One thing that I'm seeing that may need to be documented, is that this breaks mysql-testsuite in its default configuration.
Because we can no longer let /usr/sbin/mysqld write to /tmp at will, the test suite won't start without some coaxing. This works
sudo -u mysql /usr/lib/mysql-test/mysql-test-run.pl --vardir=/var/tmp/mysql
Or, if we add this to the apparmor profile:
# for the testing suite owner @{HOME}/tmp/** rwkl, owner @{HOME}/tmp/ rw,
Then we can start it as any user with just
/usr/lib/mysql-test/mysql-test-run.pl --vardir=$HOME/tmp
The mysql user runs with $HOME == /nonexistent, so this should be safe.
One thing that I'm seeing that may need to be documented, is that this breaks mysql-testsuite in its default configuration.
Because we can no longer let /usr/sbin/mysqld write to /tmp at will, the test suite won't start without some coaxing. This works
sudo -u mysql /usr/lib/ mysql-test/ mysql-test- run.pl --vardir= /var/tmp/ mysql
Or, if we add this to the apparmor profile:
# for the testing suite
owner @{HOME}/tmp/** rwkl,
owner @{HOME}/tmp/ rw,
Then we can start it as any user with just
/usr/lib/ mysql-test/ mysql-test- run.pl --vardir=$HOME/tmp
The mysql user runs with $HOME == /nonexistent, so this should be safe.