13

I have followed the instructions here to set up a Galera cluster. The instruction says I need to disable appArmor:

Disabling AppArmor

By default, some servers—for instance, Ubuntu—include AppArmor, which may prevent mysqld from opening additional ports or running scripts. You must disable AppArmor or configure it to allow mysqld...

So I followed the instructions and executed, the following commands:

sudo ln -s /etc/apparmor.d/usr /etc/apparmor.d/disable/.sbin.mysqld
sudo service apparmor restart

I have completed the cluster configuration. But I am not sure if I have correctly disabled the AppArmor, because when I run:

sudo aa-status

I get:

... some more output here
2 processes have profiles defined.
1 processes are in enforce mode.
   /usr/sbin/mysqld (1938)
1 processes are in complain mode.
snap.amazon-ssm-agent.amazon-ssm-agent (1295)
0 processes are unconfined but have a profile defined.

I see mysqld is in enforce mode... what does this mean? Does it mean AppArmor is disabled for MySQL? Is it possible to disable AppArmor all together?

Improve this question

2 Answers 2

Reset to default
18

AppArmor confinement is provided via profiles loaded into the kernel, typically on boot. AppArmor profiles can be in one of two modes: enforcement and complain. Profiles loaded in enforcement mode will result in enforcement of the policy defined in the profile as well as reporting policy violation attempts (either via syslog or auditd). Profiles in complain mode will not enforce policy but instead report policy violation attempts.

  • "What does it mean?"; It means restrictions for the AppArmor profile for mysql will be enforced.

  • "Can it be disabled"; yes it can, how:

    sudo ln -s /etc/apparmor.d/{profile.name-here} /etc/apparmor.d/disable/    
sudo apparmor_parser -R /etc/apparmor.d/{profile.name-name-here}

Example:

sudo ln -s /etc/apparmor.d/usr.sbin.mysqld /etc/apparmor.d/disable/
sudo apparmor_parser -R /etc/apparmor.d/usr.sbin.mysqld

Then run the command sudo aa-status to see if the mysql profile is loaded.

To re-enable:

sudo rm /etc/apparmor.d/disable/usr.sbin.mysqld
sudo apparmor_parser -r /etc/apparmor.d/usr.sbin.mysqld
sudo aa-status

See:

https://www.cyberciti.biz/faq/ubuntu-linux-howto-disable-apparmor-commands/

https://wiki.ubuntu.com/AppArmor

https://help.ubuntu.com/community/AppArmor

Improve this answer
2
  • 1
    thank you! I had issues with Firefox opening downloaded files. the ~/.xsession-errors file showed errors related to permissions. I disabled apparmour profile corresponding to firefox and reloading it helped :-)
    – asgs
    Sep 27, 2021 at 12:44
  • Thanks for the solution! Does anyone know why App Armor is incompatible with MySQL? I read the links above, but it's pretty hard to understand unless you're an OS programmer.
    – Andrew Koster
    Feb 16, 2022 at 19:59
17

If you're getting an error in 20.04 when storing a password in a keychain, that's AppArmor securing snap applications.

You can fix this by clicking "Permissions" in Ubuntu Software when viewing the MySQL Workbench app. Turn on the reading/writing passwords permission.

Improve this answer
1
  • Is this an answer to a different question?
    – Andrew Koster
    Feb 16, 2022 at 19:54

Not the answer you're looking for? Browse other questions tagged or ask your own question.