[MDEV-24277] policy support files missing from "our" Ubuntu packages Created: 2020-11-25 Updated: 2021-04-05 |
|
| Status: | Stalled |
| Project: | MariaDB Server |
| Component/s: | Packaging, Platform Debian |
| Affects Version/s: | 10.4.17, 10.5.8 |
| Fix Version/s: | 10.4, 10.5 |
| Type: | Bug | Priority: | Major |
| Reporter: | Hartmut Holzgraefe | Assignee: | Otto Kekäläinen |
| Resolution: | Unresolved | Votes: | 0 |
| Labels: | None | ||
| Description |
|
Original MariaDB mariadb-server ubuntu packages install selinux and apparmor policy templates from the github support-files/policy source folder to /usr/share/mysql/policy Our own mariadb-server packages do not include these files, so when switching from distro packages to our own this information is lost. |
| Comments |
| Comment by Sergei Golubchik [ 2021-01-26 ] | ||||||||||||||||||||
|
what version is it? | ||||||||||||||||||||
| Comment by Hartmut Holzgraefe [ 2021-01-26 ] | ||||||||||||||||||||
|
Original customer support was for 10.4, it is the same for latest10.5 still | ||||||||||||||||||||
| Comment by Otto Kekäläinen [ 2021-04-04 ] | ||||||||||||||||||||
|
We have the following files in 10.5 sources:
These are practically unmaintained, there is nobody testing or updating the SELinux or AppArmor profiles, thus they are very likely to stop the server from doing completely valid things as the system access whitelists are outdated.
In my opinion we should not ship these. If some distro is shipping them, I guess they have their own versions that they are maintaining. The priority would be to encourage them to submit their updated SELinux or AppArmor policies upstream first. We should ship these only once the policy files are indeed up-to-date and preferably also used somethere to run MTR or other testing to validate that they work at least in the most basic use case. | ||||||||||||||||||||
| Comment by Sergei Golubchik [ 2021-04-05 ] | ||||||||||||||||||||
|
mariadb.te is supported, maintained, and installed. |