Bug 1323673

Summary: SELinux policy doesn't allow mysql to open more than 1024 files
Product: Red Hat Enterprise Linux 7 Reporter: Anand Nande <anande>
Component: selinux-policyAssignee: Simon Sekidde <ssekidde>
Status: CLOSED ERRATA QA Contact: Milos Malik <mmalik>
Severity: medium Docs Contact:
Priority: medium    
Version: 7.4CC: amedeo.salvati, anande, aperotti, databases-maint, hhorak, lvrabec, mgrepl, mkolaja, mmalik, plautrba, pvrabec, ssekidde
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: selinux-policy-3.13.1-80.el7 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-11-04 02:46:41 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Comment 2 Lukas Vrabec 2016-04-22 12:01:34 UTC 
Hi, 

If you set permissive SELinux mode:
# setenforce 0

you still hit this issue? 

I don't think this is SELinux issue.
Comment 3 Amedeo Salvati 2016-04-22 12:22:40 UTC 
(In reply to Lukas Vrabec from comment #2)
> Hi, 
> 
> If you set permissive SELinux mode:
> # setenforce 0
> 
> you still hit this issue? 

no, if I set selinux on permissive mode mariadb can open more than 1024 files.

To be able to leave selinux on enforcement mode I created this module:

# cat mysql-fastweb.te 

module mysql-fastweb 1.0;

require {
        type mysqld_safe_t;
        type mysqld_t;
        class process { siginh noatsecure rlimitinh };
}

#============= mysqld_safe_t ==============
allow mysqld_safe_t mysqld_t:process { siginh rlimitinh noatsecure };


> 
> I don't think this is SELinux issue.

I do think this is SELinux issue.
Comment 5 Miroslav Grepl 2016-04-25 15:40:08 UTC 
(In reply to Amedeo Salvati from comment #3)
> (In reply to Lukas Vrabec from comment #2)
> > Hi, 
> > 
> > If you set permissive SELinux mode:
> > # setenforce 0
> > 
> > you still hit this issue? 
> 
> no, if I set selinux on permissive mode mariadb can open more than 1024
> files.
> 
> To be able to leave selinux on enforcement mode I created this module:
> 
> # cat mysql-fastweb.te 
> 
> module mysql-fastweb 1.0;
> 
> require {
>         type mysqld_safe_t;
>         type mysqld_t;
>         class process { siginh noatsecure rlimitinh };
> }
> 
> #============= mysqld_safe_t ==============
> allow mysqld_safe_t mysqld_t:process { siginh rlimitinh noatsecure };
> 
> 
> > 
> > I don't think this is SELinux issue.
> 
> I do think this is SELinux issue.

Could you please test it with

allow mysqld_safe_t mysqld_t:process { rlimitinh };

Thank you.
Comment 6 Amedeo Salvati 2016-04-25 16:32:06 UTC 
(In reply to Miroslav Grepl from comment #5)
> (In reply to Amedeo Salvati from comment #3)
> > (In reply to Lukas Vrabec from comment #2)
> > > Hi, 
> > > 
> > > If you set permissive SELinux mode:
> > > # setenforce 0
> > > 
> > > you still hit this issue? 
> > 
> > no, if I set selinux on permissive mode mariadb can open more than 1024
> > files.
> > 
> > To be able to leave selinux on enforcement mode I created this module:
> > 
> > # cat mysql-fastweb.te 
> > 
> > module mysql-fastweb 1.0;
> > 
> > require {
> >         type mysqld_safe_t;
> >         type mysqld_t;
> >         class process { siginh noatsecure rlimitinh };
> > }
> > 
> > #============= mysqld_safe_t ==============
> > allow mysqld_safe_t mysqld_t:process { siginh rlimitinh noatsecure };
> > 
> > 
> > > 
> > > I don't think this is SELinux issue.
> > 
> > I do think this is SELinux issue.
> 
> Could you please test it with
> 
> allow mysqld_safe_t mysqld_t:process { rlimitinh };
> 
> Thank you.

It works! 
Thanks
Amedeo

this is new module:

# cat mysql-fastweb.te 

module mysql-fastweb 1.1;

require {
        type mysqld_safe_t;
        type mysqld_t;
        class process { rlimitinh };
}

#============= mysqld_safe_t ==============
allow mysqld_safe_t mysqld_t:process { rlimitinh };
# checkmodule -M -m -o mysql-fastweb.mod mysql-fastweb.te
# semodule_package -o mysql-fastweb.pp -m mysql-fastweb.mod
# semodule -i mysql-fastweb.pp
# semodule -l | grep fastwe
mysql-fastweb   1.1
Comment 15 errata-xmlrpc 2016-11-04 02:46:41 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2283.html