From 7061a3a4dc9d060925cf2113c193464ad1fd71df Mon Sep 17 00:00:00 2001 From: Andreas Rammhold Date: Thu, 1 Oct 2020 23:16:01 +0200 Subject: [PATCH] nixos/mysql: put the bullet points in a listing This makes them a lot more readable in the rendered HTML compared to some inline dashes. --- nixos/doc/manual/release-notes/rl-2009.xml | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/nixos/doc/manual/release-notes/rl-2009.xml b/nixos/doc/manual/release-notes/rl-2009.xml index e599820d965e..ff61108d7cbf 100644 --- a/nixos/doc/manual/release-notes/rl-2009.xml +++ b/nixos/doc/manual/release-notes/rl-2009.xml @@ -116,15 +116,24 @@ services.mysql.initialScript = pkgs.writeText "mariadb-init.sql" '' MySQL server is now started with additional systemd sandbox/hardening options for better security. The PrivateTmp, ProtectHome, and ProtectSystem options may be problematic when MySQL is attempting to read from or write to your filesystem anywhere outside of its own state directory, for example when calling LOAD DATA INFILE or SELECT * INTO OUTFILE. In this scenario a variant of the following may be required: - - allow MySQL to read from /home and /tmp directories when using LOAD DATA INFILE + + + allow MySQL to read from /home and /tmp directories when using LOAD DATA INFILE systemd.services.mysql.serviceConfig.ProtectHome = lib.mkForce "read-only"; - - allow MySQL to write to custom folder /var/data when using SELECT * INTO OUTFILE, assuming the mysql user has write - access to /var/data + + + + + allow MySQL to write to custom folder /var/data when using SELECT * INTO OUTFILE, assuming the mysql user has write + access to /var/data systemd.services.mysql.serviceConfig.ReadWritePaths = [ "/var/data" ]; + + + The MySQL service no longer runs its systemd service startup script as root anymore. A dedicated non root