Bug 143957 - can't connect to /var/lib/mysql/mysql.sock from apache/php
can't connect to /var/lib/mysql/mysql.sock from apache/php
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted (Show other bugs)
i386 Linux
medium Severity medium
: ---
: ---
Assigned To: Daniel Walsh
Depends On:
  Show dependency treegraph
Reported: 2005-01-02 12:30 EST by Glenn Henshaw
Modified: 2007-11-30 17:10 EST (History)
0 users

See Also:
Fixed In Version: RHBA-2005-251
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2005-04-12 17:56:28 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2005:251 low SHIPPED_LIVE selinux-policy-targeted bug fix update 2005-06-09 00:00:00 EDT

  None (edit)
Description Glenn Henshaw 2005-01-02 12:30:02 EST
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/125.5.5 (KHTML, like Gecko) Safari/125.12

Description of problem:
A php script is setup to access mysql through 'localhost'. The database fails to open. The following log is given:

Jan  2 12:08:18 voltaic kernel: audit(1104685698.767:0): avc:  denied  { connectto } for  pid=16699 exe=/usr/sbin/httpd path=/var/lib/mysql/mysql.sock scontext=root:system_r:httpd_t tcontext=root:system_r:unconfined_t tclass=unix_stream_socket

Priviledges for /var/lib/mysql/mysql.sock are:
srwxrwxrwx  mysql    mysql    system_u:object_r:mysqld_var_run_t mysql.sock

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:

Expected Results:  database should open via a socket file

Additional info:

httpd-2.0.52-3.1, php-4.3.10-3.2, php-mysql-4.3.10-3.2

Adding the following to /etc/selinux/targeted/src/policy/domains/misc/local.te 
ifdef(`mysqld.te', `
allow httpd_t unconfined_t:unix_stream_socket connectto;
 and reloading the policy allows this to work.
Comment 1 Daniel Walsh 2005-01-03 13:33:54 EST
The problem here is that your mysql is labeled incorrectly.

You need to relabel your system or at least the mysql 

rpm -q -l mysql mysql-server | restorecon -R -v -f -
Comment 2 Glenn Henshaw 2005-01-03 16:54:35 EST
That seems to have been it:

[root@voltaic thraxisp]# rpm -q -l mysql mysql-server | /sbin/restorecon -R -v -f -
/sbin/restorecon reset context /usr/libexec/mysqld->system_u:object_r:mysqld_exec_t
/sbin/restorecon reset context /var/run/mysqld->system_u:object_r:mysqld_var_run_t
/sbin/restorecon reset context /var/run/mysqld/mysqld.pid->system_u:object_r:

It seems that you need to relabel mysql-server after bringing it up for the first time.
Comment 3 Tim Powers 2005-06-09 09:06:04 EDT
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.


Note You need to log in before you can comment on or make changes to this bug.