嗯！莫名踩雷了 mariadb-server

利用 MariaDb 架 nextcloud 平台，收集校務評鑑資料，一開始裝好了之後，用起來都很正常。

但是安全更新後把伺服器重新開機，就發現nextcloud 掛了，遠端登入後才發現是資料庫沒啟動，立馬手動執行

sudo systemctl restart mysqld.server

結果等了許多，跳出了另一個錯誤訊息

2018-05-29 13:46:04 139927905056960 [Note] Using unique option prefix 'myisam-recover' is error-prone and can break in the future. Please use the full name 'myisam-recover-options' instead.
2018-05-29 13:46:04 139927905056960 [Note] Using unique option prefix 'myisam-recover' is error-prone and can break in the future. Please use the full name 'myisam-recover-options' instead.
2018-05-29 13:46:04 139927905056960 [Note] InnoDB: Mutexes and rw_locks use GCC atomic builtins
2018-05-29 13:46:04 139927905056960 [Note] InnoDB: Uses event mutexes
2018-05-29 13:46:04 139927905056960 [Note] InnoDB: Compressed tables use zlib 1.2.8
2018-05-29 13:46:04 139927905056960 [Note] InnoDB: Using Linux native AIO
2018-05-29 13:46:04 139927905056960 [Note] InnoDB: Number of pools: 1
2018-05-29 13:46:04 139927905056960 [Note] InnoDB: Using SSE2 crc32 instructions
2018-05-29 13:46:04 139927905056960 [Note] InnoDB: Initializing buffer pool, total size = 128M, instances = 1, chunk size = 128M
2018-05-29 13:46:04 139927905056960 [Note] InnoDB: Completed initialization of buffer pool
2018-05-29 13:46:04 139927257839360 [Note] InnoDB: If the mysqld execution user is authorized, page cleaner thread priority can be changed. See the man page of setpriority().
2018-05-29 13:46:04 139927905056960 [Note] InnoDB: The first innodb_system data file 'ibdata1' did not exist. A new tablespace will be created!
2018-05-29 13:46:04 139927905056960 [Note] InnoDB: Setting file './ibdata1' size to 12 MB. Physically writing the file full; Please wait ...
2018-05-29 13:46:04 139927905056960 [Note] InnoDB: File './ibdata1' size is now 12 MB.
2018-05-29 13:46:04 139927905056960 [Note] InnoDB: Setting log file ./ib_logfile101 size to 50331648 bytes
2018-05-29 13:46:04 139927905056960 [Note] InnoDB: Setting log file ./ib_logfile1 size to 50331648 bytes
2018-05-29 13:46:04 139927905056960 [Note] InnoDB: Renaming log file ./ib_logfile101 to ./ib_logfile0
2018-05-29 13:46:04 139927905056960 [Note] InnoDB: New log files created, LSN=45790
2018-05-29 13:46:04 139927905056960 [Note] InnoDB: Doublewrite buffer not found: creating new
2018-05-29 13:46:04 139927905056960 [Note] InnoDB: Doublewrite buffer created
2018-05-29 13:46:04 139927905056960 [Note] InnoDB: 128 out of 128 rollback segments are active.
2018-05-29 13:46:04 139927905056960 [Note] InnoDB: Creating foreign key constraint system tables.
2018-05-29 13:46:04 139927905056960 [Note] InnoDB: Creating tablespace and datafile system tables.
2018-05-29 13:46:04 139927905056960 [Note] InnoDB: Creating sys_virtual system tables.
2018-05-29 13:46:04 139927905056960 [Note] InnoDB: Creating shared tablespace for temporary tables
2018-05-29 13:46:04 139927905056960 [Note] InnoDB: Setting file './ibtmp1' size to 12 MB. Physically writing the file full; Please wait ...
2018-05-29 13:46:04 139927905056960 [Note] InnoDB: File './ibtmp1' size is now 12 MB.
2018-05-29 13:46:04 139927905056960 [Note] InnoDB: Waiting for purge to start
2018-05-29 13:46:04 139927905056960 [Note] InnoDB: 5.7.22 started; log sequence number 0
2018-05-29 13:46:04 139927905056960 [Note] Plugin 'FEEDBACK' is disabled.
2018-05-29 13:46:04 139927905056960 [ERROR] Could not open mysql.plugin table. Some plugins may be not loaded
2018-05-29 13:46:04 139927905056960 [ERROR] Can't open and lock privilege tables: Table 'mysql.servers' doesn't exist
2018-05-29 13:46:04 139927905056960 [Note] Server socket created on IP: '127.0.0.1'.
2018-05-29 13:46:04 139927905056960 [ERROR] Fatal error: Can't open and lock privilege tables: Table 'mysql.user' doesn't exist

本來以為是資料庫故障了，結果切換到 /var/lib/mysql 後，發現資料庫、資料表似乎都在，疑問之下，開啟  /var/log/syslog ，發現又一串錯誤訊息…

May 30 20:15:45 ubuntu systemd[1]: Starting MariaDB 10.2.15 database server...
May 30 20:15:46 ubuntu kernel: [97757.266462] audit: type=1400 audit(1527682546.054:13): apparmor="DENIED" operation="open" profile="/usr/sbin/mysqld" name="/proc/12073/status" pid=12073 comm="mysqld" requested_mask="r" denied_mask="r" fsuid=106 ouid=106
May 30 20:15:46 ubuntu kernel: [97757.266776] audit: type=1400 audit(1527682546.054:14): apparmor="DENIED" operation="open" profile="/usr/sbin/mysqld" name="/sys/devices/system/node/" pid=12073 comm="mysqld" requested_mask="r" denied_mask="r" fsuid=106 ouid=0
May 30 20:15:46 ubuntu kernel: [97757.267025] audit: type=1400 audit(1527682546.054:15): apparmor="DENIED" operation="open" profile="/usr/sbin/mysqld" name="/proc/12073/status" pid=12073 comm="mysqld" requested_mask="r" denied_mask="r" fsuid=106 ouid=106
May 30 20:15:46 ubuntu kernel: [97757.357815] audit: type=1400 audit(1527682546.142:16): apparmor="DENIED" operation="open" profile="/usr/sbin/mysqld" name="/etc/mysql/mariadb.conf.d/" pid=12073 comm="mysqld" requested_mask="r" denied_mask="r" fsuid=106 ouid=0
May 30 20:15:46 ubuntu mysqld[12073]: #007/usr/sbin/mysqld: Can't read dir of '/etc/mysql/mariadb.conf.d/' (Errcode: 13 "Permission denied")
May 30 20:15:46 ubuntu mysqld[12073]: #007/usr/sbin/mysqld: Can't read dir of '/etc/mysql/mariadb.conf.d/' (Errcode: 13 "Permission denied")
May 30 20:15:46 ubuntu mysqld[12073]: Fatal error in defaults handling. Program aborted
May 30 20:15:46 ubuntu kernel: [97757.360216] audit: type=1400 audit(1527682546.146:17): apparmor="DENIED" operation="open" profile="/usr/sbin/mysqld" name="/etc/mysql/mariadb.conf.d/" pid=12073 comm="mysqld" requested_mask="r" denied_mask="r" fsuid=106 ouid=0
May 30 20:15:46 ubuntu systemd[1]: mariadb.service: Main process exited, code=exited, status=1/FAILURE
May 30 20:15:46 ubuntu systemd[1]: Failed to start MariaDB 10.2.15 database server.
May 30 20:15:46 ubuntu systemd[1]: mariadb.service: Unit entered failed state.
May 30 20:15:46 ubuntu systemd[1]: mariadb.service: Failed with result 'exit-code'.

本來以為是 DB 設定檔出了問題，也懷疑過 mariadb-common 和 mysql-common 這 2 個系統自己裝進來的套件，混在一起後有衝突，調整了許久還是無法啟動。

後來再仔細看了一下 log 內容，似乎是被 denied ，permission 不夠，苦搜了許久，終於把這雷也掃了，結論：

編輯   /etc/apparmor.d/usr.sbin.mysqld，增加下列內容，重新啟動服務後，正常！呼！

/etc/mysql/*.cnf r,
/{,var/}run/mysqld/mysqld.pid w,
/{,var/}run/mysqld/mysqld.sock w,
/usr/lib/mysql/plugin/ r,
/proc/*/status r,
/sys/devices/system/node/ r,
/sys/devices/system/node/node0/meminfo r,
/run/systemd/notify w,