☰

尽管有 apparmor 配置文件，MariaDB 仍失败

tag-icon • tag-icon apparmor mariadb
尽管有 apparmor 配置文件，MariaDB 仍失败

在以下情况下，我在 Ubuntu 19 安装上启动 MariaDB 失败：

nov 02 16:40:51 farnsworth systemd[1]: Starting MariaDB 10.3.17 database server...
nov 02 16:40:51 farnsworth mysqld[5328]: 2019-11-02 16:40:51 0 [Note] /usr/sbin/mysqld (mysqld 10.3.17-MariaDB-1) starting as process 5328 ...
nov 02 16:40:52 farnsworth audit[5328]: AVC apparmor="ALLOWED" operation="sendmsg" info="Failed name lookup - disconnected path" error=-13 profile="/usr/sbin/mysqld" name="run/systemd/notify" pid=5328 comm="mysqld" requested_mask="w" denied_mask="w" fsuid=123 ouid=0
nov 02 16:40:52 farnsworth audit[5328]: AVC apparmor="ALLOWED" operation="sendmsg" info="Failed name lookup - disconnected path" error=-13 profile="/usr/sbin/mysqld" name="run/systemd/notify" pid=5328 comm="mysqld" requested_mask="w" denied_mask="w" fsuid=123 ouid=0
nov 02 16:40:52 farnsworth systemd[1]: mariadb.service: Main process exited, code=exited, status=1/FAILURE

我已经创建了一个 apparmor 配置文件，并试图让它允许/usr/sbin/mysqld写入权限run/systemd/notify：

# Last Modified: Fri Nov  1 22:57:29 2019
#include <tunables/global>

# vim:syntax=apparmor
# AppArmor policy for mysqld
# ###AUTHOR###
# Redacted
# ###COPYRIGHT###
# 2019
# ###COMMENT###
# Ubuntu 19/MariaDB
# No template variables specified

/usr/sbin/mysqld flags=(complain) {
  #include <abstractions/base>
  #include <abstractions/evince>
  #include <abstractions/nameservice>

  /etc/mysql/conf.d/ r,
  /etc/mysql/conf.d/mysql.cnf r,
  /etc/mysql/conf.d/mysqldump.cnf r,
  /etc/mysql/mariadb.cnf r,
  /etc/mysql/mariadb.conf.d/ r,
  /etc/mysql/mariadb.conf.d/50-client.cnf r,
  /etc/mysql/mariadb.conf.d/50-mysql-clients.cnf r,
  /etc/mysql/mariadb.conf.d/50-mysqld_safe.cnf r,
  /etc/mysql/mariadb.conf.d/50-server.cnf r,
  /run/systemd/notify w,
  /usr/sbin/mysqld rk,
  /var/lib/mysql/** rw,
  /var/log/mysql/** r,
  owner /var/lib/mysql/ r,
  owner /var/lib/mysql/** rwk,
  owner /var/log/mysql/** rw,
}

有趣的是，MariaDB 需要的文件是/run/systemd/notify(绝对路径)，而它请求的写入权限是run/systemd/notify(没有起始斜杠，因此是相对路径)。但删除斜杠会导致配置文件失败：

$ sudo apparmor_parser -r /etc/apparmor.d/usr.sbin.mysqld 
AppArmor parser error for /etc/apparmor.d/usr.sbin.mysqld in /etc/apparmor.d/usr.sbin.mysqld at line 29: syntax error, unexpected TOK_ID, expecting TOK_MODE

但是，当我将配置文件置于投诉模式，然后让 apparmor 查明是否需要进行任何更改时，它没有发现任何问题：

$ sudo aa-complain mysqld
Setting /usr/sbin/mysqld to complain mode.

$ sudo aa-logprof
Reading log entries from /var/log/audit/audit.log.
Updating AppArmor profiles in /etc/apparmor.d.
Complain-mode changes:

有人知道这个文件的路径设置在哪里吗？

答案1

好的，我遇到了完全相同的问题并且刚刚解决了！

在您的 apparmor 配置中添加：

# Allow Systemd notify access                                                                                                                                                                                                                       
/{,var/}run/systemd/notify w,

并将以下行从

/usr/sbin/mysqld flags=(complain) {

到

/usr/sbin/mysqld flags=(attach_disconnected,complain) {

然后给它一个好的

sudo /etc/init.d/apparmor reload && sudo systemctl restart mysqld && sudo systemctl status mysqld

这是我的一份副本usr.sbin.mysqld，运行于 18.04 和 MariaDB 10.3.20

# vim:syntax=apparmor
# Last Modified: Tue Feb 09 15:28:30 2016
#include <tunables/global>

/usr/sbin/mysqld flags=(attach_disconnected,complain) {
  #include <abstractions/base>
  #include <abstractions/nameservice>
  #include <abstractions/user-tmp>
  #include <abstractions/mysql>
  #include <abstractions/winbind>

# Allow system resource access
  /sys/devices/system/cpu/ r,
  capability sys_resource,
  capability dac_override,
  capability setuid,
  capability setgid,

# Allow network access
  network tcp,

  /etc/hosts.allow r,
  /etc/hosts.deny r,

# Allow config access
  /etc/mysql/** r,

# Allow pid, socket, socket lock file access
  /var/run/mysqld/mysqld.pid rw,
  /var/run/mysqld/mysqld.sock rw,
  /var/run/mysqld/mysqld.sock.lock rw,
  /run/mysqld/mysqld.pid rw,
  /run/mysqld/mysqld.sock rw,
  /run/mysqld/mysqld.sock.lock rw,

# Allow execution of server binary
  /usr/sbin/mysqld mr,
  /usr/sbin/mysqld-debug mr,

# Allow plugin access
  /usr/lib/mysql/plugin/ r,
  /usr/lib/mysql/plugin/*.so* mr,

# Allow error msg and charset access
  /usr/share/mysql/ r,
  /usr/share/mysql/** r,

# Allow data dir access
  /var/lib/mysql/ r,
  /var/lib/mysql/** rwk,

# Allow data files dir access
  /var/lib/mysql-files/ r,
  /var/lib/mysql-files/** rwk,

# Allow keyring dir access
  /var/lib/mysql-keyring/ r,
  /var/lib/mysql-keyring/** rwk,

# Allow log file access
  /var/log/mysql.err rw,
  /var/log/mysql.log rw,
  /var/log/mysql/ r,
  /var/log/mysql/** rw,

# Allow SystemD ACCESS
  /{,var/}run/systemd/notify w,

  # Site-specific additions and overrides. See local/README for details.
}

答案2

看来他们搞砸了。我今天刚刚测试过，Apparmor 配置 (19.10) 包含一个免责声明，即它对 mysqld 来说是“故意为空的”，因为它不会带来任何好处。但是，mysqld-akonadi 的配置设置了几条规则。Akonadi 可以工作，但普通的 MariaDB 不行。真扫兴！

相关内容