Red Hat Bugzilla – Bug 1490956
PostgreSQL fails to start under SELinux MLS
Last modified: 2018-04-10 08:42:56 EDT
Description of problem: When the system is using the MSL SELinux policy, the postgresql.service unit fails to start: ExecStartPre=/usr/bin/postgresql-check-db-dir ${PGDATA} (code=exited, status=1/FAILURE) The problem is this AVC: type=AVC msg=audit(1505225522.279:9675648): avc: denied { getattr } for pid=14486 comm="postgresql-chec" path="/var/lib/pgsql/data/PG_VERSION" dev="dm-0" ino=135 scontext=system_u:system_r:init_t:s0-s15:c0.c1023 tcontext=system_u:object_r:postgresql_db_t:s0 tclass=file Version-Release number of selected component (if applicable): postgresql-9.2.18-1.el7.x86_64 selinux-policy-mls-3.13.1-102.el7_3.16.noarch How reproducible: Always Steps to Reproduce: 1. Enable SELinux MLS 2. Start postgresql.service Actual results: PostgreSQL fails to start because postgresql-check-db-dir does not run Expected results: postgresql-check-db-dir should execute successfully even under SELinux MLS, and postgresql should start Additional info: Fixing this problem is trivial: chcon -t postgresql_exec_t /usr/bin/postgresql-check-db-dir
# sestatus SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root directory: /etc/selinux Loaded policy name: mls Current mode: enforcing Mode from config file: permissive Policy MLS status: enabled Policy deny_unknown status: denied Max kernel policy version: 31 # service postgresql start Redirecting to /bin/systemctl start postgresql.service # ps -efZ | grep postgres system_u:system_r:postgresql_t:s0-s15:c0.c1023 postgres 1746 1 0 04:31 ? 00:00:00 /usr/bin/postgres -D /var/lib/pgsql/data -p 5432 system_u:system_r:postgresql_t:s0-s15:c0.c1023 postgres 1747 1746 0 04:31 ? 00:00:00 postgres: logger process system_u:system_r:postgresql_t:s0-s15:c0.c1023 postgres 1749 1746 0 04:31 ? 00:00:00 postgres: checkpointer process system_u:system_r:postgresql_t:s0-s15:c0.c1023 postgres 1750 1746 0 04:31 ? 00:00:00 postgres: writer process system_u:system_r:postgresql_t:s0-s15:c0.c1023 postgres 1751 1746 0 04:31 ? 00:00:00 postgres: wal writer process system_u:system_r:postgresql_t:s0-s15:c0.c1023 postgres 1752 1746 0 04:31 ? 00:00:00 postgres: autovacuum launcher process system_u:system_r:postgresql_t:s0-s15:c0.c1023 postgres 1753 1746 0 04:31 ? 00:00:00 postgres: stats collector process root:sysadm_r:sysadm_t:s0 root 1756 1296 0 04:31 pts/0 00:00:00 grep --color=auto postgres # matchpathcon /usr/bin/postgresql-check-db-dir /usr/bin/postgresql-check-db-dir system_u:object_r:postgresql_exec_t:s0 # rpm -qa selinux-policy\* | sort selinux-policy-3.13.1-189.el7.noarch selinux-policy-mls-3.13.1-189.el7.noarch selinux-policy-targeted-3.13.1-189.el7.noarch #
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:0763