Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-33301

memlock with systemd still not working even with MDEV-9095 fix

Details

    Description

      Trying to use memlock with sysyemD on either Ubuntu or Rocky Linux always gives me

      [Warning] Failed to lock memory. Errno: 12

      even with CAP_IPC_LOCK in place as per MDEV-9095.

      The machines I tested on had plenty of memory (128MB buffer pool on a 4GB VM), so it is clearly not just memory size related.

      Tested with all 10.6 and 11.3 on Rocky Linux, and 10.1, 10.6 and 11.3 on Ubuntu

      Attachments

        Issue Links

          causes

          Bug - A problem which impairs or prevents the functions of the product. MDEV-33776 Setting RPM caps on mariadbd instead of mysqld creates permission errors and failing RPM installs

          • Blocker - Blocks development and/or testing work, production could not run.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-36229 MariaDB effectively running as root CAP_DAC_OVERRIDE

          • Blocker - Blocks development and/or testing work, production could not run.
          • Closed
          is duplicated by

          Bug - A problem which impairs or prevents the functions of the product. MDEV-33776 Setting RPM caps on mariadbd instead of mysqld creates permission errors and failing RPM installs

          • Blocker - Blocks development and/or testing work, production could not run.
          • Closed
          relates to

          Bug - A problem which impairs or prevents the functions of the product. MDBF-666 have apparmor enabled on Ubuntu VMs for testing

          • Major - Major loss of function.
          • Open

          Bug - A problem which impairs or prevents the functions of the product. MDEV-9095 [PATCH] systemd capability for --memlock

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-36229 MariaDB effectively running as root CAP_DAC_OVERRIDE

          • Blocker - Blocks development and/or testing work, production could not run.
          • Closed
          links to

          Web Link openssl issue 21770

          Activity

            Ascending order - Click to sort in descending order
            View 13 older comments
            danblack Daniel Black added a comment -

            pls review gh server branch bb-10.5-MDEV-33301-alternate-capset (70e46c07d344caecd66108626cdbd0caaff81d19)

            danblack Daniel Black added a comment - pls review gh server branch bb-10.5- MDEV-33301 -alternate-capset (70e46c07d344caecd66108626cdbd0caaff81d19)
            danblack Daniel Black added a comment -

            illuusio, yes includes and apparmor adding of the capability, but yes we do need to test in CI. MDBF-666

            danblack Daniel Black added a comment - illuusio , yes includes and apparmor adding of the capability, but yes we do need to test in CI. MDBF-666
            serg Sergei Golubchik added a comment -

            danblack,

            • I see that 70e46c07d344cae does not revert changes in cpack_rpm.cmake. Do you mean it should be applied after git revert 8a1904d7825 ?
            • old buildbot will verify that tls tests work. Are there any tests for memlock anywhere?
            serg Sergei Golubchik added a comment - danblack , I see that 70e46c07d344cae does not revert changes in cpack_rpm.cmake . Do you mean it should be applied after git revert 8a1904d7825 ? old buildbot will verify that tls tests work. Are there any tests for memlock anywhere?
            danblack Daniel Black added a comment - - edited

            The commit behind 70e46c07d344cae^ does the revert (of a few fixes).

            > Are there any tests for memlock anywhere?

            Not currently, same with large pages too. I think they can be added to the install/upgrade tests.

            danblack Daniel Black added a comment - - edited The commit behind 70e46c07d344cae^ does the revert (of a few fixes). > Are there any tests for memlock anywhere? Not currently, same with large pages too. I think they can be added to the install/upgrade tests.
            serg Sergei Golubchik added a comment -

            ok to push

            serg Sergei Golubchik added a comment - ok to push

            People

              danblack Daniel Black
              hholzgra Hartmut Holzgraefe
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.