On Sat, Jun 06, 2009 at 12:34:43PM -0000, pascal wrote: > kern.log after an update: >
Relevant error messages: > audit(1244290348.293:19): operation="profile_replace" > name="/usr/sbin/mysqld" name2="default" pid=6774 > Jun 6 14:12:28 pascal-laptop kernel: [ 2951.715329] type=1505 > audit(1244290348.333:20): operation="profile_replace" > name="/usr/sbin/mysqld" name2="default" pid=6781 > Jun 6 14:12:45 pascal-laptop kernel: [ 2969.356185] type=1503 > audit(1244290365.974:25): operation="inode_create" requested_mask="a::" > denied_mask="a::" fsuid=0 name="/home/mysql/pascal-laptop.lower-test" > pid=7176 profile="/usr/sbin/mysqld" > Jun 6 14:12:45 pascal-laptop kernel: [ 2969.356259] type=1503 > audit(1244290365.974:26): operation="inode_create" requested_mask="a::" > denied_mask="a::" fsuid=0 name="/home/mysql/pascal-laptop.lower-test" > pid=7176 profile="/usr/sbin/mysqld" > Jun 6 14:12:45 pascal-laptop kernel: [ 2969.363748] type=1503 > audit(1244290365.982:27): operation="inode_permission" > requested_mask="r::" denied_mask="r::" fsuid=112 > name="/home/mysql/mysql/db.frm" pid=7179 profile="/usr/sbin/mysqld" > Jun 6 14:12:46 pascal-laptop kernel: [ 2969.403433] type=1503 > audit(1244290366.022:28): operation="inode_create" requested_mask="a::" > denied_mask="a::" fsuid=0 name="/home/mysql/pascal-laptop.lower-test" > pid=7191 profile="/usr/sbin/mysqld" > Jun 6 14:12:46 pascal-laptop kernel: [ 2969.403508] type=1503 > audit(1244290366.022:29): operation="inode_create" requested_mask="a::" > denied_mask="a::" fsuid=0 name="/home/mysql/pascal-laptop.lower-test" > pid=7191 profile="/usr/sbin/mysqld" > Jun 6 14:12:46 pascal-laptop kernel: [ 2969.407872] type=1503 > audit(1244290366.026:30): operation="inode_permission" > requested_mask="r::" denied_mask="r::" fsuid=112 > name="/home/mysql/mysql/user.frm" pid=7195 profile="/usr/sbin/mysqld" > Jun 6 14:12:46 pascal-laptop kernel: [ 2969.407921] type=1503 > audit(1244290366.026:31): operation="inode_permission" > requested_mask="r::" denied_mask="r::" fsuid=112 > name="/home/mysql/mysql/user.frm" pid=7195 profile="/usr/sbin/mysqld" > Jun 6 14:12:46 pascal-laptop kernel: [ 2969.408101] type=1503 > audit(1244290366.026:32): operation="inode_permission" > requested_mask="r::" denied_mask="r::" fsuid=112 > name="/home/mysql/mysql/user.frm" pid=7195 profile="/usr/sbin/mysqld" > Jun 6 14:12:46 pascal-laptop kernel: [ 2969.437078] type=1503 > audit(1244290366.058:33): operation="inode_create" requested_mask="a::" > denied_mask="a::" fsuid=0 name="/home/mysql/pascal-laptop.lower-test" > pid=7202 profile="/usr/sbin/mysqld" > Jun 6 14:12:46 pascal-laptop kernel: [ 2969.437463] type=1503 > audit(1244290366.058:34): operation="inode_create" requested_mask="a::" > denied_mask="a::" fsuid=0 name="/home/mysql/pascal-laptop.lower-test" > pid=7202 profile="/usr/sbin/mysqld"
So the problem is related to mysqld apparmor profile. Apparently mysqld profile has been replaced during the upgrade (first line in the audit log).
> > /etc/apparmor.d/usr.sbin.mysqld: > > # vim:syntax=apparmor > # Last Modified: Tue Jun 19 17:37:30 2007 > #include <tunables/global> > > /usr/sbin/mysqld { > #include <abstractions/base> > #include <abstractions/nameservice> > #include <abstractions/user-tmp> > #include <abstractions/mysql> > #include <abstractions/winbind> > > capability dac_override, > capability sys_resource, > capability setgid, > capability setuid, > > network tcp, > > /etc/hosts.allow r, > /etc/hosts.deny r, > > /etc/mysql/*.pem r, > /etc/mysql/conf.d/ r, > /etc/mysql/conf.d/* r, > /etc/mysql/my.cnf r, > /usr/sbin/mysqld mr, > /usr/share/mysql/** r, > /var/log/mysql.log rw, > /var/log/mysql.err rw, > /home/mysql/ r, > /home/mysql/** rwk, > /var/log/mysql/ r, > /var/log/mysql/* rw, > /var/run/mysqld/mysqld.pid w, > /var/run/mysqld/mysqld.sock w, > }
It seems that the apparmor profile is customized to allow access to /home/mysql/. Could you make sure that the correct profile has been reloaded?
-- Mathias Gug Ubuntu Developer http://www.ubuntu.com
On Sat, Jun 06, 2009 at 12:34:43PM -0000, pascal wrote:
> kern.log after an update:
>
Relevant error messages: 8.293:19) : operation= "profile_ replace" usr/sbin/ mysqld" name2="default" pid=6774 8.333:20) : operation= "profile_ replace" usr/sbin/ mysqld" name2="default" pid=6781 5.974:25) : operation= "inode_ create" requested_ mask="a: :" home/mysql/ pascal- laptop. lower-test" "/usr/sbin/ mysqld" 5.974:26) : operation= "inode_ create" requested_ mask="a: :" home/mysql/ pascal- laptop. lower-test" "/usr/sbin/ mysqld" 5.982:27) : operation= "inode_ permission" mask="r: :" denied_mask="r::" fsuid=112 home/mysql/ mysql/db. frm" pid=7179 profile= "/usr/sbin/ mysqld" 6.022:28) : operation= "inode_ create" requested_ mask="a: :" home/mysql/ pascal- laptop. lower-test" "/usr/sbin/ mysqld" 6.022:29) : operation= "inode_ create" requested_ mask="a: :" home/mysql/ pascal- laptop. lower-test" "/usr/sbin/ mysqld" 6.026:30) : operation= "inode_ permission" mask="r: :" denied_mask="r::" fsuid=112 home/mysql/ mysql/user. frm" pid=7195 profile= "/usr/sbin/ mysqld" 6.026:31) : operation= "inode_ permission" mask="r: :" denied_mask="r::" fsuid=112 home/mysql/ mysql/user. frm" pid=7195 profile= "/usr/sbin/ mysqld" 6.026:32) : operation= "inode_ permission" mask="r: :" denied_mask="r::" fsuid=112 home/mysql/ mysql/user. frm" pid=7195 profile= "/usr/sbin/ mysqld" 6.058:33) : operation= "inode_ create" requested_ mask="a: :" home/mysql/ pascal- laptop. lower-test" "/usr/sbin/ mysqld" 6.058:34) : operation= "inode_ create" requested_ mask="a: :" home/mysql/ pascal- laptop. lower-test" "/usr/sbin/ mysqld"
> audit(124429034
> name="/
> Jun 6 14:12:28 pascal-laptop kernel: [ 2951.715329] type=1505
> audit(124429034
> name="/
> Jun 6 14:12:45 pascal-laptop kernel: [ 2969.356185] type=1503
> audit(124429036
> denied_mask="a::" fsuid=0 name="/
> pid=7176 profile=
> Jun 6 14:12:45 pascal-laptop kernel: [ 2969.356259] type=1503
> audit(124429036
> denied_mask="a::" fsuid=0 name="/
> pid=7176 profile=
> Jun 6 14:12:45 pascal-laptop kernel: [ 2969.363748] type=1503
> audit(124429036
> requested_
> name="/
> Jun 6 14:12:46 pascal-laptop kernel: [ 2969.403433] type=1503
> audit(124429036
> denied_mask="a::" fsuid=0 name="/
> pid=7191 profile=
> Jun 6 14:12:46 pascal-laptop kernel: [ 2969.403508] type=1503
> audit(124429036
> denied_mask="a::" fsuid=0 name="/
> pid=7191 profile=
> Jun 6 14:12:46 pascal-laptop kernel: [ 2969.407872] type=1503
> audit(124429036
> requested_
> name="/
> Jun 6 14:12:46 pascal-laptop kernel: [ 2969.407921] type=1503
> audit(124429036
> requested_
> name="/
> Jun 6 14:12:46 pascal-laptop kernel: [ 2969.408101] type=1503
> audit(124429036
> requested_
> name="/
> Jun 6 14:12:46 pascal-laptop kernel: [ 2969.437078] type=1503
> audit(124429036
> denied_mask="a::" fsuid=0 name="/
> pid=7202 profile=
> Jun 6 14:12:46 pascal-laptop kernel: [ 2969.437463] type=1503
> audit(124429036
> denied_mask="a::" fsuid=0 name="/
> pid=7202 profile=
So the problem is related to mysqld apparmor profile. Apparently mysqld
profile has been replaced during the upgrade (first line in the audit
log).
> d/usr.sbin. mysqld: nameservice> user-tmp> mysql> winbind> mysqld/ mysqld. pid w, mysqld/ mysqld. sock w,
> /etc/apparmor.
>
> # vim:syntax=apparmor
> # Last Modified: Tue Jun 19 17:37:30 2007
> #include <tunables/global>
>
> /usr/sbin/mysqld {
> #include <abstractions/base>
> #include <abstractions/
> #include <abstractions/
> #include <abstractions/
> #include <abstractions/
>
> capability dac_override,
> capability sys_resource,
> capability setgid,
> capability setuid,
>
> network tcp,
>
> /etc/hosts.allow r,
> /etc/hosts.deny r,
>
> /etc/mysql/*.pem r,
> /etc/mysql/conf.d/ r,
> /etc/mysql/conf.d/* r,
> /etc/mysql/my.cnf r,
> /usr/sbin/mysqld mr,
> /usr/share/mysql/** r,
> /var/log/mysql.log rw,
> /var/log/mysql.err rw,
> /home/mysql/ r,
> /home/mysql/** rwk,
> /var/log/mysql/ r,
> /var/log/mysql/* rw,
> /var/run/
> /var/run/
> }
It seems that the apparmor profile is customized to allow access to
/home/mysql/. Could you make sure that the correct profile has been
reloaded?
-- www.ubuntu. com
Mathias Gug
Ubuntu Developer http://