Looks like my old faithful LAMP directory structure has come unstuck with SELinux. I prefer everything in the same place. CentOS 6.6 Apache 2.2.15 MySQL 6.5
/DATA/
/DATA/httpdocs/
/DATA/mysql/
/DATA/server-config.php
/DATA/httpd-error.logs...
If I do this then Apache works fine but mysql will not start.
chcon -R -t httpd_sys_content_t /DATA/
chcon -R -t mysqld_db_t /DATA/mysql
chcon -R -t httpd_sys_content_t /DATA/httpdocs
If I do this then mysql will start but Apache will not start.
chcon -R -t mysqld_db_t /DATA
chcon -R -t mysqld_db_t /DATA/mysql
chcon -R -t httpd_sys_content_t /DATA/httpdocs
I know this is related to the label I'm attaching to the root /DATA folder and they can not have two?
Yes all my problems go away if I disable SELinux but it is required for this project. The folders are chowned and chmodded fine.
For the mysql case the error is
2015-04-24 14:17:56 3391 [Warning] Can't create test file /DATA/mysql/WIK1.lower-test
2015-04-24 14:17:56 3391 [Warning] Can't create test file /DATA/mysql/WIK1.lower-test
/usr/sbin/mysqld: Can't change dir to '/DATA/mysql/' (Errcode: 13 - Permission denied)
2015-04-24 14:17:56 3391 [ERROR] Aborting
For the Apache case the error is.
Starting httpd: Warning: DocumentRoot [/DATA/httpdocs/] does not exist
I have tried adding this to /etc/selinux/targeted/contexts/files/file_contexts.local
/DATA/mysql(/.*)? system_u:object_r:mysql_db_t:s0
But it does nothing.
Can anyone help me tame SELinux or is my only option a separate folder for mysql?
Thanks
Thanks, I tried this (also posting answer cause I could not format text in comment)
cd ~
setenforce Permissive
service mysqld restart
service httpd restart
# interact with web app make it do things like file writes, db access, network and so on.
grep 'mysqld_t\|httpd_sys_content_t' /var/log/audit/audit.log | audit2allow -M postgreylocal
semodule -i postgreylocal.pp
# check it exists...
semodule -l
chcon -R -t postgreylocal /DATA
chcon -R -t postgreylocal /DATA/
setenforce Enforce
mysql still does not go. I think I do not know how to apply the policy postgreylocal? In the log I have - /var/log/audit/audit.log
type=AVC msg=audit(1429892483.654:3036): avc: denied { read } for pid=7089 comm="mysqld" name="DATA" dev=dm-3 ino=13 scontext=unconfined_u:system_r:mysqld_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=lnk_file
type=SYSCALL msg=audit(1429892483.654:3036): arch=c000003e syscall=80 success=no exit=-13 a0=132b500 a1=10 a2=41000 a3=7fff4d3af8f0 items=1 ppid=6882 pid=7089 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=4294967295 comm="mysqld" exe="/usr/sbin/mysqld" subj=unconfined_u:system_r:mysqld_t:s0 key=(null)
type=CWD msg=audit(1429892483.654:3036): cwd="/"
type=PATH msg=audit(1429892483.654:3036): item=0 name="/DATA/mysql/" nametype=UNKNOWN
If I chcon with SE Enforcing I get the following....
# chcon -R -t postgreylocal /DATA
chcon: failed to change context of `/DATA' to `system_u:object_r:postgreylocal:s0': Invalid argument