MariaDB 起動/停止

起動/停止（RedHat, Ubuntu : Systemd）

ユーザー設定（優先される）

[root]# vim /etc/systemd/system/mariadb.service

[Unit]
Description = MariaDB - Database Server
After = network.target

[Service]
Environment=SYSTEMD_LOG_LEVEL=debug,console:info
ExecStart = /usr/local/mysql/bin/mariadbd --defaults-file=/etc/my.cnf
ExecStop = /bin/kill -SIGTERM $MAINPID
KillMode = control-group
ExecReload = /bin/kill -SIGHUP $MAINPID
Restart = on-failure
RestartSec = 10s

SystemCallArchitectures = native
SystemCallFilter=~@clock
SystemCallFilter=~@cpu-emulation
SystemCallFilter=~@debug
SystemCallFilter=~@module
SystemCallFilter=~@mount
SystemCallFilter=~@obsolete
SystemCallFilter=~@privileged
SystemCallFilter=~@raw-io
SystemCallFilter=~@reboot
SystemCallFilter=~@resources
SystemCallFilter=~@swap

RestrictRealtime = yes

RemoveIPC = yes
PrivateIPC = yes

CapabilityBoundingSet =

RestrictAddressFamilies =~ AF_PACKET AF_NETLINK

User = mysql
Group = mysql
PermissionsStartOnly = yes
UMask = 0077

#× ProtectSystem = strict
ProtectSystem = full
ProtectHome = yes
#× PrivateTmp = yes
ReadWritePaths = /usr/local/mysql
PrivateUsers = yes

PrivateDevices = yes
ProtectClock = yes
ProtectKernelLogs = yes
ProtectKernelModules = yes
ProtectKernelTunables = yes
ProtectControlGroups = yes

#× PrivateNetwork = yes
NoNewPrivileges = yes
IPAddressAllow = localhost
IPAddressAllow = 192.168.1.0/24
IPAddressDeny = any
MemoryDenyWriteExecute = yes
ProcSubset = pid

RestrictNamespaces = yes
RestrictSUIDSGID = yes
ProtectHostname = yes
LockPersonality = yes
ProtectProc = invisible

[Install]
WantedBy = multi-user.target

[root]# systemctl daemon-reload

    [root]# systemd-analyze security mariadb.service

    → Overall exposure level for mariadb.service: 1.4 OK

[root]# systemctl { start stop reload-or-restart } mariadb.service

[root]# systemctl { enable disable } mariadb.service

[root]# systemctl enable --now mariadb.service

[root]# systemctl disable --now mariadb.service

データベースへアクセス

[user]$ mariadb -u ユーザー名 -p データベース名