| Summary: | mysqld does not start with selinux in enforcing mode | |||
|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | David Downing <dave.downing> | |
| Component: | mysql | Assignee: | Tom Lane <tgl> | |
| Status: | CLOSED DUPLICATE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | |
| Severity: | high | Docs Contact: | ||
| Priority: | unspecified | |||
| Version: | 16 | CC: | deron.meranda, dew, dietervandenbroeck, hhorak, jfarre, richardfearn, tgl | |
| Target Milestone: | --- | |||
| Target Release: | --- | |||
| Hardware: | x86_64 | |||
| OS: | Linux | |||
| Whiteboard: | ||||
| Fixed In Version: | Doc Type: | Bug Fix | ||
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 759679 (view as bug list) | Environment: | ||
| Last Closed: | 2011-11-17 16:12:13 UTC | Type: | --- | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
|
Description
David Downing
2011-11-15 11:05:24 UTC
Forgot to add that # restorecon -r / makes no difference. I am seeing this to. Immediately after upgrading from F15 to F16, mysqld would start fine. However after updating all the system packages I am now getting an SELinux AVC error. I don't know what in particular may have changed
I am using the SELinux Targeted policy in enforcing mode. In particular,
selinux-policy-targeted-3.10.0-55.fc16.noarch
The errors getting logged are:
Nov 16 03:10:37 beryl kernel: [ 3201.542880] type=1400 audit(1321431037.652:22): avc: denied { read } for pid=4498 comm="mysqld_safe" path="/bin/bash" dev=dm-0 ino=5505036 scontext=system_u:system_r:mysqld_safe_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file
Nov 16 03:10:37 beryl mysqld_safe[4498]: /bin/sh: error while loading shared libraries: cannot apply additional memory protection after relocation: Permission denied
The SELinux booleans related to MySQL are set as:
allow_user_mysql_connect --> off
mysql_connect_any --> off
Same problem here. [Dieter@DieterLaptop ~]$ rpm -qa | grep mysql mysql-server-5.5.16-3.fc16.x86_64 mysql-libs-5.5.16-3.fc16.x86_64 mysql-5.5.16-3.fc16.x86_64 mysql-utilities-1.0.1-0.5.2.35.fc16.noarch [Dieter@DieterLaptop ~]$ rpm -qa | grep selinux libselinux-python-2.1.6-4.fc16.x86_64 libselinux-2.1.6-4.fc16.x86_64 selinux-policy-targeted-3.10.0-55.fc16.noarch selinux-policy-3.10.0-55.fc16.noarch libselinux-utils-2.1.6-4.fc16.x86_64 libselinux-2.1.6-4.fc16.i686 It looks like this bug is caused by http://bugzilla.redhat.com/show_bug.cgi?id=753816 *** Bug 754672 has been marked as a duplicate of this bug. *** Please see whether your issue isn't fixed by https://admin.fedoraproject.org/updates/selinux-policy-3.10.0-56.fc16 *** Bug 753851 has been marked as a duplicate of this bug. *** selinux-policy-3.10.0-56.fc16 fixes the bug. Problem solved OK, thanks for the followup. *** This bug has been marked as a duplicate of bug 753816 *** selinux-policy-3.10.0-56.fc16 fixed it for me, too. Donald As the original submitter of this bug I am beginning to feel a bit left out! # yum clean all && yum --enablerepo=updates-testing update selinux-policy just gives me "No Packages marked for Update" # rpm -q selinux-policy selinux-policy-3.10.0-55.fc16.noarch David, The update is available at https://admin.fedoraproject.org/updates/selinux-policy-3.10.0-56.fc16 or on koji. Donald The updated packages haven't yet shown up in the updates-testing repository yet. I don't know if it is just a natural repo-push delay, or they are still waiting on confirmation that it fixes all the other bugs not related to mysql. You can download the RPM files directly from the Fedora build system at http://koji.fedoraproject.org/koji/buildinfo?buildID=274347 and install them using plain rpm, e.g., "rpm -Uvh" You can influence how quickly the bugs get pushed to testing by adding karma at: https://admin.fedoraproject.org/updates/selinux-policy-3.10.0-56.fc16 Donald Fixed for me too and added the karma. |