Add AppArmor notice for Debian/Ubuntu users during server startup

When MariaDB fails to start due to permission errors, users on
Debian/Ubuntu might not be able to guess that AppArmor might be the
cause, and they should check for AppArmor denials in the kernel audit
log.

Add an informational message during startup that:
- Only prints when the 'mariadbd' profile is actually loaded
- Includes exact commands from the Debian packaging NEWS
- Provides actionable paths for local overrides
- Mentions both complain and enforce modes for troubleshooting

The message is printed once during normal server startup (not in help or
bootstrap modes) through the existing logging infrastructure, ensuring
it appears in both syslog and the error log where users will see it when
troubleshooting startup failures.

Forwarded: https://github.com/MariaDB/server/pull/5003

Gbp-Pq: Name Add-AppArmor-notice-for-Debian-Ubuntu-users-during-server.patch

diff --git a/sql/mysqld.cc b/sql/mysqld.cc
index 36ccb1952acbb7cb0e0196cec57d1dccf6855efb..74b013f772f04004ad080c148e4088c0be71bd99 100644 (file)
--- a/sql/mysqld.cc
+++ b/sql/mysqld.cc
@@ -5128,6 +5128,46 @@ static int init_server_components()
                             "https://github.com/MariaDB/server");
     }
 
+  /*
+    Print notice about AppArmor on Debian/Ubuntu systems to help users diagnose
+    permission issues that may be caused by AppArmor denials on systems where
+    the AppArmor profile is active.
+  */
+  if (!opt_help && !opt_bootstrap)
+  {
+    MY_STAT stat_info;
+    if (my_stat("/sys/kernel/security/apparmor/profiles", &stat_info, MYF(0)))
+    {
+      /* Check if mariadbd profile is loaded by reading the profiles file */
+      FILE *fp = fopen("/sys/kernel/security/apparmor/profiles", "r");
+      if (fp)
+      {
+        char line[256];
+        bool mariadb_profile_active = false;
+        while (fgets(line, sizeof(line), fp))
+        {
+          if (strstr(line, "mariadbd"))
+          {
+            mariadb_profile_active = true;
+            break;
+          }
+        }
+        fclose(fp);
+
+        if (mariadb_profile_active)
+        {
+          sql_print_information(
+            "AppArmor profile 'mariadbd' is active. "
+            "If permission errors occur, check: 'aa-status | grep mariadb' "
+            "or 'sudo dmesg | grep -i apparmor'. "
+            "To disable enforcement: 'aa-complain /etc/apparmor.d/mariadbd'. "
+            "To add local overrides, create /etc/apparmor.d/local/mariadbd "
+            "(see /usr/share/doc/mariadb-server/NEWS.Debian.gz).");
+        }
+      }
+    }
+  }
+
 #ifdef WITH_PERFSCHEMA_STORAGE_ENGINE
   /*
     Parsing the performance schema command line option may have reported