Bug 2221433
| Summary: | SELinux is preventing mariadbd from 'search' accesses on the directory net. | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | dan | ||||||
| Component: | mysql-selinux | Assignee: | Michal Schorm <mschorm> | ||||||
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||||
| Severity: | unspecified | Docs Contact: | |||||||
| Priority: | unspecified | ||||||||
| Version: | 38 | CC: | amessina, dan, hhorak, ljavorsk, mschorm | ||||||
| Target Milestone: | --- | Keywords: | Reopened | ||||||
| Target Release: | --- | ||||||||
| Hardware: | x86_64 | ||||||||
| OS: | Unspecified | ||||||||
| Whiteboard: | abrt_hash:4543e3b644fd226b4089e115da133e4c6f0af10dc68a4c015d3cf0a19425839a;VARIANT_ID=workstation; | ||||||||
| Fixed In Version: | mysql-selinux-1.0.9-1.fc40 mysql-selinux-1.0.10-1.fc40 mysql-selinux-1.0.10-1.fc39 mysql-selinux-1.0.10-1.fc38 mysql-selinux-1.0.10-1.fc37 | Doc Type: | If docs needed, set a value | ||||||
| Doc Text: | Story Points: | --- | |||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | 2023-11-27 01:53:51 UTC | Type: | --- | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Embargoed: | |||||||||
| Attachments: |
|
||||||||
Created attachment 1974816 [details]
File: description
Created attachment 1974817 [details]
File: os_info
Hello, could you please describe your intention or use-case, that led you to this situation? Because I'd guess that the 'mariadbd' would likely want not only to 'search' the directory, but also operate on the files inside. A description or reproducer would help me understand what's going on and fix the SELinux rules in more accurate way. Cause is unknown. I don't do anything special other than access the db across the network. Accessed DB across the network from a Windows mysql ODBC client. package: selinux-policy-targeted-38.22-1.fc38.noarch comment: Accessed DB across the network from a Windows mysql ODBC client. hashmarkername: setroubleshoot type: libreport reason: SELinux is preventing mariadbd from 'search' accesses on the directory net. kernel: 6.4.7-200.fc38.x86_64 Is this the same as #2186996? I can confirm this issue exists in Fedora 39. FEDORA-2023-2b65fa4f45 has been submitted as an update to Fedora 40. https://bodhi.fedoraproject.org/updates/FEDORA-2023-2b65fa4f45 FEDORA-2023-2b65fa4f45 has been pushed to the Fedora 40 stable repository. If problem still persists, please make note of it in this bug report. Sorry for the misleading Fedora Update reports. This issue has NOT been fixed. I've made an attempt to fix it, but I was unsuccessful. I've reverted the respective commit on the upstream of the 'mysql-selinux' package, however the update automation still picked up the BZ number from the reverted commit message and used them to mark those BZs as resolved. While the fix attempt I made wasn't working, I believe the research behind it I've made should be correct. https://github.com/devexp-db/mysql-selinux/commit/de84778e555b891fd9ea5f3111c87a4990650d6c I'll try again after consultation with someone proficient in writing SELinux rules. FEDORA-2023-26954ac6f4 has been submitted as an update to Fedora 40. https://bodhi.fedoraproject.org/updates/FEDORA-2023-26954ac6f4 FEDORA-2023-26954ac6f4 has been pushed to the Fedora 40 stable repository. If problem still persists, please make note of it in this bug report. FEDORA-2023-de0c445f23 has been submitted as an update to Fedora 39. https://bodhi.fedoraproject.org/updates/FEDORA-2023-de0c445f23 FEDORA-2023-50b22e7196 has been submitted as an update to Fedora 38. https://bodhi.fedoraproject.org/updates/FEDORA-2023-50b22e7196 This is the actual update that should fix your issue, please test it: https://bodhi.fedoraproject.org/updates/?search=mysql-selinux-1.0.10 FEDORA-2023-de0c445f23 has been pushed to the Fedora 39 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2023-de0c445f23` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2023-de0c445f23 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. FEDORA-2023-50b22e7196 has been pushed to the Fedora 38 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2023-50b22e7196` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2023-50b22e7196 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. FEDORA-2023-f5860f0475 has been pushed to the Fedora 37 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2023-f5860f0475` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2023-f5860f0475 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. FEDORA-2023-de0c445f23 has been pushed to the Fedora 39 stable repository. If problem still persists, please make note of it in this bug report. FEDORA-2023-50b22e7196 has been pushed to the Fedora 38 stable repository. If problem still persists, please make note of it in this bug report. FEDORA-2023-f5860f0475 has been pushed to the Fedora 37 stable repository. If problem still persists, please make note of it in this bug report. FEDORA-2024-8beb0aba20 (selinux-policy-41.26-1.fc42) has been submitted as an update to Fedora 42. https://bodhi.fedoraproject.org/updates/FEDORA-2024-8beb0aba20 FEDORA-2024-8beb0aba20 (selinux-policy-41.26-1.fc42) has been pushed to the Fedora 42 stable repository. If problem still persists, please make note of it in this bug report. |
Description of problem: SELinux is preventing mariadbd from 'search' accesses on the directory net. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that mariadbd should be allowed search access on the net directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'mariadbd' --raw | audit2allow -M my-mariadbd # semodule -X 300 -i my-mariadbd.pp Additional Information: Source Context system_u:system_r:mysqld_t:s0 Target Context system_u:object_r:sysctl_net_t:s0 Target Objects net [ dir ] Source mariadbd Source Path mariadbd Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-38.17-1.fc38.noarch Local Policy RPM mysql-selinux-1.0.5-3.fc38.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 6.3.8-200.fc38.x86_64 #1 SMP PREEMPT_DYNAMIC Thu Jun 15 02:15:40 UTC 2023 x86_64 Alert Count 22 First Seen 2023-04-15 13:59:39 EDT Last Seen 2023-07-08 16:13:42 EDT Local ID 81b23eb7-79bb-4070-94f3-208998c1eebd Raw Audit Messages type=AVC msg=audit(1688847222.756:17470): avc: denied { search } for pid=1379 comm="mariadbd" name="net" dev="proc" ino=18692 scontext=system_u:system_r:mysqld_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=dir permissive=0 Hash: mariadbd,mysqld_t,sysctl_net_t,dir,search Version-Release number of selected component: selinux-policy-targeted-38.17-1.fc38.noarch Additional info: reporter: libreport-2.17.10 package: selinux-policy-targeted-38.17-1.fc38.noarch component: mysql-selinux hashmarkername: setroubleshoot type: libreport reason: SELinux is preventing mariadbd from 'search' accesses on the directory net. kernel: 6.3.8-200.fc38.x86_64 component: mysql-selinux Potential duplicate: bug 2186996