Bug 1323673 - SELinux policy doesn't allow mysql to open more than 1024 files
Summary: SELinux policy doesn't allow mysql to open more than 1024 files
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy
Version: 7.4
Hardware: All
OS: Linux
medium
medium
Target Milestone: rc
: ---
Assignee: Simon Sekidde
QA Contact: Milos Malik
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-04-04 12:11 UTC by Anand Nande
Modified: 2020-03-11 15:04 UTC (History)
12 users (show)

Fixed In Version: selinux-policy-3.13.1-80.el7
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-11-04 02:46:41 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2016:2283 0 normal SHIPPED_LIVE selinux-policy bug fix and enhancement update 2016-11-03 13:36:25 UTC

Comment 2 Lukas Vrabec 2016-04-22 12:01:34 UTC
Hi, 

If you set permissive SELinux mode:
# setenforce 0

you still hit this issue? 

I don't think this is SELinux issue.

Comment 3 Amedeo Salvati 2016-04-22 12:22:40 UTC
(In reply to Lukas Vrabec from comment #2)
> Hi, 
> 
> If you set permissive SELinux mode:
> # setenforce 0
> 
> you still hit this issue? 

no, if I set selinux on permissive mode mariadb can open more than 1024 files.

To be able to leave selinux on enforcement mode I created this module:

# cat mysql-fastweb.te 

module mysql-fastweb 1.0;

require {
        type mysqld_safe_t;
        type mysqld_t;
        class process { siginh noatsecure rlimitinh };
}

#============= mysqld_safe_t ==============
allow mysqld_safe_t mysqld_t:process { siginh rlimitinh noatsecure };


> 
> I don't think this is SELinux issue.

I do think this is SELinux issue.

Comment 5 Miroslav Grepl 2016-04-25 15:40:08 UTC
(In reply to Amedeo Salvati from comment #3)
> (In reply to Lukas Vrabec from comment #2)
> > Hi, 
> > 
> > If you set permissive SELinux mode:
> > # setenforce 0
> > 
> > you still hit this issue? 
> 
> no, if I set selinux on permissive mode mariadb can open more than 1024
> files.
> 
> To be able to leave selinux on enforcement mode I created this module:
> 
> # cat mysql-fastweb.te 
> 
> module mysql-fastweb 1.0;
> 
> require {
>         type mysqld_safe_t;
>         type mysqld_t;
>         class process { siginh noatsecure rlimitinh };
> }
> 
> #============= mysqld_safe_t ==============
> allow mysqld_safe_t mysqld_t:process { siginh rlimitinh noatsecure };
> 
> 
> > 
> > I don't think this is SELinux issue.
> 
> I do think this is SELinux issue.

Could you please test it with

allow mysqld_safe_t mysqld_t:process { rlimitinh };

Thank you.

Comment 6 Amedeo Salvati 2016-04-25 16:32:06 UTC
(In reply to Miroslav Grepl from comment #5)
> (In reply to Amedeo Salvati from comment #3)
> > (In reply to Lukas Vrabec from comment #2)
> > > Hi, 
> > > 
> > > If you set permissive SELinux mode:
> > > # setenforce 0
> > > 
> > > you still hit this issue? 
> > 
> > no, if I set selinux on permissive mode mariadb can open more than 1024
> > files.
> > 
> > To be able to leave selinux on enforcement mode I created this module:
> > 
> > # cat mysql-fastweb.te 
> > 
> > module mysql-fastweb 1.0;
> > 
> > require {
> >         type mysqld_safe_t;
> >         type mysqld_t;
> >         class process { siginh noatsecure rlimitinh };
> > }
> > 
> > #============= mysqld_safe_t ==============
> > allow mysqld_safe_t mysqld_t:process { siginh rlimitinh noatsecure };
> > 
> > 
> > > 
> > > I don't think this is SELinux issue.
> > 
> > I do think this is SELinux issue.
> 
> Could you please test it with
> 
> allow mysqld_safe_t mysqld_t:process { rlimitinh };
> 
> Thank you.

It works! 
Thanks
Amedeo

this is new module:

# cat mysql-fastweb.te 

module mysql-fastweb 1.1;

require {
        type mysqld_safe_t;
        type mysqld_t;
        class process { rlimitinh };
}

#============= mysqld_safe_t ==============
allow mysqld_safe_t mysqld_t:process { rlimitinh };
# checkmodule -M -m -o mysql-fastweb.mod mysql-fastweb.te
# semodule_package -o mysql-fastweb.pp -m mysql-fastweb.mod
# semodule -i mysql-fastweb.pp
# semodule -l | grep fastwe
mysql-fastweb   1.1

Comment 15 errata-xmlrpc 2016-11-04 02:46:41 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2283.html


Note You need to log in before you can comment on or make changes to this bug.