Red Hat Bugzilla – Bug 192904
Default policy for MySQL disallows setting open_files_limit
Last modified: 2008-01-30 14:05:34 EST
Description of problem: The default policy for mysqld does not allow you to set the open_files_limit. Attempts to do so result in a selinux message being logged Version-Release number of selected component (if applicable):selinux-policy-targeted-1.17.30-2.126 How reproducible: Completely reproducible Steps to Reproduce: 1. add the following line to your /etc/my.cnf file: set-variable = open_files_limit=8192 2. restart mysql 3. Look at /var/log/messages. You will see an selinux log message that an action was denied 4. Look at the /var/log/mysqld.log - you will see that MySQL was unable to change the parameter Actual results: Expected results: Additional info: This can be fixed by updating the policy file in /etc/selinux/targeted/src/policy/domains/program/ mysqld.te, which I have done and it is now working. Just wanted to get this bug logged so that it can be fixed in the default install.
What AVC messages are you seeing?
audit(1148420382.015:56): avc: denied { sys_resource } for pid=23201 co mm="mysqld" capability=24 scontext=root:system_r:mysqld_t tcontext=root:system_r:mysqld_t tclass=capab ility
BTW, these are the two lines that I changed in /etc/selinux/targeted/src/policy/domains/program/ mysqld.te: allow mysqld_t self:capability { dac_override setgid setuid net_bind_service sys_resource }; allow mysqld_t self:process { setsched getsched setrlimit rlimitinh }; The combination of those two works. Just adding the 'setrlimit' to self:process did not work, but I didn't try adding just 'sys_resource' to self:capability.
Fixed in selinux-policy-targeted-1.17.30-2.138
Bulk closing a old selinux policy bugs that were in the modified state. If the bug is still not fixed. Please reopen.