Bug 1693245 - SELinux: mariadb-server-galera
Summary: SELinux: mariadb-server-galera
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: mariadb
Version: 8.0
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: 8.0
Assignee: Michal Schorm
QA Contact: Anna Khaitovich
URL:
Whiteboard:
Depends On:
Blocks: 1732381
TreeView+ depends on / blocked
 
Reported: 2019-03-27 11:33 UTC by Michal Schorm
Modified: 2020-03-04 10:04 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Cause: Missing SELinux rule(s) Consequence: MariaDB cluster couldn't be set up without manually adding appropriate SELinux rules to all nodes machines. Fix: Added / Fixed SELinux rules in selinux-policy package Result: SELinux will not block standard setup of MariaDB cluster
Clone Of:
: 1732381 (view as bug list)
Environment:
Last Closed: 2020-03-04 10:04:40 UTC
Type: Bug
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:3708 None None None 2019-11-05 22:42:42 UTC

Description Michal Schorm 2019-03-27 11:33:44 UTC
You can use instructions from here:
https://bugzilla.redhat.com/show_bug.cgi?id=1522636#c5

to setup the cluster.

If you enable SELinux on any of the cluster nodes, it will make problems.

Comment 2 Karel Volný 2019-04-02 13:12:11 UTC
FTR, trying to run the automated test, I got this:

SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     actual (secure)
Max kernel policy version:      31
selinux-policy-3.14.1-61.el8.noarch
----
time->Tue Apr  2 05:45:51 2019
type=PROCTITLE msg=audit(1554198351.207:515): proctitle="ifconfig"
type=SYSCALL msg=audit(1554198351.207:515): arch=c00000b7 syscall=48 success=no exit=-13 a0=ffffffffffffff9c a1=aaaaba88e2a0 a2=4 a3=2 items=0 ppid=23534 pid=23580 auid=4294967295 uid=27 gid=27 euid=27 suid=27 fsuid=27 egid=27 sgid=27 fsgid=27 tty=(none) ses=4294967295 comm="ifconfig" exe="/usr/sbin/ifconfig" subj=system_u:system_r:mysqld_t:s0 key=(null)
type=AVC msg=audit(1554198351.207:515): avc:  denied  { search } for  pid=23580 comm="ifconfig" name="net" dev="proc" ino=3284 scontext=system_u:system_r:mysqld_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=dir permissive=0


Note You need to log in before you can comment on or make changes to this bug.