr/sbin/mysqld flags=(attach_disconnected,complain) {
  #include <abstractions/base>
  #include <abstractions/nameservice>
  #include <abstractions/user-tmp>
  #include <abstractions/mysql>
  #include <abstractions/winbind>

# Allow system resource access
  /sys/devices/system/cpu/ r,
  capability sys_resource,
  capability dac_override,
  capability setuid,
  capability setgid,

# Allow network access
  network tcp,

  /etc/hosts.allow r,
  /etc/hosts.deny r,

# Allow config access
  /etc/mysql/** r,

# Allow pid, socket, socket lock file access
  /var/run/mysqld/mysqld.pid rw,
  /var/run/mysqld/mysqld.sock rw,
  /var/run/mysqld/mysqld.sock.lock rw,
  /run/mysqld/mysqld.pid rw,
  /run/mysqld/mysqld.sock rw,
  /run/mysqld/mysqld.sock.lock rw,

# Allow execution of server binary
  /usr/sbin/mysqld mr,
  /usr/sbin/mysqld-debug mr,

# Allow plugin access
  /usr/lib/mysql/plugin/ r,
  /usr/lib/mysql/plugin/*.so* mr,

# Allow error msg and charset access
  /usr/share/mysql/ r,
  /usr/share/mysql/** r,

# Allow data dir access
  /var/lib/mysql/ r,
  /var/lib/mysql/** rwk,

# Allow data files dir access
  /var/lib/mysql-files/ r,
  /var/lib/mysql-files/** rwk,

# Allow keyring dir access
  /var/lib/mysql-keyring/ r,
  /var/lib/mysql-keyring/** rwk,

# Allow log file access
  /var/log/mysql.err rw,
  /var/log/mysql.log rw,
  /var/log/mysql/ r,
  /var/log/mysql/** rw,

# Allow SystemD ACCESS
  /{,var/}run/systemd/notify w,

  # Site-specific additions and overrides. See local/README for details.
}
    • 6

  2. It seems they messed up. I just tested today and the Apparmor configuration (19.10) contains a disclaimer that it is "Intentionally empty" for mysqld since it would not provide any benefit. However, the config for mysqld-akonadi has several rules set. Akonadi works, plain MariaDB doesn't. Bummer!

    • 0