0

I am getting mysql to run on a ecryptfs filesystem in a standard LAMP stack running in DigitalOcean Ubuntu 18.04.2 for a Wordpress website.

It is running well with the process below, except that AppArmor needs to be disabled for MySQL to start (on the ecryptfs mount), and as I am running CIVICRM on Wordpress, there still are quirky behaviours relating to queries on the database that is not responded well. However, overall at this stage, WP is up and running. The process I've used below is to make a copy of the mysql folder into a ecrypfs folder and bind mount it back to /var/lib/mysql to sidestep changes in my.cnf and apparmor. However, mysql still refuse to start until I remove the apparmor profile for mysql.

  1. install ecryptfs

    sudo apt-get update
    sudo apt-get install ecryptfs-utils
    
  2. stop mysql service

    sudo service mysql stop
    
  3. make the encrypted folder

    sudo mkdir /usr/local/enc/mysql
    
  4. rename the current mysql folder

    sudo cd /var/lib
    sudo mv mysql mysql.bak
    
  5. mount encrypted folder onto mysql folder

    sudo mount -t ecryptfs /usr/local/enc/mysql /var/lib/mysql
    

    There will be questions asked, I have taken the default [1,1,n,n,yes]

    Or, you can add do a automount add the following line via nano /etc/fstab, but the password will need to be here as well which is not secure:

    /usr/local/enc/mysql /var/lib/mysql ecryptfs key=passphrase:passwd=xxxxxxxx,ecryptfs_cipher=aes,ecryptfs_key_bytes=16,ecryptfs_passthrough=n,ecryptfs_enable_filename_crypto=n 0 0

  6. copy all contents with their permission from current mysql folder to the encrypted folder

    sudo cp -R -p /var/lib/mysql.bak /var/lib/mysql
    
  7. move the content in /var/lib/mysql 1 level up

    sudo cd /var/lib/mysql
    sudo mv mysql.bak/* .
    sudo rmdir mysql.bak
    
  8. at this point you can check that files are in clear in /var/lib/mysql but the associated files in /usr/local/enc/mysql are gibberish/encrypted

  9. try to restart mysql, only to be met with error

    sudo service mysql start
    
    Job for mysql.service failed because the control process exited with error code.
    See "systemctl status mysql.service" and "journalctl -xe" for details.
    

10. After checking that all permissions of the 2 folders are correct, I tried disabling apparmor for mysql with following steps

    sudo ln -s /etc/apparmor.d/usr.sbin.mysqld /etc/apparmor.d/disable/
    sudo apparmor_parser -R /etc/apparmor.d/usr.sbin.mysqld 

  1. Add the encrypted folder as alias into apparmor

    sudo nano /etc/apparmor.d/tunables/alias
    
    add this line to the file:
    alias /var/lib/mysql -> /usr/local/enc/mysql/,
    
  2. And mysql can start now, my Wordpress works too

    sudo service mysql start
    

However, I am still keen to get Apparmor working right rather than disabling the mysql profile. Any advise on how this can be done?

2 Answers 2

0

I did some more digging and I think i got the answer. Despite what i saw from some posts that apparmor does not care about the mount source folder, apparantly it does look to where the source folder is from when doing the mount. this is actually good security. i tried adding the source folder as an alias in apparmor and it now works. i have also change the mount to automount. the quirk that I last described also went away. I will edit my orginal post for these points.

A follow up question I have now is the performance for having ecryptfs supporting mysql, any pointers for this? Thanks.

0

My experience with AppArmor, mysql, and encryptfs, is you must alias BOTH the source bits, and the mounted bits in

/etc/apparmor.d/tunables/alias

alias /var/lib/mysql/ -> /usr/local/encrypted-source/mysql/,
alias /var/lib/mysql/ -> /usr/local/encrypted/mysql/,

Note this is Ubuntu 20.04

Have a look in /etc/apparmor.d/usr.sbin.mysqld and a lot became evident when looking there.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.