/                               h

        /etc                            r

        /etc/grsec                      h

        /etc/mysql/my.cnf               r

        /lib                            rx

        /proc/sys/kernel/version        r

        /tmp                            rwcd

        /usr/lib                        rx

        /usr/share/zoneinfo             r

        /usr/share/mysql                r

        /var/run/mysqld                 w

        /var/lib/mysql                  rw

        /var/lib/mysql/*                rw

        -CAP_ALL

        +CAP_SETGID

        +CAP_SETUID

}

Расскажу еще об одной проблеме, с которой мне пришлось столкнуться. Для подсчета трафика я использую NeTAMS. После обучения получил такой ACL для netams:

subject /usr/bin/netams o {

        /

        /var                            rwc

        /var/log                        h

        /etc/ssh                        h

        /etc/grsec                      h

        /dev/grsec                      h

        /proc/kcore                     h

        /proc/sys                       h

        /etc/shadow                     h

        /etc/passwd                     h

        /dev/mem                        h

        /dev/kmem                       h

        /dev/port                       h