• Daniel Black's avatar
    MDEV-33301 memlock with systemd still not working · 76a27155
    Daniel Black authored
    .. even with MDEV-9095 fix
    
    CapabilityBounding sets require filesystem setcap attributes
    for the executable to gain privileges during execution.
    
    A side effect of this however is the getauxvec(AT_SECURE) gets
    set, and the secure_getenv from OpenSSL internals on
    OPENSSL_CONF environment variable will get ignored (openssl gh issue
    21770).
    
    According to capabilities(7), Ambient capabilities don't trigger
    ld.so triggering the secure execution mode.
    
    Include SELinux and Apparmor capabilities for ipc_lock
    76a27155
mariadb.service.in 5.92 KB