[SRU] upstart script does not load AppArmor profile

The following should fix it...

Statement of Impact:

Mysql that was shipped with lucid is currently running unconfined. This is due apparmor has not been converted to upstart yet, however mysql has.

How this bug has been addressed:

apparmor has been enabled in the init script. There should be no regressions with this change.

How to reproduce:

1. Start mysql server.
2. Check to see if the profile has been enforced: aa-status

There should be no regressions with this change.

Two questions:

 * Did we ship the same AppArmor rules in Karmic, or were they changed/tightened during lucid? In the latter case, this would be quite an extensive change, since Lucid hasn't been tested with AppArmor protection for MySQL.

 * Does the command actually enable AA protection for mysql already, or just causes the later startup of AA to actually retroactively protect the running daemon?

Yes we did have AppArmor rules in karmic, and I aware of one change during lucid to the apparmor rules. For the second question, I am not sure.

chuck

Accepted mysql-dfsg-5.1 into lucid-proposed, the package will build now and be available in a few hours. Please test and give feedback here. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you in advance!

Before update:

chuck@lucid-test:~$ sudo aa-status
[sudo] password for chuck:
apparmor module is loaded.
5 profiles are loaded.
5 profiles are in enforce mode.
   /sbin/dhclient3
   /usr/lib/NetworkManager/nm-dhcp-client.action
   /usr/lib/connman/scripts/dhclient-script
   /usr/sbin/mysqld
   /usr/sbin/tcpdump
0 profiles are in complain mode.
2 processes have profiles defined.
1 processes are in enforce mode :
   /sbin/dhclient3 (810)
0 processes are in complain mode.
1 processes are unconfined but have a profile defined.
   /usr/sbin/mysqld (628)

After update:
chuck@lucid-test:~$ sudo aa-status
apparmor module is loaded.
5 profiles are loaded.
5 profiles are in enforce mode.
   /sbin/dhclient3
   /usr/lib/NetworkManager/nm-dhcp-client.action
   /usr/lib/connman/scripts/dhclient-script
   /usr/sbin/mysqld
   /usr/sbin/tcpdump
0 profiles are in complain mode.
2 processes have profiles defined.
2 processes are in enforce mode :
   /sbin/dhclient3 (810)
   /usr/sbin/mysqld (2126)
0 processes are in complain mode.
0 processes are unconfined but have a profile defined

Before update:

chuck@lucid-test:~$ sudo aa-status
[sudo] password for chuck:
apparmor module is loaded.
5 profiles are loaded.
5 profiles are in enforce mode.
   /sbin/dhclient3
   /usr/lib/NetworkManager/nm-dhcp-client.action
   /usr/lib/connman/scripts/dhclient-script
   /usr/sbin/mysqld
   /usr/sbin/tcpdump
0 profiles are in complain mode.
2 processes have profiles defined.
1 processes are in enforce mode :
   /sbin/dhclient3 (810)
0 processes are in complain mode.
1 processes are unconfined but have a profile defined.
   /usr/sbin/mysqld (628)

After update:
chuck@lucid-test:~$ sudo aa-status
apparmor module is loaded.
5 profiles are loaded.
5 profiles are in enforce mode.
   /sbin/dhclient3
   /usr/lib/NetworkManager/nm-dhcp-client.action
   /usr/lib/connman/scripts/dhclient-script
   /usr/sbin/mysqld
   /usr/sbin/tcpdump
0 profiles are in complain mode.
2 processes have profiles defined.
2 processes are in enforce mode :
   /sbin/dhclient3 (810)
   /usr/sbin/mysqld (2126)
0 processes are in complain mode.
0 processes are unconfined but have a profile defined.

Gah...yes this fixes the problem.

chuck

This bug was fixed in the package mysql-dfsg-5.1 - 5.1.41-3ubuntu12.1

---------------
mysql-dfsg-5.1 (5.1.41-3ubuntu12.1) lucid-proposed; urgency=low

  * debian/mysql-server-5.1.mysql.upstart: load AppArmor profile since
    mysql can start before AppArmor now (LP: #573206).
 -- Kees Cook <email address hidden> Sat, 01 May 2010 12:06:10 -0700

Copied to maverick.

This bug was fixed in the package mysql-dfsg-5.1 - 5.1.41-3ubuntu12.1

---------------
mysql-dfsg-5.1 (5.1.41-3ubuntu12.1) lucid-proposed; urgency=low

  * debian/mysql-server-5.1.mysql.upstart: load AppArmor profile since
    mysql can start before AppArmor now (LP: #573206).
 -- Kees Cook <email address hidden> Sat, 01 May 2010 12:06:10 -0700