[From nobody Mon Apr 13 17:21:08 2026 Received: (at submit) by bugs.debian.org; 27 Mar 2026 10:08:47 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-15.1 required=4.0 tests=BAYES_00, BODY_INCLUDES_PACKAGE,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU, DKIM_VALID_EF,FOURLA,HAS_PACKAGE,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 98; hammy, 150; neutral, 329; spammy, 0. spammytokens: hammytokens:0.000-+--UD:init.d, 0.000-+--initd, 0.000-+--init.d, 0.000-+--sk:taint_o, 0.000-+--sk:TAINT_O Return-path: <stse@rootsland.net> Received: from mail.rootsland.net ([2a01:4f8:c17:3852::2]:39254) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <stse@rootsland.net>) id 1w647R-0077Jw-2c for submit@bugs.debian.org; Fri, 27 Mar 2026 10:08:47 +0000 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.rootsland.net 4fhx1Z5BHpz3wxK DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=rootsland.net; s=mail20200305; t=1774605538; bh=ZtdlpP6El12zs2eWGKJDKd/xgI0c9VgR1O3k3FDgqGk=; h=Date:From:To:Subject:From; b=JT9NnEgD3rIoBvNhj+fuz8JFaPULjshTJX052LMO136rEe4VK/jvUhh5bZsgpoL56 DO3zQWroLWRxCWtmjpmDsvd37YgEm87SWfqBP6QKQE75lhZfrV05nxhVwNxjxDgRK1 QjDeK5uwwBvt6kDQV5VkTLrDtuntjuxnhf2zOTYI= Received: from osgiliath.gondor (unknown [IPv6:2001:16b8:c31d:b600:2bcb:9dd:2e17:bf80]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (prime256v1) server-digest SHA256 client-signature ECDSA (secp521r1) client-digest SHA512) (Client CN "stse@fsing.rootsland.net", Issuer "stse@fsing.rootsland.net" (not verified)) by mail.rootsland.net (Postfix) with ESMTPS id 4fhx1Z5BHpz3wxK for <submit@bugs.debian.org>; Fri, 27 Mar 2026 10:58:58 +0100 (CET) Received: by osgiliath.gondor (Postfix, from userid 10009) id 4fhx1Z3cXPzyBS; Fri, 27 Mar 2026 10:58:58 +0100 (CET) Date: Fri, 27 Mar 2026 10:58:58 +0100 From: Stephan Seitz <stse+debianbugs@rootsland.net> To: Debian Bug Tracking System <submit@bugs.debian.org> Subject: mariadb-server: MariaDB doesn't start anymore with enforcing Apparmor profile Message-ID: <20260327T105357.blubb.15228.stse@fsing.rootsland.net> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit X-Reportbug-Version: 13.2.0 Organization: Minas Tirith, Gondor X-Greylist: delayed 576 seconds by postgrey-1.37 at buxtehude; Fri, 27 Mar 2026 10:08:45 UTC Delivered-To: submit@bugs.debian.org Package: mariadb-server Version: 1:11.8.6-4 Severity: normal Dear Maintainer, I’m using Debian/Testing with sysvinit. MariaDB doesn’t start anymore with the new enforcing apparmor profile. osgiliath:~# date; service mariadb start Fr 27. Mär 10:45:23 CET 2026 Starting MariaDB database server: mariadbd . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 260327 10:45:53 mysqld_safe Can't log to error log and syslog at the same time. Remove all --log-error configuration options for --syslog to take effect. 260327 10:45:53 mysqld_safe Logging to '/tmp/tmp.E6JnB7r1Em.err'. 260327 10:45:53 mysqld_safe Starting mariadbd daemon with databases from /var/lib/mysql Running '/etc/init.d/mariadb start' failed with error log: 260327 10:45:53 mysqld_safe Starting mariadbd daemon with databases from /var/lib/mysql 2026-03-27 10:45:53 0 [Warning] Could not increase number of max_open_files to more than 1024 (request: 32139) 2026-03-27 10:45:53 0 [Warning] Changed limits: max_open_files: 1024 max_connections: 100 (was 100) table_cache: 447 (was 2000) 2026-03-27 10:45:53 0 [Warning] Can't create test file '/var/lib/mysql/osgiliath.lower-test' (Errcode: 13 "Permission denied") /usr/sbin/mariadbd: Can't change dir to '/var/lib/mysql/' (Errcode: 13 "Permission denied") 2026-03-27 10:45:53 0 [ERROR] Aborting 260327 10:45:53 mysqld_safe mysqld from pid file /run/mysqld/mysqld.pid ended /var/log/kern.log shows: 2026-03-27T10:45:23.200360+01:00 osgiliath kernel: [ T58] audit: type=1400 audit(1774604723.198:4319): apparmor="DENIED" operation="capable" class="cap" profile="mariadbd" pid=16450 comm="mariadbd" capability=24 capname="sys_resource" 2026-03-27T10:45:23.208387+01:00 osgiliath kernel: [ T58] audit: type=1400 audit(1774604723.206:4320): apparmor="DENIED" operation="capable" class="cap" profile="mariadbd" pid=16450 comm="mariadbd" capability=2 capname="dac_read_search" 2026-03-27T10:45:23.208395+01:00 osgiliath kernel: [ T58] audit: type=1400 audit(1774604723.206:4321): apparmor="DENIED" operation="capable" class="cap" profile="mariadbd" pid=16450 comm="mariadbd" capability=1 capname="dac_override" 2026-03-27T10:45:53.661371+01:00 osgiliath kernel: [ T58] audit: type=1400 audit(1774604753.660:4322): apparmor="DENIED" operation="capable" class="cap" profile="mariadbd" pid=16902 comm="mariadbd" capability=24 capname="sys_resource" 2026-03-27T10:45:53.669378+01:00 osgiliath kernel: [ T58] audit: type=1400 audit(1774604753.668:4323): apparmor="DENIED" operation="capable" class="cap" profile="mariadbd" pid=16902 comm="mariadbd" capability=2 capname="dac_read_search" 2026-03-27T10:45:53.669398+01:00 osgiliath kernel: [ T58] audit: type=1400 audit(1774604753.668:4324): apparmor="DENIED" operation="capable" class="cap" profile="mariadbd" pid=16902 comm="mariadbd" capability=1 capname="dac_override" In complaining mode MariaDB is starting and I see the following apparmor logs: 2026-03-27T10:47:39.688360+01:00 osgiliath kernel: [ T58] audit: type=1400 audit(1774604859.686:4326): apparmor="ALLOWED" operation="capable" class="cap" profile="mariadbd" pid=17110 comm="mariadbd" capability=24 capname="sys_resource" 2026-03-27T10:47:39.696374+01:00 osgiliath kernel: [ T58] audit: type=1400 audit(1774604859.694:4327): apparmor="ALLOWED" operation="capable" class="cap" profile="mariadbd" pid=17110 comm="mariadbd" capability=2 capname="dac_read_search" 2026-03-27T10:47:39.696393+01:00 osgiliath kernel: [ T58] audit: type=1400 audit(1774604859.694:4328): apparmor="ALLOWED" operation="capable" class="cap" profile="mariadbd" pid=17110 comm="mariadbd" capability=1 capname="dac_override" 2026-03-27T10:47:39.697356+01:00 osgiliath kernel: [ T58] audit: type=1400 audit(1774604859.695:4329): apparmor="ALLOWED" operation="capable" class="cap" profile="mariadbd" pid=17110 comm="mariadbd" capability=6 capname="setgid" 2026-03-27T10:47:39.697373+01:00 osgiliath kernel: [ T58] audit: type=1400 audit(1774604859.695:4330): apparmor="ALLOWED" operation="capable" class="cap" profile="mariadbd" pid=17110 comm="mariadbd" capability=6 capname="setgid" 2026-03-27T10:47:39.697374+01:00 osgiliath kernel: [ T58] audit: type=1400 audit(1774604859.695:4331): apparmor="ALLOWED" operation="capable" class="cap" profile="mariadbd" pid=17110 comm="mariadbd" capability=7 capname="setuid" 2026-03-27T10:47:39.709349+01:00 osgiliath kernel: [ T58] audit: type=1400 audit(1774604859.707:4332): apparmor="ALLOWED" operation="open" class="file" profile="mariadbd" name="/sys/devices/pci0000:00/0000:00:1f.2/ata2/host1/target1:0:0/1:0:0:0/block/sdb/dev" pid=17110 comm="mariadbd" requested_mask="r" denied_mask="r" fsuid=122 ouid=0 2026-03-27T10:47:39.709353+01:00 osgiliath kernel: [ T58] audit: type=1400 audit(1774604859.707:4333): apparmor="ALLOWED" operation="open" class="file" profile="mariadbd" name="/sys/devices/pci0000:00/0000:00:1f.2/ata6/host5/target5:0:0/5:0:0:0/block/sr0/dev" pid=17110 comm="mariadbd" requested_mask="r" denied_mask="r" fsuid=122 ouid=0 2026-03-27T10:47:39.710385+01:00 osgiliath kernel: [ T58] audit: type=1400 audit(1774604859.708:4334): apparmor="ALLOWED" operation="open" class="file" profile="mariadbd" name="/sys/devices/pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/block/sda/dev" pid=17110 comm="mariadbd" requested_mask="r" denied_mask="r" fsuid=122 ouid=0 Many greetings, Stephan Seitz -- System Information: Debian Release: forky/sid APT prefers stable-security APT policy: (900, 'stable-security'), (900, 'oldoldstable-updates'), (900, 'testing') Architecture: amd64 (x86_64) Kernel: Linux 6.19.10 (SMP w/8 CPU threads; PREEMPT) Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8), LANGUAGE not set Shell: /bin/sh linked to /usr/bin/dash Init: sysvinit (via /sbin/init) LSM: AppArmor: enabled Versions of packages mariadb-server depends on: ii debconf [debconf-2.0] 1.5.92 ii galera-4 26.4.25-2 ii gawk 1:5.3.2-1 ii iproute2 6.19.0-1 ii libc6 2.42-13 ii libdbi-perl 1.647-1+b1 ii libgcc-s1 16-20260308-1 ii libpam0g 1.7.0-5+b1 ii libssl3t64 3.6.1-3 ii libstdc++6 16-20260308-1 ii lsof 4.99.4+dfsg-2 ii mariadb-client 1:11.8.6-4 ii mariadb-common 1:11.8.6-4 ii mariadb-server-core 1:11.8.6-4 ii passwd 1:4.18.0-2 ii perl 5.40.1-7 ii procps 2:4.0.4-9+b1 ii psmisc 23.7-2 ii rsync 3.4.1+ds1-7 ii socat 1.8.1.1-1 ii systemd-standalone-sysusers [systemd-sysusers] 260.1-1 ii zlib1g 1:1.3.dfsg+really1.3.1-3 Versions of packages mariadb-server recommends: ii libhtml-template-perl 2.97-2 ii mariadb-plugin-provider-bzip2 1:11.8.6-4 ii mariadb-plugin-provider-lz4 1:11.8.6-4 ii mariadb-plugin-provider-lzma 1:11.8.6-4 ii mariadb-plugin-provider-lzo 1:11.8.6-4 ii mariadb-plugin-provider-snappy 1:11.8.6-4 ii pv 1.10.4-1 Versions of packages mariadb-server suggests: ii bsd-mailx [mailx] 8.1.2-0.20220412cvs-1.1 pn mariadb-test <none> pn netcat-openbsd <none> -- Configuration Files: /etc/mysql/mariadb.conf.d/50-server.cnf changed [not included] -- debconf information excluded -- | If your life was a horse, you'd have to shoot it. | ]