Merge lp:~raghavendra-prabhu/percona-server/bug-1131102 into lp:percona-server/5.6

[Raghavendra D Prabhu]

Selinux and Apparmor policies.

[Alexey Kopytov (akopytov)]

This should be resubmitted for lp:percona-server/5.5 (as lp:percona-server was recently repointed to lp:percona-server/5.6).

review: Needs Resubmitting

=== added directory 'policy'
=== added directory 'policy/apparmor'
=== added file 'policy/apparmor/usr.sbin.mysqld'
--- policy/apparmor/usr.sbin.mysqld	1970-01-01 00:00:00 +0000
+++ policy/apparmor/usr.sbin.mysqld	2013-03-08 16:46:26 +0000
@@ -0,0 +1,61 @@
+# Last Modified: Thu Mar  7 21:58:51 2013
+# Based on usr.sbin.mysqld packaged in mysql-server in Ubuntu.
+# For Percona Server and Percona XtraDB Cluster
+
+#include <tunables/global>
+
+/usr/sbin/mysqld flags=(complain) {
+  #include <abstractions/base>
+  #include <abstractions/mysql>
+  #include <abstractions/nameservice>
+  #include <abstractions/user-tmp>
+  #include <abstractions/winbind>
+  #include <local/usr.sbin.mysqld>
+
+
+  capability chown,
+  capability dac_override,
+  capability setgid,
+  capability setuid,
+  capability sys_rawio,
+  capability sys_resource,
+
+  network tcp,
+
+
+  /dev/dm-0 r,
+  /etc/group r,
+  /etc/gai.conf r,
+  /etc/hosts.allow r,
+  /etc/hosts.deny r,
+  /etc/ld.so.cache r,
+  /etc/mtab r,
+  /etc/my.cnf r,
+  /etc/mysql/*.cnf r,
+  /etc/mysql/*.pem r,
+  /etc/mysql/conf.d/ r,
+  /etc/mysql/conf.d/* r,
+  /etc/nsswitch.conf r,
+  /etc/passwd r,
+  /etc/services r,
+  /run/mysqld/mysqld.pid w,
+  /run/mysqld/mysqld.sock w,
+  /sys/devices/system/cpu/ r,
+  owner /tmp/** lk,
+  /tmp/** rw,
+  /usr/lib/mysql/plugin/ r,
+  /usr/lib/mysql/plugin/*.so* mr,
+  /usr/sbin/mysqld mr,
+  /usr/share/mysql/** r,
+  /var/lib/mysql/ r,
+  /var/lib/mysql/** rwk,
+  /var/log/mysql.err rw,
+  /var/log/mysql.log rw,
+  /var/log/mysql/ r,
+  /var/log/mysql/* rw,
+  /var/run/mysqld/mysqld.pid w,
+  /var/run/mysqld/mysqld.sock w,
+
+  # Site-specific additions and overrides. See local/README for details.
+  #include <local/usr.sbin.mysqld>
+}
 
=== added file 'policy/apparmor/usr.sbin.mysqld.local'
--- policy/apparmor/usr.sbin.mysqld.local	1970-01-01 00:00:00 +0000
+++ policy/apparmor/usr.sbin.mysqld.local	2013-03-08 16:46:26 +0000
@@ -0,0 +1,2 @@
+# Site-specific additions and overrides for usr.sbin.mysqld..
+# For more details, please see /etc/apparmor.d/local/README.
 
=== added directory 'policy/selinux'
=== added file 'policy/selinux/percona-server.fc'
--- policy/selinux/percona-server.fc	1970-01-01 00:00:00 +0000
+++ policy/selinux/percona-server.fc	2013-03-08 16:46:26 +0000
@@ -0,0 +1,6 @@
+/etc/init\.d/rc\.d/mysql -- gen_context(system_u:object_r:mysqld_initrc_exec_t,s0)
+/var/lib/mysql/.*\.log --  gen_context(system_u:object_r:mysqld_log_t,s0)
+/var/lib/mysql/.*\.err --  gen_context(system_u:object_r:mysqld_log_t,s0)
+/var/lib/mysql/.*\.pid -- gen_context(system_u:object_r:mysqld_var_run_t,s0)
+/var/lib/mysql/.*\.cnf	--  gen_context(system_u:object_r:mysqld_etc_t,s0)
+/usr/bin/xtrabackup.* -- gen_context(system_u:object_r:mysqld_exec_t,s0)
 
=== added file 'policy/selinux/percona-server.te'
--- policy/selinux/percona-server.te	1970-01-01 00:00:00 +0000
+++ policy/selinux/percona-server.te	2013-03-08 16:46:26 +0000
@@ -0,0 +1,35 @@
+# This adds few more rules in addition to mysql.pp in selinux-policy-targeted
+module percona-server 1.0;
+
+require {
+        type user_tmp_t;
+        type mysqld_safe_t;
+        type tmp_t;
+        type fixed_disk_device_t;
+        type mysqld_t;
+        type tmpfs_t;
+        class sock_file { getattr unlink create };
+        class capability { sys_nice sys_resource };
+        class blk_file { read write open };
+        class file { write getattr read create unlink open };
+        class dir { search read write remove_name open add_name };
+}
+
+#============= mysqld_safe_t ==============
+allow mysqld_safe_t self:capability { sys_nice sys_resource };
+
+allow mysqld_safe_t tmp_t:dir { write remove_name };
+allow mysqld_safe_t tmp_t:sock_file { getattr unlink };
+allow mysqld_safe_t user_tmp_t:sock_file { getattr unlink };
+
+#============= mysqld_t ==============
+allow mysqld_t fixed_disk_device_t:blk_file { read write open };
+allow mysqld_t tmp_t:sock_file { create unlink };
+
+allow mysqld_t tmpfs_t:dir { write search read remove_name open add_name };
+allow mysqld_t tmpfs_t:file { write getattr read create unlink open };
+
+allow mysqld_t user_tmp_t:dir { write add_name };
+allow mysqld_t user_tmp_t:file create;
+
+allow mysqld_t tmp_t:file { append create read write open getattr unlink setattr };