0

Please advise me of whether it is possible to configure SElinux context in a way that MariaDB would pick it up.

current configuration:

ls -lZ /etc/my.cnf
lrwxrwxrwx. root root system_u:object_r:mysqld_etc_t:s0 /etc/my.cnf -> /app/program/cfg/mysql/etc/my.cnf

ls -lZ /app/program/cfg/mysql/etc/my.cnf
-rw-r--r--. root root system_u:object_r:default_t:s0   /app/program/cfg/mysql/etc/my.cnf

ls -l /app/program/cfg
lrwxrwxrwx. 1 user user 26 Jun 12 16:25 /app/program/cfg -> cfg-ver1

(I tried changing context for second file multiple times, it didn't work)

Currently MariaDB can't pick it up with enforcing, but is working well with permissive.

UPD: I also tried to use !include directive in /etc/my.cnf to include a different config file, but MariaDB doesn't pull it if path contains symbolic link as described above.

type=AVC msg=audit(1560419317.130:75): avc:  denied  { read } for  pid=4359 comm="mysqld" name="cfg" dev="xvda1" ino=205 scontext=system_u:system_r:mysqld_t:s0 tcontext=system_u:object_r:default_t:s0 tclass=lnk_file permissive=0

        Was caused by:
                Missing type enforcement (TE) allow rule.

And cfg is a symbolic link. This line in /etc/my.cnf does work (with proper Selinux context of target file):

!include /app/program/cfg-ver1/mysql/etc/my.cnf

After running:

sudo chcon -t mysqld_etc_t /app/program/cfg/mysql/etc/my.cnf

Resulting in:

[root@ip-172-31-60-102 etc]# ls -lZ my.cnf
lrwxrwxrwx. root root system_u:object_r:mysqld_etc_t:s0 my.cnf -> /app/program/cfg/mysql/etc/my.cnf
[root@ip-172-31-60-102 etc]# ls -lZ /app/program/cfg/mysql/etc/my.cnf
-rw-r--r--. root root system_u:object_r:mysqld_etc_t:s0 /app/program/cfg/mysql/etc/my.cnf

mariadb restarted, but the configuration file was not respected.

  • (the Linux tags could easily be assumed by the "selinux" tag) – Jeff Schaller Jun 12 at 17:37
  • What file is inode 205 on device xvda1? – Jeff Schaller Jun 14 at 9:59
0

In order for a process to be able to access a file, all the directories of a path leading to that file must have proper permissions to allow the process trying to read that file. This is true for traditional UNIX permissions as much as it is for SELinux contexts.

For traditional UNIX, "proper permissions" means just the x bit for directories, while permissions of symlinks are not considered.

But for SELinux contexts you need "read" permission on symlinks as much as you need "search" permission on directories.

Your excerpt from audit.log says that your cfg symlink has default_t type, which is not allowed to your MariaDB running under its mysql_t type.

Try applying a chcon command to the cfg symlink that is part of the path leading to your .cnf file. Specify the -h argument to have chcon apply to the symlink itself and not to the target the symlink refers to.

That is:

sudo chcon -ht mysqld_etc_t /app/program/cfg

If everything works as intended, you might want to craft a (series of) regexp(s) matching your directories to have SELinux always consider those directories as part of your MariaDB's configuration, so as not to lose the correct permissions for them when you or SELinux eventually perform some (auto-)relabeling.

Thus, for instance:

semanage fcontext -a -t mysqld_etc_t '/app/program/cfg.*(/.*)?'

comprises everything named cfg* under /app/program and below.

Depending on how strictly secure you want to be, you might want to provide a more tailored configuration by narrowing down the regexp or by providing additional semanage fcontext commands for the files further below that directory.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.