This article explains how to configure a Vormetric resource set to securely allow MySQL startup scripts to access encrypted GuardPoints.
Why do startup scripts need access to GuardPoints?
When Linux starts a service, Linux also runs a startup script. The startup script runs when the machine powers on or when a service manually starts. The startup script typically runs tasks that relate to the starting, stopping, and restarting of a service.
For database services, the startup script typically runs tasks that occur in folders that hold database files. With encrypted database files, you must allow the startup script to access the database folders. If not, the database will not start properly, and in some cases, interfere with the power-on process for the machine.
As part of the startup process, the operating system needs permission to view and change file/folder ownership and permissions. As a result, if you want to guard var/lib/mysql, you must create two rules in your policy.
Common GuardPoints
The system needs to access the commonly guarded (encrypted) folders inside of /var/lib/mysql.
Access to GuardPoints
The resource is relative to the GuardPoint. In other words, if the GuardPoint is /var/lib/mysql, and you want to allow access to a particular file in that directory, you would only need to specify that specific file in your resource parameter.
For instance if the GuardPoint is /var/lib/mysql/, then your resource would only be mysql.sock.
Allow startup scripts to access encrypted MySQL databases
In the instructions below, you will create and add two rules to your policy.
Log into your DSM as Security Administrator.
In the menu bar, click Polices, and then click Manage Policies.
Mark the policy that guards your databases, such as /var/ib/sql/data, and then click Add.
Under Security Rules, click Add.
Next to Resource, click Select.
In the window that appears, click Add.
In Name, enter a descriptive name for your Resource Set.
Click Add to specify a resource that will need to be accessed in the GuardPoint upon startup.
In Directory, enter a slash: \
In File, enter the mysql.sock file that needs to be accessed upon startup, and then click Ok. These resource must be added one at a time.
(Optional) To add resources, repeat steps 8 - 10.
Mark the newly created Resource Set, and then click Select Resource Set. In the window that appears, Resource is populated with the newly created Resource Set.
Next to Effect, click Select.
Mark Permit and Apply Key.
Click Select Effect.
Click Ok.
Mark the rule, and then click Up to move the new rule above the catch-all rule.
For your reference you have just created and added the first rule.
Inside your policy editor, click Add to create the second security rule.
Next to Action, click Select.
Using the image below for, mark all the rules listed below.
Click Select Action.
Next to Effect, click Select.
Mark Permit, and then click Ok.
Click Ok.
Mark the rule, and then click Up to move the new rule up one entry.
Click Apply to save, and then click Ok.
(Optional) You should test to make sure your system is running properly.