?????????????? ?????????????? ?????????????? ?????????????? PK<}>]Happarmor/READMEnu[Note: The included AppArmor profiles can be used for MariaDB Galera cluster. However, since these profiles had been tested for a limited set of scenarios, it is highly recommended to run them in "complain" mode and report any denials on mariadb.org/jira. PK<}>]?=L apparmor/usr.sbin.mysqldnu[# Last Modified: Fri Mar 1 18:55:47 2013 # Based on usr.sbin.mysqld packaged in mysql-server in Ubuntu. # This AppArmor profile has been copied under BSD License from # Percona XtraDB Cluster, along with some additions. #include /usr/sbin/mariadbd flags=(complain) { #include #include #include #include #include capability chown, capability dac_override, capability ipc_lock, capability setgid, capability setuid, capability sys_rawio, capability sys_resource, network tcp, /bin/dash rcx, /dev/dm-0 r, /etc/gai.conf r, /etc/group r, /etc/hosts.allow r, /etc/hosts.deny r, /etc/ld.so.cache r, /etc/mtab r, /etc/my.cnf r, /etc/mysql/*.cnf r, /etc/mysql/*.pem r, /etc/mysql/conf.d/ r, /etc/mysql/conf.d/* r, /etc/mysql/mariadb.conf.d/ r, /etc/mysql/mariadb.conf.d/* r, /etc/nsswitch.conf r, /etc/passwd r, /etc/services r, /run/mysqld/mysqld.pid w, /run/mysqld/mysqld.sock w, /sys/devices/system/cpu/ r, owner /tmp/** lk, /tmp/** rw, /usr/lib/mysql/plugin/ r, /usr/lib/mysql/plugin/*.so* mr, /usr/sbin/mariadbd mr, /usr/share/mysql/** r, /var/lib/mysql/ r, /var/lib/mysql/** rwk, /var/log/mysql.err rw, /var/log/mysql.log rw, /var/log/mysql/ r, /var/log/mysql/* rw, /run/mysqld/mysqld.pid w, /run/mysqld/mysqld.sock w, profile /bin/dash flags=(complain) { #include #include #include #include #include /bin/cat rix, /bin/dash rix, /bin/date rix, /bin/grep rix, /bin/nc.openbsd rix, /bin/netstat rix, /bin/ps rix, /bin/rm rix, /bin/sed rix, /bin/sleep rix, /bin/tar rix, /bin/which rix, /dev/tty rw, /etc/ld.so.cache r, /etc/my.cnf r, /proc/ r, /proc/*/cmdline r, /proc/*/fd/ r, /proc/*/net/dev r, /proc/*/net/if_inet6 r, /proc/*/net/tcp r, /proc/*/net/tcp6 r, /proc/*/stat r, /proc/*/status r, /proc/sys/kernel/pid_max r, /proc/tty/drivers r, /proc/uptime r, /proc/version r, /sbin/ifconfig rix, /sys/devices/system/cpu/ r, /tmp/** rw, /usr/bin/cut rix, /usr/bin/dirname rix, /usr/bin/gawk rix, /usr/bin/mysql rix, /usr/bin/perl rix, /usr/bin/seq rix, /usr/bin/wsrep_sst* rix, /usr/bin/wsrep_sst_common r, /usr/bin/mariabackup* rix, /var/lib/mysql/ r, /var/lib/mysql/** rw, /var/lib/mysql/*.log w, /var/lib/mysql/*.err w, # MariaDB additions ptrace peer=@{profile_name}, /bin/hostname rix, /bin/ip rix, /bin/mktemp rix, /bin/ss rix, /bin/sync rix, /bin/touch rix, /bin/uname rix, /etc/mysql/*.cnf r, /etc/mysql/conf.d/ r, /etc/mysql/conf.d/* r, /proc/*/attr/current r, /proc/*/fdinfo/* r, /proc/*/net/* r, /proc/locks r, /proc/sys/net/ipv4/ip_local_port_range r, /run/mysqld/mysqld.sock rw, /sbin/ip rix, /usr/bin/basename rix, /usr/bin/du rix, /usr/bin/find rix, /usr/bin/lsof rix, /usr/bin/my_print_defaults rix, /usr/bin/mysqldump rix, /usr/bin/pv rix, /usr/bin/rsync rix, /usr/bin/socat rix, /usr/bin/tail rix, /usr/bin/timeout rix, /usr/bin/xargs rix, /usr/bin/xbstream rix, } # Site-specific additions and overrides. See local/README for details. #include } PK<}>]apparmor/usr.sbin.mysqld.localnu[# Site-specific additions and overrides for usr.sbin.mysqld.. # For more details, please see /etc/apparmor.d/local/README. # This AppArmor profile has been copied under BSD License from # Percona XtraDB Cluster, along with some additions. PK<}>]/RKRRselinux/READMEnu[Note: The included SELinux policy files can be used for MariaDB Galera cluster. However, since these policies had been tested for a limited set of scenarios, it is highly recommended that you run mysqld in "permissive" mode even with these policies installed and report any denials on mariadb.org/jira. How to generate and load the policy module of MariaDB Galera cluster ? * Generate the SELinux policy module. # cd /policy/selinux/ # make -f /usr/share/selinux/devel/Makefile mariadb-server.pp * Load the generated policy module. # semodule -i /path/to/mariadb-server.pp * Lastly, run the following command to allow tcp/4568 and udp/4567. # semanage port -a -t mysqld_port_t -p tcp 4568 # semanage port -a -t mysqld_port_t -p udp 4567 How to run mysqld in permissve mode ? # semanage permissive -a mysqld_t PK<}>]*8bselinux/mariadb-server.fcnu[# This SELinux file contexts (.fc) file has been copied under New BSD License from # Percona XtraDB Cluster. /etc/init\.d/rc\.d/mysql -- gen_context(system_u:object_r:mysqld_initrc_exec_t,s0) /var/lib/mysql/.*\.log -- gen_context(system_u:object_r:mysqld_log_t,s0) /var/lib/mysql/.*\.err -- gen_context(system_u:object_r:mysqld_log_t,s0) /var/lib/mysql/.*\.pid -- gen_context(system_u:object_r:mysqld_var_run_t,s0) /var/lib/mysql/.*\.cnf -- gen_context(system_u:object_r:mysqld_etc_t,s0) /usr/bin/mariabackup.* -- gen_context(system_u:object_r:mysqld_exec_t,s0) /usr/bin/wsrep.* -- gen_context(system_u:object_r:mysqld_safe_exec_t,s0) PK<}>]selinux/mariadb-server.tenu[# This SELinux type enforcement (.te) file has been copied under New BSD License # from Percona XtraDB Cluster, along with some additions. module mariadb-server 1.0; require { type user_tmp_t; #type kerberos_master_port_t; type mysqld_safe_t; type tmp_t; type tmpfs_t; type hostname_exec_t; type ifconfig_exec_t; type sysctl_net_t; type proc_net_t; type port_t; type mysqld_t; type var_lib_t; type rsync_exec_t; type bin_t; type shell_exec_t; type anon_inodefs_t; type fixed_disk_device_t; type usermodehelper_t; class lnk_file read; class process { getattr signull }; class unix_stream_socket connectto; class capability { ipc_lock sys_resource sys_nice }; class tcp_socket { name_bind name_connect }; class file { execute setattr read create getattr execute_no_trans write ioctl open append unlink }; class sock_file { create unlink getattr }; class blk_file { read write open }; class dir { write search getattr add_name read remove_name open }; # MariaDB additions type kerberos_port_t; type tram_port_t; type mysqld_port_t; class udp_socket name_bind; class process setpgid; class netlink_tcpdiag_socket { create nlmsg_read }; } #============= mysqld_safe_t ============== allow mysqld_safe_t mysqld_t:process signull; allow mysqld_safe_t self:capability { sys_resource sys_nice }; allow mysqld_safe_t tmp_t:file { create read write open getattr unlink ioctl setattr }; allow mysqld_safe_t tmp_t:dir { write remove_name add_name }; allow mysqld_safe_t tmp_t:sock_file { getattr unlink }; allow mysqld_safe_t user_tmp_t:sock_file { getattr unlink }; allow mysqld_safe_t var_lib_t:dir { write add_name }; allow mysqld_safe_t var_lib_t:file { write ioctl setattr create open getattr append unlink }; #============= mysqld_t ============== allow mysqld_t anon_inodefs_t:file write; allow mysqld_t tmp_t:sock_file { create unlink }; allow mysqld_t tmpfs_t:dir { write search read remove_name open add_name }; allow mysqld_t tmpfs_t:file { write getattr read create unlink open }; allow mysqld_t fixed_disk_device_t:blk_file { read write open }; allow mysqld_t ifconfig_exec_t:file { read execute open execute_no_trans getattr }; #This rule allows connecting on 4444/4567/4568 #allow mysqld_t kerberos_master_port_t:tcp_socket { name_bind name_connect }; allow mysqld_t mysqld_safe_t:dir { getattr search }; allow mysqld_t mysqld_safe_t:file { read open }; allow mysqld_t self:unix_stream_socket connectto; allow mysqld_t port_t:tcp_socket { name_bind name_connect }; allow mysqld_t proc_net_t:file { read getattr open }; allow mysqld_t sysctl_net_t:dir search; allow mysqld_t var_lib_t:file { getattr open append }; allow mysqld_t var_lib_t:sock_file { create unlink getattr }; allow mysqld_t rsync_exec_t:file { read getattr open execute execute_no_trans }; allow mysqld_t self:process getattr; allow mysqld_t hostname_exec_t:file { read getattr execute open execute_no_trans }; allow mysqld_t user_tmp_t:dir { write add_name }; allow mysqld_t user_tmp_t:file create; allow mysqld_t bin_t:lnk_file read; allow mysqld_t tmp_t:file { append create read write open getattr unlink setattr }; allow mysqld_t usermodehelper_t:file { read open }; # Allows too much leeway - the mariabackup/wsrep rules in fc should fix it, but # keep for the moment. allow mysqld_t shell_exec_t:file { execute_no_trans getattr read execute open }; allow mysqld_t bin_t:file { getattr read execute open execute_no_trans ioctl }; # MariaDB additions allow mysqld_t self:process setpgid; allow mysqld_t self:capability { ipc_lock }; # This rule allows port tcp/4444 allow mysqld_t kerberos_port_t:tcp_socket { name_bind name_connect }; # This rule allows port tcp/4567 (tram_port_t may not be available on # older versions) allow mysqld_t tram_port_t:tcp_socket name_bind; # This rule allows port udp/4567 (see README) allow mysqld_t mysqld_port_t:udp_socket name_bind; # Rules related to mariabackup allow mysqld_t self:netlink_tcpdiag_socket { create nlmsg_read }; allow mysqld_t sysctl_net_t:file { read getattr open }; PK<}>]o@{{selinux/mariadb.ppnu[||SE Linux Modulemariadb1.0@ capabilitysetgidsetuidobject_r@@@@ @mysqld_safe_t@@@@@@@@@@@@@@@@@@@@@@@@@ capabilityobject_r mysqld_safe_tPK<}>]^e selinux/mariadb.tenu[module mariadb 1.0; require { type mysqld_safe_t; class capability { setuid setgid }; } #============= mysqld_safe_t ============== allow mysqld_safe_t self:capability { setuid setgid }; PK<}>]Happarmor/READMEnu[PK<}>]?=L ?apparmor/usr.sbin.mysqldnu[PK<}>]sapparmor/usr.sbin.mysqld.localnu[PK<}>]/RKRRselinux/READMEnu[PK<}>]*8b@selinux/mariadb-server.fcnu[PK<}>] selinux/mariadb-server.tenu[PK<}>]o@{{'selinux/mariadb.ppnu[PK<}>]^e *selinux/mariadb.tenu[PK+