Accepting request 769982 from home:kstreitova:branches:server:database

OBS-URL: https://build.opensuse.org/request/show/769982
OBS-URL: https://build.opensuse.org/package/show/server:database/mariadb?expand=0&rev=242

mariadb.service

@@ -20,21 +20,53 @@
 #      EOF
 
 [Unit]
-Description=MySQL server
+Description=MariaDB @VERSION@ database server
+Documentation=man:mysqld(8)
+Documentation=https://mariadb.com/kb/en/library/systemd/
 Wants=basic.target
 Conflicts=mariadb.target
 After=basic.target network.target 
 
+[Install]
+WantedBy=multi-user.target
+Alias=mysql.service
+
 [Service]
-Restart=on-abort
-Type=notify
 ExecStartPre=/usr/lib/mysql/mysql-systemd-helper  install
 ExecStartPre=/usr/lib/mysql/mysql-systemd-helper  upgrade
 ExecStart=/usr/lib/mysql/mysql-systemd-helper     start
 
+Type=notify
+User=mysql
+Group=mysql
+
+KillSignal=SIGTERM
+
+# Don't want to see an automated SIGKILL ever
+SendSIGKILL=no
+
+# Restart crashed server only, on-failure would also restart, for example, when
+# my.cnf contains unknown option
+Restart=on-abort
+RestartSec=5s
+
 # Configures the time to wait for start-up/stop
 TimeoutSec=300
 
-[Install]
-WantedBy=multi-user.target
-Alias=mysql.service
+# CAP_IPC_LOCK To allow memlock to be used as non-root user
+# CAP_DAC_OVERRIDE To allow auth_pam_tool (which is SUID root) to read /etc/shadow when it's chmod 0
+#   does nothing for non-root, not needed if /etc/shadow is u+r
+# CAP_AUDIT_WRITE auth_pam_tool needs it on Debian for whatever reason
+CapabilityBoundingSet=CAP_IPC_LOCK CAP_DAC_OVERRIDE CAP_AUDIT_WRITE
+
+# Prevent writes to /usr, /boot, and /etc
+ProtectSystem=full
+
+# Prevent accessing /home, /root and /run/user
+ProtectHome=true
+
+# Execute pre and post scripts as root, otherwise it does it as User=
+PermissionsStartOnly=true
+
+UMask=007
+