Bug 858406

Summary: PostgreSQL PITR setup with SELinux feature request
Product: Red Hat Enterprise Linux 6 Reporter: Dmitry S. Makovey <dmitry>
Component: selinux-policyAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED ERRATA QA Contact: Michal Trunecka <mtruneck>
Severity: medium Docs Contact:
Priority: medium    
Version: 6.3CC: dwalsh, ebenes, mmalik, mtruneck
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: selinux-policy-3.7.19-168.el6 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 873350 (view as bug list) Environment:
Last Closed: 2013-02-21 08:29:20 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 873350    
Attachments:
Description Flags
Sample module outlining all the permissions required for PITR implementation with SSH and RSync none

Description Dmitry S. Makovey 2012-09-18 22:02:19 UTC 
Created attachment 614140 [details]
Sample module outlining all the permissions required for PITR implementation with SSH and RSync

Description of problem:

Currently RHEL-shipped SELinux policy is not set up to work with PostgreSQL's PITR (point-in-time recovery). In order to apply most common methods for PITR implementation one needs to manually generate corresponding module. From information I've gathered implementation ends up being fairly similar in each case thus may warrant a tunable implemented in default policies to allow PostgreSQL to transfer WAL files to the secondary node[s]. 

In my particular case I'm implementing PGPool-II replication with PITR. (Following documentation at: http://www.pgpool.net/docs/latest/pgpool-en.html#online-recovery ). 

Version-Release number of selected component (if applicable):

selinux-policy-targeted-3.7.19-155.el6_3.noarch
selinux-policy-3.7.19-155.el6_3.noarch

How reproducible:

Always.

Steps to Reproduce:
1. setup PGPool-II and PITR recovery as per http://www.pgpool.net/docs/latest/pgpool-en.html#online-recovery
1a. namely add to /var/lib/pgsql/data/postgresql.conf:

archive_mode = on 
archive_command = '/usr/bin/rsync %p postgres.3.4:/var/spool/pgsql/wal/%f < /dev/null'

which essentially asks postgres to send WAL files over to the secondary machine whenever it reaches checkpoint.

2. launch "psql -U postgres template1" on one of the nodes
3. => select pg_backup_start("backup_test");
4. => select pg_backup_stop()
  
Actual results:

WARNING:  pg_stop_backup still waiting for archive to complete (60 seconds elapsed)

and a lot of SELinux denials

Expected results:

operation to succeed.

Additional info:

PGPool-II used is built using SPEC file in bug #847357 which essentially is a Fedora package rebuilt and tweaked to work in RHEL
Comment 2 Miroslav Grepl 2012-09-19 12:54:53 UTC 
Ok, I added a new

sepgsql_enable_pitr_implementation

boolean to Fedora. Will backport to RHEL6.
Comment 3 Miroslav Grepl 2012-09-20 06:15:56 UTC 
Ok

optional_policy(`
    tunable_policy(`postgresql_can_rsync',`
        rsync_exec(postgresql_t)
    ')
')

optional_policy(`
    tunable_policy(`postgresql_can_rsync',`
        ssh_exec(postgresql_t)
        ssh_read_user_home_files(postgresql_t)
        corenet_tcp_connect_ssh_port(postgresql_t)
    ')
')

I like this solution more than was my first.
Comment 7 errata-xmlrpc 2013-02-21 08:29:20 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-0314.html