1

I have MySQL installed in my development machine, where I just don't need any additional security measure.

I want to move MySQL Data files to another partition, which implies a lot of change in AppAmor config, that I don't want to do since it's too much work for a simple development machine and I really don't need it.

My question is: is it safe to remove AppArmor without any side-effects to the system?

Like I said, security in this case is not really a concern.

  • Sorry but this is not the way to go. Apparmor is there for a reason. And it is not that difficult. (the change is -identical- to what you did in /etc/mysql/my.cnf). – Rinzwind May 13 '13 at 9:00
2

It would not be safe to remove AppArmor in the sense of the word. You would be disabling a security system designed to be in place for protecting you. So it would indeed make you less safe. What you want to know is: yes you can remove it without side-effects but lessen that system's security with it.

But the changes to apparmor are quite minimal, if you just want to move the MySQL DataDir to another partition. In addition I would recommend moving it to /srv/mysql and mount your partition either to /srv or to /srv/mysql for that reason (depending if you have other services on that box you want to put into /srv).

Reason behind is, that ubuntu states the /srv mountpoint/directory the place for your own (custom) service data to be deployed (srv stands for service. Should contain server specific services related data. For example, /srv/cvs contains CVS related data.)

The changes to apparmor are quite minimalistic:

vi /etc/apparmor.d/usr.sbin.mysqld and search for /var/lib/mysql and insert:

  /var/lib/mysql/ r,
  /var/lib/mysql/** rwk,
  # new location of datadir
  /srv/mysql/ r,
  /srv/mysql/** rwk,

That is enough to satisfy apparmor and you can leave it in place without needing to fiddle around with uninstalling it.

Hope that helps!

  • Always a pleasure. – JeGr May 15 '13 at 13:21
  • +1, but if I may remark: I love vi but I generally suggest to use nano in my answers. – MadMike Feb 23 '17 at 8:40
3

You can remove AppArmor without immediately killing the system. Nothing relies on it to function.

But it is there for a reason. If security really isn't a concern, that's fair enough, but if you're just doing it for a quick convenience, consider learning how to adapt the rules.

  • Ok, I'll look a little bit more on it. – Psicofrenia May 13 '13 at 9:24
2

For your specific question replace $applicationname with mysqld

The best practice way to disable apparmor for a single application is

sudo aa-complain $applicationname

or

sudo aa-complain /path/to/$applicationname.

If you install apparmor-utils you can use aa-cleanprof $applicationname to wipe the profile clean and it won't stop anything.

Keep in mind that you can easily generate a profile while in development so that you know exactly what your application needs if you were to deploy it in production.

You can install apparmor-utils and use aa-cleanprof, aa-autodep $applicationname, aa-genprof $applicationname and aa-logprof to easily build a profile specific to your use of the application.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.