Hello! Just as a reminder about this topic: at the moment MariaDB 5.5 has no effective AppArmor profile. I am happy to accept pull requests / patches for it, if somebody more knowledgeable in AppArmor profile generation wants to supply one.
Debian official packaging repo: http://anonscm.debian.org/gitweb/?p=pkg-mysql/mariadb-5.5.git A Github mirror for easy pull requests: https://github.com/ottok/mariadb-5.5 2014-02-22 19:49 GMT+02:00 Otto Kekäläinen <[email protected]>: > Helllo! > > 2014-02-22 19:41 GMT+02:00 Felix Geyer <[email protected]>: >> -Slave_open_temp_tables 0 >> +Slave_open_temp_tables 1 >> >> mysqltest: Result content mismatch >> >> not ok > > This is ok, this "error" is not marked as an actual error in the test > suite and it happens at least in all of the build environments I use. > > >> There are a few denied permissions: >> >> apparmor="DENIED" operation="mknod" parent=13650 profile="/usr/sbin/mysqld" >> name="/usr/share/mysql/mysql-test/<hostname>.lower-test" pid=13654 >> comm="mysqld" >> requested_mask="c" denied_mask="c" fsuid=0 ouid=0 >> apparmor="DENIED" operation="open" parent=26824 profile="/usr/sbin/mysqld" >> name="/etc/" pid=26826 >> comm="mysqld" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 >> apparmor="DENIED" operation="open" parent=26863 profile="/usr/sbin/mysqld" >> name="/etc/pam.d/other" >> pid=26895 comm="mysqld" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 >> apparmor="DENIED" operation="capable" parent=27197 >> profile="/usr/sbin/mysqld" pid=27231 >> comm="mysqld" pid=27231 comm="mysqld" capability=36 capname="block_suspend" >> >> Just before the access to /etc/pam.d/other mariadb logs: >> mysqld: PAM pam_end: NULL pam handle passed >> >> The first one is obviously only requested by the test suite, not sure about >> the others. > > > I guess it is ok to add mysql-test paths to the profile, as an > attacker would not benefit of such access anyway. > > Unlike MySQL, MariaDB has PAM authentication integration. So that > probably needs some extra AppArmor rules too? > > > Please send me a updated profile if you are handy at writing them :) > > - Otto > > > -- > Check out our blog at http://seravo.fi/blog > and follow @ottokekalainen -- Check out our blog at http://seravo.fi/blog and follow @ottokekalainen -- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
