如何配置 apparmor 以允许 mariadb 加载共享库？

Question

昨天例行更新后，MariaDB 无法启动，因为共享库文件被 apparmor 阻止而无法加载。

这是journalctl -xe 的输出

Apr 17 11:44:45 pbts-academic audit[10349]: AVC apparmor="DENIED" operation="file_mmap" profile="/usr/sbin/mysqld" name="/usr/lib/x86_64-linux-gnu/liblz4.so.1.7.1"
Apr 17 11:44:45 pbts-academic kernel: audit: type=1400 audit(1555472685.956:79): apparmor="DENIED" operation="file_mmap" profile="/usr/sbin/mysqld" name="/usr/lib/x86_64-linux-gnu/liblz4.so.1.7.1"
Apr 17 11:44:45 pbts-academic mysqld[10349]: /usr/sbin/mysqld: error while loading shared libraries: liblz4.so.1: failed to map segment from shared object
Apr 17 11:44:45 pbts-academic systemd[1]: mariadb.service: Main process exited, code=exited, status=127/n/a
Apr 17 11:44:45 pbts-academic systemd[1]: mariadb.service: Failed with result 'exit-code'.
Apr 17 11:44:45 pbts-academic systemd[1]: Failed to start MariaDB 10.3.14 database server.
-- Subject: Unit mariadb.service has failed
-- Defined-By: systemd
-- Support: http://www.ubuntu.com/support
-- 
-- Unit mariadb.service has failed.
-- 
-- The result is RESULT.

提前致谢。

Answer 1

将行添加到/etc/apparmor.d/usr.sbin.mysqld(或/etc/apparmor.d/usr.sbin.mysqld.local)

/usr/lib/x86_64-linux-gnu/liblz4.so* rm,

rm，不删除，允许apparmor读取并内存映射文件，这就是MariaDB加载共享库所需的。