Bug 192904

Summary:	Default policy for MySQL disallows setting open_files_limit
Product:	Red Hat Enterprise Linux 4	Reporter:	Grant Robinson <grant>
Component:	selinux-policy-targeted	Assignee:	Daniel Walsh <dwalsh>
Status:	CLOSED CURRENTRELEASE	QA Contact:
Severity:	high	Docs Contact:
Priority:	medium
Version:	4.0	CC:	dwalsh
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	Current	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2008-01-30 19:05:34 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Grant Robinson 2006-05-23 22:42:58 UTC

Description of problem:
The default policy for mysqld does not allow you to set the open_files_limit.  Attempts to do so result
in a selinux message being logged


Version-Release number of selected component (if applicable):selinux-policy-targeted-1.17.30-2.126


How reproducible: Completely reproducible


Steps to Reproduce:
1. add the following line to your /etc/my.cnf file:

set-variable = open_files_limit=8192

2. restart mysql

3.  Look at /var/log/messages.  You will see an selinux log message that an action was denied

4.  Look at the /var/log/mysqld.log - you will see that MySQL was unable to change the parameter

  
Actual results:


Expected results:


Additional info:
This can be fixed by updating the policy file in /etc/selinux/targeted/src/policy/domains/program/
mysqld.te, which I have done and it is now working.  Just wanted to get this bug logged so that it can 
be fixed in the default install.

Comment 1 Daniel Walsh 2006-05-25 18:05:07 UTC

What AVC messages are you seeing?

Comment 2 Grant Robinson 2006-05-25 18:16:48 UTC

audit(1148420382.015:56): avc:  denied  { sys_resource } for  pid=23201 co
mm="mysqld" capability=24 scontext=root:system_r:mysqld_t tcontext=root:system_r:mysqld_t 
tclass=capab
ility

Comment 3 Grant Robinson 2006-05-25 18:19:30 UTC

BTW, these are the two lines that I changed in /etc/selinux/targeted/src/policy/domains/program/
mysqld.te:

allow mysqld_t self:capability { dac_override setgid setuid net_bind_service sys_resource };
allow mysqld_t self:process { setsched getsched setrlimit rlimitinh };

The combination of those two works.  Just adding the 'setrlimit' to self:process did not work, but I 
didn't try adding just 'sys_resource' to self:capability.

Comment 4 Daniel Walsh 2006-06-15 22:29:32 UTC

Fixed in selinux-policy-targeted-1.17.30-2.138

Comment 5 Daniel Walsh 2008-01-30 19:05:34 UTC

Bulk closing a old selinux policy bugs that were in the modified state.  If the
bug is still not fixed.  Please reopen.