Skip to content

Commit

Permalink
PKG-38 SElinux blocks PS from writing telemetry if semanage is not pr…
Browse files Browse the repository at this point in the history 
…esent

PKG-40 AA profile update

(cherry picked from commit b43c182)
  • Loading branch information
@surbhat1595
surbhat1595 committed Jun 27, 2024
1 parent 3daa680 commit 353e667
Show file tree
Hide file tree
Showing 3 changed files with 31 additions and 42 deletions.
4 changes: 0 additions & 4 deletions build-ps/debian/extra/apparmor-profile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -75,10 +75,6 @@
# Allow access to openssl config
/etc/ssl/openssl.cnf r,

# Allow access to PS Telemetry directory
/usr/local/percona/telemetry/ps/ rw,
/usr/local/percona/telemetry/ps/** rw,

# Site-specific additions and overrides. See local/README for details.
#include <local/usr.sbin.mysqld>
}
57 changes: 25 additions & 32 deletions build-ps/debian/percona-server-server.postinst
View file
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,29 @@ check_exit_status() {
fi
}

# PKG-40 To check if the apparmor profile has been changed on the user's system
# If the file has been changed, append telemetry rules to the file
# If unchanged, install the new apparmor profile
check_apparmor_files() {
if ! diff -q /etc/apparmor.d/usr.sbin.mysqld /etc/apparmor.d/old_apparmor >/dev/null; then
sed -i 's: # Site-specific additions and overrides. See local/README for details.::' /etc/apparmor.d/usr.sbin.mysqld
sed -i 's: #include <local/usr.sbin.mysqld>::' /etc/apparmor.d/usr.sbin.mysqld
sed -i '$ s/}//' /etc/apparmor.d/usr.sbin.mysqld
echo "# Allow access to PS telemetry directory" >> /etc/apparmor.d/usr.sbin.mysqld
echo " /usr/local/percona/telemetry/ps/ rw," >> /etc/apparmor.d/usr.sbin.mysqld
echo " /usr/local/percona/telemetry/ps/** rw," >> /etc/apparmor.d/usr.sbin.mysqld
echo "" >> /etc/apparmor.d/usr.sbin.mysqld
echo " # Site-specific additions and overrides. See local/README for details." >> /etc/apparmor.d/usr.sbin.mysqld
echo " #include <local/usr.sbin.mysqld>" >> /etc/apparmor.d/usr.sbin.mysqld
echo "}" >> /etc/apparmor.d/usr.sbin.mysqld
sed -r -i ':a; /^\s*$/ {N;ba}; s/( *\n *){2,}/\n/' /etc/apparmor.d/usr.sbin.mysqld
rm -f /etc/apparmor.d/usr.sbin.mysqld.in2
else
mv -f /etc/apparmor.d/usr.sbin.mysqld.in2 /etc/apparmor.d/usr.sbin.mysqld
fi
}


MY_BASEDIR_VERSION=$(my_print_defaults --loose-verbose mysqld server | grep basedir | awk -F'=' '{print $2}')
TOKUDB=$(dpkg -l | grep -c 'percona-server-tokudb')
if [ $TOKUDB = 1 ]
Expand Down Expand Up @@ -133,22 +156,7 @@ case "$1" in
PROFILE_ACTION="Use NEW AppArmor profile"
# If the existing AppArmor module/local profile is the proper file, we back it up
if [ -f "/etc/apparmor.d/usr.sbin.mysqld" ]; then
if ! diff -q /etc/apparmor.d/usr.sbin.mysqld /etc/apparmor.d/old_apparmor >/dev/null; then
sed -i 's: # Site-specific additions and overrides. See local/README for details.::' /etc/apparmor.d/usr.sbin.mysqld
sed -i 's: #include <local/usr.sbin.mysqld>::' /etc/apparmor.d/usr.sbin.mysqld
sed -i '$ s/}//' /etc/apparmor.d/usr.sbin.mysqld
echo "# Allow access to PS telemetry directory" >> /etc/apparmor.d/usr.sbin.mysqld
echo " /usr/local/percona/telemetry/ps/ rw," >> /etc/apparmor.d/usr.sbin.mysqld
echo " /usr/local/percona/telemetry/ps/** rw," >> /etc/apparmor.d/usr.sbin.mysqld
echo "" >> /etc/apparmor.d/usr.sbin.mysqld
echo " # Site-specific additions and overrides. See local/README for details." >> /etc/apparmor.d/usr.sbin.mysqld
echo " #include <local/usr.sbin.mysqld>" >> /etc/apparmor.d/usr.sbin.mysqld
echo "}" >> /etc/apparmor.d/usr.sbin.mysqld
sed -r -i ':a; /^\s*$/ {N;ba}; s/( *\n *){2,}/\n/' /etc/apparmor.d/usr.sbin.mysqld
rm -f /etc/apparmor.d/usr.sbin.mysqld.in2
else
mv -f /etc/apparmor.d/usr.sbin.mysqld.in2 /etc/apparmor.d/usr.sbin.mysqld
fi
check_apparmor_files
else
mv -f /etc/apparmor.d/usr.sbin.mysqld.in2 /etc/apparmor.d/usr.sbin.mysqld 2> /dev/null || true
fi
Expand Down Expand Up @@ -202,22 +210,7 @@ EOF
fi
update-alternatives --force --install /etc/mysql/my.cnf my.cnf "/etc/mysql/mysql.cnf" 300
if [ -f "/etc/apparmor.d/usr.sbin.mysqld" ]; then
if ! diff -q /etc/apparmor.d/usr.sbin.mysqld /etc/apparmor.d/old_apparmor >/dev/null; then
sed -i 's: # Site-specific additions and overrides. See local/README for details.::' /etc/apparmor.d/usr.sbin.mysqld
sed -i 's: #include <local/usr.sbin.mysqld>::' /etc/apparmor.d/usr.sbin.mysqld
sed -i '$ s/}//' /etc/apparmor.d/usr.sbin.mysqld
echo "# Allow access to PS telemetry directory" >> /etc/apparmor.d/usr.sbin.mysqld
echo " /usr/local/percona/telemetry/ps/ rw," >> /etc/apparmor.d/usr.sbin.mysqld
echo " /usr/local/percona/telemetry/ps/** rw," >> /etc/apparmor.d/usr.sbin.mysqld
echo "" >> /etc/apparmor.d/usr.sbin.mysqld
echo " # Site-specific additions and overrides. See local/README for details." >> /etc/apparmor.d/usr.sbin.mysqld
echo " #include <local/usr.sbin.mysqld>" >> /etc/apparmor.d/usr.sbin.mysqld
echo "}" >> /etc/apparmor.d/usr.sbin.mysqld
sed -r -i ':a; /^\s*$/ {N;ba}; s/( *\n *){2,}/\n/' /etc/apparmor.d/usr.sbin.mysqld
rm -f /etc/apparmor.d/usr.sbin.mysqld.in2
else
mv -f /etc/apparmor.d/usr.sbin.mysqld.in2 /etc/apparmor.d/usr.sbin.mysqld
fi
check_apparmor_files
fi
rm -f /etc/apparmor.d/old_apparmor
mv -f /etc/apparmor.d/usr.sbin.mysqld.in2 /etc/apparmor.d/usr.sbin.mysqld 2> /dev/null || true
Expand Down
12 changes: 6 additions & 6 deletions build-ps/percona-server.spec
View file
Original file line number Diff line number Diff line change
Expand Up @@ -800,12 +800,12 @@ fi
%endif
%ifarch x86_64
mkdir -p %{ps_telemetry}
chown mysql:percona-telemetry /usr/local/percona/telemetry/ps
chmod 775 /usr/local/percona/telemetry/ps
chmod g+s /usr/local/percona/telemetry/ps
chmod u+s /usr/local/percona/telemetry/ps
/usr/sbin/semanage fcontext -a -e /var/lib/mysql %{ps_telemetry}
restorecon -RvF %{ps_telemetry}
chown mysql:percona-telemetry %{ps_telemetry}
chmod 775 %{ps_telemetry}
chmod g+s %{ps_telemetry}
chmod u+s %{ps_telemetry}
chcon -t mysqld_db_t %{ps_telemetry}
chcon -u system_u %{ps_telemetry}
%endif
if [ -d /etc/percona-server.conf.d ]; then
CONF_EXISTS=$(grep "percona-server.conf.d" /etc/my.cnf | wc -l)
Expand Down

0 comments on commit 353e667

Please sign in to comment.