Set CAP_IPC_LOCK capability if possible

As done in upstream 8a1904d about MDEV-33301, set the capability
CAP_IPC_LOCK when possible to facilitate the mmaping of huge memory pages
(see man mmap), like MariaDB uses with --large-pages.

Author: ottok

debian/mariadb-server-core.postinst

@@ -0,0 +1,49 @@
+#!/bin/bash
+set -e
+
+# shellcheck source=/dev/null
+. /usr/share/debconf/confmodule
+
+if [ -n "$DEBIAN_SCRIPT_DEBUG" ]
+then
+  set -v -x
+  DEBIAN_SCRIPT_TRACE=1
+fi
+
+${DEBIAN_SCRIPT_TRACE:+ echo "#42#DEBUG# RUNNING $0 $*" 1>&2}
+
+export PATH=$PATH:/sbin:/usr/sbin:/bin:/usr/bin
+
+# inspired by iputils-ping
+#
+# cap_ipc_lock is required if a user wants to use --memlock
+# and has insufficient RLIMIT_MEMLOCK (MDEV-33301)
+
+PROGRAM=$(dpkg-divert --truename /usr/sbin/mysqld)
+
+case "$1" in
+  configure)
+    # If we have setcap installed, try setting
+    # which allows us to install our binaries without the setuid
+    # bit.
+    if command -v setcap > /dev/null
+    then
+      if ! setcap cap_ipc_lock+ep "$PROGRAM"
+      then
+        echo "Setcap failed on $PROGRAM, required with --memlock if insufficent RLIMIT_MEMLOCK" >&2
+      fi
+    fi
+    ;;
+
+  abort-upgrade|abort-remove|abort-configure|triggered)
+    ;;
+
+  *)
+    echo "postinst called with unknown argument '$1'" 1>&2
+    exit 1
+    ;;
+esac
+
+db_stop # in case invoke fails
+
+#DEBHELPER#