Initial Chef repository

cookbooks/mysql/templates/default/apparmor/usr.sbin.mysqld-instance.erb

@@ -0,0 +1,13 @@
+/etc/<%= @mysql_name %>/*.pem r,
+/etc/<%= @mysql_name %>/conf.d/ r,
+/etc/<%= @mysql_name %>/conf.d/* r,
+/etc/<%= @mysql_name %>/my.cnf r,
+<%= @log_dir %>/ r,
+<%= @log_dir %>/* rw,
+<%= @data_dir %>/ r,
+<%= @data_dir %>/** rwk,
+<%= @run_dir %>/** rw,
+<%= @pid_file %> rw,
+<%= @socket_file %> rw,
+/tmp/<%= @mysql_name %>/ r,
+/tmp/<%= @mysql_name %>/my.sql r,

cookbooks/mysql/templates/default/apparmor/usr.sbin.mysqld-local.erb

@@ -0,0 +1 @@
+#include <local/mysql>

cookbooks/mysql/templates/default/apparmor/usr.sbin.mysqld.erb

@@ -0,0 +1,45 @@
+# vim:syntax=apparmor
+# Last Modified: Tue Jun 19 17:37:30 2007
+#include <tunables/global>
+
+/usr/sbin/mysqld {
+  #include <abstractions/base>
+  #include <abstractions/nameservice>
+  #include <abstractions/user-tmp>
+  #include <abstractions/mysql>
+  #include <abstractions/winbind>
+
+  capability dac_override,
+  capability sys_resource,
+  capability setgid,
+  capability setuid,
+
+  network tcp,
+
+  /etc/hosts.allow r,
+  /etc/hosts.deny r,
+
+  /etc/mysql/*.pem r,
+  /etc/mysql/conf.d/ r,
+  /etc/mysql/conf.d/* r,
+  /etc/mysql/*.cnf r,
+  /usr/lib/mysql/plugin/ r,
+  /usr/lib/mysql/plugin/*.so* mr,
+  /usr/sbin/mysqld mr,
+  /usr/share/mysql/** r,
+  /var/log/mysql.log rw,
+  /var/log/mysql.err rw,
+  /var/lib/mysql/ r,
+  /var/lib/mysql/** rwk,
+  /var/log/mysql/ r,
+  /var/log/mysql/* rw,
+  /var/run/mysqld/mysqld.pid rw,
+  /var/run/mysqld/mysqld.sock w,
+  /run/mysqld/mysqld.pid rw,
+  /run/mysqld/mysqld.sock w,
+
+  /sys/devices/system/cpu/ r,
+
+  # Site-specific additions and overrides. See local/README for details.
+  #include <local/usr.sbin.mysqld>
+}