4

I think I have an old profile (copied below).

I don't know where to look to find the correct profile.

Is there an authoritative source for standard apparmor profiles - or would this be somewhere in mysql source?

Is there a standard way to update profiles or do I have to manually figure out what it should be?

e.g.

sudo apparmor get-updated-profile-for mysql

MySQL 5.7/Ubuntu 16.04

Currently:

/etc/apparmor.d$ cat usr.sbin.mysqld 
# vim:syntax=apparmor
# Last Modified: Tue Jun 19 17:37:30 2007
#include <tunables/global>

/usr/sbin/mysqld {
#include <abstractions/base>
#include <abstractions/nameservice>
#include <abstractions/user-tmp>
#include <abstractions/mysql>
#include <abstractions/winbind>

capability dac_override,
capability sys_resource,
capability setgid,
capability setuid,

network tcp,

/etc/hosts.allow r,
/etc/hosts.deny r,
/etc/mysql/*.pem r,
/etc/mysql/conf.d/ r,
/etc/mysql/conf.d/* r,
/etc/mysql/*.cnf r,
/usr/lib/mysql/plugin/ r,
/usr/lib/mysql/plugin/*.so* mr,
/usr/sbin/mysqld mr,
/usr/share/mysql/** r,
/var/log/mysql.log rw,
/var/log/mysql.err rw,
/var/lib/mysql/ r,
/var/lib/mysql/** rwk,
/var/log/mysql/ r,
/var/log/mysql/* rw,
/var/run/mysqld/mysqld.pid rw,
/var/run/mysqld/mysqld.sock w,
/var/run/mysqld/mysqld.sock.lock rw,
/run/mysqld/mysqld.pid rw,
/run/mysqld/mysqld.sock w,
/run/mysqld/mysqld.sock.lock rw,
/sys/devices/system/cpu/ r,

# Site-specific additions and overrides. See local/README for details.
#include <local/usr.sbin.mysqld>
}
galoget
  • 223
  • 1
  • 9
Confused Vorlon
  • 171
  • 1
  • 5

2 Answers2

3

ok - so firing up a clean ubuntu server and installing mysql seems to be a reasonable way to get the 'right' profile. It is currently the following:

# vim:syntax=apparmor
# Last Modified: Tue Feb 09 15:28:30 2016
#include <tunables/global>

/usr/sbin/mysqld {
  #include <abstractions/base>
  #include <abstractions/nameservice>
  #include <abstractions/user-tmp>
  #include <abstractions/mysql>
  #include <abstractions/winbind>

# Allow system resource access
  /sys/devices/system/cpu/ r,
  capability sys_resource,
  capability dac_override,
  capability setuid,
  capability setgid,

# Allow network access
  network tcp,

  /etc/hosts.allow r,
  /etc/hosts.deny r,

# Allow config access
  /etc/mysql/** r,

# Allow pid, socket, socket lock file access
  /var/run/mysqld/mysqld.pid rw,
  /var/run/mysqld/mysqld.sock rw,
  /var/run/mysqld/mysqld.sock.lock rw,
  /run/mysqld/mysqld.pid rw,
  /run/mysqld/mysqld.sock rw,
  /run/mysqld/mysqld.sock.lock rw,

# Allow execution of server binary
  /usr/sbin/mysqld mr,
  /usr/sbin/mysqld-debug mr,

# Allow plugin access
  /usr/lib/mysql/plugin/ r,
  /usr/lib/mysql/plugin/*.so* mr,

# Allow error msg and charset access
  /usr/share/mysql/ r,
  /usr/share/mysql/** r,

# Allow data dir access
  /var/lib/mysql/ r,
  /var/lib/mysql/** rwk,

# Allow data files dir access
  /var/lib/mysql-files/ r,
  /var/lib/mysql-files/** rwk,

# Allow keyring dir access
  /var/lib/mysql-keyring/ r,
  /var/lib/mysql-keyring/** rwk,

# Allow log file access
  /var/log/mysql.err rw,
  /var/log/mysql.log rw,
  /var/log/mysql/ r,
  /var/log/mysql/** rw,

  # Site-specific additions and overrides. See local/README for details.
  #include <local/usr.sbin.mysqld>
}
Confused Vorlon
  • 171
  • 1
  • 5
-1

I error mysql cannot create ip socket with error no 13. Apparmor was set to DENY. After trying numerous apparmor configuration, I can only get it running again by setting apparmor to COMPLAIN. I use aa-complain from apparmor-utils. Mysql is running fine after that.

This may be not the greatest solution, especially for production servers.

I use it only for the localhost instances on my laptop.

Dapid Candra
  • 1
  • 1
  • 1
    Thanks for answering. But this is akin to disabling SELINUX, i.e it's "A Bad Idea". The proper solution is a valid apparmor profile, not disabling the security. This is also what the question is asking for, so your answer does not address the question. Suggest, instead, that you delete your answer and post your experience as a comment, "I did not find a valid apparmor config and was forced to reduce security." – Jeter-work Mar 18 '20 at 15:56