mirror of
https://github.com/MariaDB/server.git
synced 2025-01-27 09:14:17 +01:00
8a1904d782
CapabilityBoundingSet included CAP_IPC_LOCK in MDEV-9095, however it requires that the executable has the capability marked in extended attributes also. The alternate to this is raising the RLIMIT_MEMLOCK for the service/ process to be able to complete the mlockall system call. This needs to be adjusted to whatever the MariaDB server was going to allocate. Rather than leave the non-obvious mapping of settings and tuning, add the capability so its easier for the user. We set the capability, if possible, but may never be used depending on user settings. As such in the Debian postinst script, don't complain if this fails. The CAP_IPC_LOCK also facilitates the mmaping of huge memory pages. (see man mmap), like mariadb uses with --large-pages. |
||
|---|---|---|
| .. | ||
| mariadb-server.fc | ||
| mariadb-server.te | ||
| mariadb.te | ||
| README | ||
Note: The included SELinux policy files can be used for MariaDB Galera cluster.
However, since these policies had been tested for a limited set of scenarios,
it is highly recommended that you run mysqld in "permissive" mode even with
these policies installed and report any denials on mariadb.org/jira.
How to generate and load the policy module of MariaDB Galera cluster ?
* Generate the SELinux policy module.
# cd <source>/policy/selinux/
# make -f /usr/share/selinux/devel/Makefile mariadb-server.pp
* Load the generated policy module.
# semodule -i /path/to/mariadb-server.pp
* Lastly, run the following command to allow tcp/4568 and udp/4567.
# semanage port -a -t mysqld_port_t -p tcp 4568
# semanage port -a -t mysqld_port_t -p udp 4567
How to run mysqld in permissve mode ?
# semanage permissive -a mysqld_t