Bug 1201413

It's weird that this works fine with RHEL-7 but it doesn't on F21.

Created attachment 1001078 [details]
selinux policy for mariadb that fixes reproducer from comment#0

(In reply to Honza Horak from comment #0)

<snip>

The reproducer actually should use the mariadb collection and service call:

> #> systemctl start mariadb

#> service rh-mariadb100-mariadb start

> #> mysql -u testusr -pabcdef

#> scl enable rh-mariadb100 -- mysql -u testusr -pabcdef

I'm also not sure if these SELinux issues are caused by communication with pam and thus will be visible with *every pam plugin* or they are *specific for pam_unix.so* module. In the later case it seems the SELinux would need to be created for every module specifically for used pam module, right?

We also have an issue that possible fix won't be available in selinux-policy soon enough -- so I'm wondering what are our options regarding fixing this directly in rh-mariadb100-mariadb package?

There is a bit simpler reproducer that uses pam_permit.so module, so there shouldn't be any AVCs specific to pam_unix.so:

1. install rh-mariadb100 collection from upcoming RHSCL-2.0
  #> yum install rh-mariadb100

2. create pam configuration
  #> cat >/etc/pam.d/mysql <<EOF
  auth            required        pam_permit.so
  account         required        pam_permit.so
  EOF

3. start the daemon
  #> service rh-mariadb100-mariadb start

4. install the plugin
  MariaDB [(none)]> install plugin pam soname 'auth_pam.so';
  Query OK, 0 rows affected (0.00 sec)

5. create a user that identifies by pam
  MariaDB [(none)]> create user testusr@localhost identified via pam;
  Query OK, 0 rows affected (0.00 sec)

6. try to log in with this user
  #> scl enable rh-mariadb100 -- mysql -u testusr -pabcdef


Current results:
ERROR 1045 (28000): Access denied for user 'testusr'@'localhost' (using password: NO)

Expected results:
login works

Additional info:
I got the following AVCs with the steps above:

type=AVC msg=audit(1426232392.662:3348): avc:  denied  { create } for  pid=11334 comm="mysqld" scontext=unconfined_u:system_r:mysqld_t:s0 tcontext=unconfined_u:system_r:mysqld_t:s0 tclass=netlink_audit_socket
type=AVC msg=audit(1426232392.662:3349): avc:  denied  { create } for  pid=11334 comm="mysqld" scontext=unconfined_u:system_r:mysqld_t:s0 tcontext=unconfined_u:system_r:mysqld_t:s0 tclass=netlink_audit_socket

However, I'm still not sure if this is something we should fix in either selinux-policy or mariadb package or it is just a specific configuration and user needs to create own specific SELinux rules for that. Which one is the correct way?

(In reply to Honza Horak from comment #1)
> It's weird that this works fine with RHEL-7 but it doesn't on F21.

Hm, now it doesn't seem so, probably just wrong testing, now I see the same issue in RHEL-7 as well.

*** Bug 1202870 has been marked as a duplicate of this bug. ***

It looks 

auth_use_pam()

will be needed. See all AVCs in #1196104 bug.

Upstream bug report (reported independently, with pam_ldap.so): https://mariadb.atlassian.net/browse/MDEV-7637

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-1375.html