0

Looks like my old faithful LAMP directory structure has come unstuck with SELinux. I prefer everything in the same place. CentOS 6.6 Apache 2.2.15 MySQL 6.5

/DATA/
/DATA/httpdocs/
/DATA/mysql/
/DATA/server-config.php
/DATA/httpd-error.logs...

If I do this then Apache works fine but mysql will not start.

chcon -R -t httpd_sys_content_t /DATA/
chcon -R -t mysqld_db_t  /DATA/mysql
chcon -R -t httpd_sys_content_t /DATA/httpdocs

If I do this then mysql will start but Apache will not start.

chcon -R -t mysqld_db_t /DATA
chcon -R -t mysqld_db_t  /DATA/mysql
chcon -R -t httpd_sys_content_t /DATA/httpdocs

I know this is related to the label I'm attaching to the root /DATA folder and they can not have two?

Yes all my problems go away if I disable SELinux but it is required for this project. The folders are chowned and chmodded fine.

For the mysql case the error is

2015-04-24 14:17:56 3391 [Warning] Can't create test file /DATA/mysql/WIK1.lower-test
2015-04-24 14:17:56 3391 [Warning] Can't create test file /DATA/mysql/WIK1.lower-test
/usr/sbin/mysqld: Can't change dir to '/DATA/mysql/' (Errcode: 13 - Permission denied)
2015-04-24 14:17:56 3391 [ERROR] Aborting

For the Apache case the error is.

Starting httpd: Warning: DocumentRoot [/DATA/httpdocs/] does not exist

I have tried adding this to /etc/selinux/targeted/contexts/files/file_contexts.local

/DATA/mysql(/.*)?       system_u:object_r:mysql_db_t:s0

But it does nothing.

Can anyone help me tame SELinux or is my only option a separate folder for mysql?

Thanks


Thanks, I tried this (also posting answer cause I could not format text in comment)

    cd ~
    setenforce Permissive
    service mysqld restart
    service httpd restart
    # interact with web app make it do things like file writes, db access, network and so on.
    grep 'mysqld_t\|httpd_sys_content_t' /var/log/audit/audit.log | audit2allow -M postgreylocal 
    semodule -i postgreylocal.pp
    # check it exists...
    semodule -l
    chcon -R -t postgreylocal /DATA
    chcon -R -t postgreylocal /DATA/
setenforce Enforce

mysql still does not go. I think I do not know how to apply the policy postgreylocal? In the log I have - /var/log/audit/audit.log

type=AVC msg=audit(1429892483.654:3036): avc:  denied  { read } for  pid=7089 comm="mysqld" name="DATA" dev=dm-3 ino=13 scontext=unconfined_u:system_r:mysqld_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=lnk_file
type=SYSCALL msg=audit(1429892483.654:3036): arch=c000003e syscall=80 success=no exit=-13 a0=132b500 a1=10 a2=41000 a3=7fff4d3af8f0 items=1 ppid=6882 pid=7089 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=4294967295 comm="mysqld" exe="/usr/sbin/mysqld" subj=unconfined_u:system_r:mysqld_t:s0 key=(null)
type=CWD msg=audit(1429892483.654:3036):  cwd="/"
type=PATH msg=audit(1429892483.654:3036): item=0 name="/DATA/mysql/" nametype=UNKNOWN

If I chcon with SE Enforcing I get the following....

# chcon -R -t postgreylocal /DATA
chcon: failed to change context of `/DATA' to `system_u:object_r:postgreylocal:s0': Invalid argument
1
  • 1
    Your preference for everything in the same place is what needs to change. Put everything back in its default locations. Apr 24, 2015 at 15:25

1 Answer 1

2

You can not attach two different security labels to the same directories. So, you had to select a single label and let the other process to read/write the files with that label.

Problem is that doing that you are effectively granting the second process read/write access to the files owned by the first process, which is exactly what you don't want to do.

Two solutions exists:

  1. you can mark all as httpd_sys_content_t and let mysql access files with that label. While this is remain somewhat insecure (mysql process can read/write http files), mysqld is usually a trusted process and so it is way better than the other way around (let http do access mysql files).
  2. you con assign to /DATA/ a different, shared label and modify your selinux policy in a way that grant permission to both httpd and mysqld to that shared label. Under /DATA/, leave the two directory types with their own lables (eg: /DATA/mysql with mysqld_db_t and /DATA/httpdocs with httpd_sys_content_t)

In both cases, for an easy policy edit, set selinux to permissive mode, the use the audit2allow utility to parse your /var/log/audit/audit.log file. Here you can find more informations.

1
  • Please read the page I linked in my answer. It has anything you need to proceed.
    – shodanshok
    Apr 24, 2015 at 8:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .