|
| 1 | +# vim:syntax=apparmor |
| 2 | +# Last Modified: Tue Feb 09 15:28:30 2016 |
| 3 | +#include <tunables/global> |
| 4 | + |
| 5 | +/usr/sbin/mysqld { |
| 6 | + #include <abstractions/base> |
| 7 | + #include <abstractions/nameservice> |
| 8 | + #include <abstractions/user-tmp> |
| 9 | + #include <abstractions/mysql> |
| 10 | + #include <abstractions/winbind> |
| 11 | + |
| 12 | +# Allow system resource access |
| 13 | + /sys/devices/system/cpu/ r, |
| 14 | + capability sys_resource, |
| 15 | + capability dac_override, |
| 16 | + capability setuid, |
| 17 | + capability setgid, |
| 18 | + |
| 19 | +# Allow network access |
| 20 | + network tcp, |
| 21 | + |
| 22 | + /etc/hosts.allow r, |
| 23 | + /etc/hosts.deny r, |
| 24 | + |
| 25 | +# Allow config access |
| 26 | + /etc/mysql/** r, |
| 27 | + |
| 28 | +# Allow pid, socket, socket lock file access |
| 29 | + /var/run/mysqld/mysqld.pid rw, |
| 30 | + /var/run/mysqld/mysqld.sock rw, |
| 31 | + /var/run/mysqld/mysqld.sock.lock rw, |
| 32 | + /run/mysqld/mysqld.pid rw, |
| 33 | + /run/mysqld/mysqld.sock rw, |
| 34 | + /run/mysqld/mysqld.sock.lock rw, |
| 35 | + |
| 36 | +# Allow execution of server binary |
| 37 | + /usr/sbin/mysqld mr, |
| 38 | + /usr/sbin/mysqld-debug mr, |
| 39 | + |
| 40 | +# Allow plugin access |
| 41 | + /usr/lib/mysql/plugin/ r, |
| 42 | + /usr/lib/mysql/plugin/*.so* mr, |
| 43 | + |
| 44 | +# Allow error msg and charset access |
| 45 | + /usr/share/mysql/ r, |
| 46 | + /usr/share/mysql/** r, |
| 47 | + |
| 48 | +# Allow data dir access |
| 49 | + /var/lib/mysql/ r, |
| 50 | + /var/lib/mysql/** rwk, |
| 51 | + |
| 52 | +# Allow data files dir access |
| 53 | + /var/lib/mysql-files/ r, |
| 54 | + /var/lib/mysql-files/** rwk, |
| 55 | + |
| 56 | +# Allow keyring dir access |
| 57 | + /var/lib/mysql-keyring/ r, |
| 58 | + /var/lib/mysql-keyring/** rwk, |
| 59 | + |
| 60 | +# Allow log file access |
| 61 | + /var/log/mysql.err rw, |
| 62 | + /var/log/mysql.log rw, |
| 63 | + /var/log/mysql/ r, |
| 64 | + /var/log/mysql/** rw, |
| 65 | + |
| 66 | + # Site-specific additions and overrides. See local/README for details. |
| 67 | + #include <local/usr.sbin.mysqld> |
| 68 | +} |
0 commit comments