mirror/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-02-22 13:23:07 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions
mariadb/support-files/policy/apparmor
History
Exact
Daniel Black 8a1904d782 MDEV-33301 memlock with systemd still not working 
CapabilityBoundingSet included CAP_IPC_LOCK in MDEV-9095, however
it requires that the executable has the capability marked in extended
attributes also.

The alternate to this is raising the RLIMIT_MEMLOCK for the service/
process to be able to complete the mlockall system call. This needs to
be adjusted to whatever the MariaDB server was going to allocate.
Rather than leave the non-obvious mapping of settings and tuning,
add the capability so its easier for the user.

We set the capability, if possible, but may never be used depending
on user settings. As such in the Debian postinst script, don't
complain if this fails.

The CAP_IPC_LOCK also facilitates the mmaping of huge memory pages.
(see man mmap), like mariadb uses with --large-pages.
2024-02-15 12:58:13 +11:00
..
README package new SELinux/AppArmor policies instead of old ones 2015-09-04 10:32:02 +02:00
usr.sbin.mysqld MDEV-33301 memlock with systemd still not working 2024-02-15 12:58:13 +11:00
usr.sbin.mysqld.local package new SELinux/AppArmor policies instead of old ones 2015-09-04 10:32:02 +02:00

README 

Note: The included AppArmor profiles can be used for MariaDB Galera cluster.
However, since these profiles had been tested for a limited set of scenarios,
it is highly recommended to run them in "complain" mode and report any denials
on mariadb.org/jira.