0

I've a server with MySQL installed and running, and an iSCSI disk (with multipath) connected and running OK. The iSCSI disk uses /emc as mountpoint. My problem is when I move MySQL datadir to a new dir on de iSCSI disk, i.e., to /emc/lib/mysql.

The migration is OK, because if I stop selinux (setenforce 0) all works OK; but, when I restart selinux (setenforce 1), MySQL fails to access its databases.

I've installed and running setroubleshootd, which give me information about the error: /emc has a default context default_t, so all files ander /emc, including my new /emc/lib/mysql, have that context, and it isn't allowed.

Copying files from /var/lib/mysql to /emc/lib/mysql using -p and -Z options didn't work.

After reading reports from sealert -l I set system to regenerate labels:

touch /.autorelabel
reboot

But this didn't work. I think it could had failed because the new disk is iSCSI, and it automounts when network is running, and perhaps selinux tries to autorelabel new disks before network is up and running, so selinux "doesn't see" the new disk. The fstab line is:

/dev/mapper/DATAp1     /emc                    ext3    _netdev         0 0

I've tried to mount the iSCSI disk adding context to fstab:

/dev/mapper/DATAp1    /emc                    ext3    _netdev,context=system_u:object_r:var_t:s0              0 0

But this didn't work.

I've tried various commands for restore and regenerate contexts, without success:

restorecon -R -v /emc
fixfiles restore

How can I set the new disk label/default context? Or, who can I preserve contexts when copying MySQL datadir?

Thank you very much guys!

2 Answers 2

2

Are you adding the policy before running restorecon? If not, restorecon may be reverting your context changes. Try:

semanage fcontext -a -t mysql_db_t "/emc/lib/mysql(/.*)?"
restorecon -Rv /emc/lib/mysql

Your solution to run setsebool –P mysqld_disable_trans 1 effectively disables selinux for mysql.

0

I think I've found a solution which implies SElinux Booleans. Just setting (activate) two booleans did the trick:

# setsebool –P mysqld_disable_trans 1
# setsebool –P httpd_can_network_connect_db 1

After that, just rebooting both services and all is working.

The -P option sets it permanently. You can see a list of booleans and their status with:

# getsebool -a

Perhaps this could help others with similar problem.

Edit: do you think it's a good and secure solution? are there any other ways to do the trick? I'll keep the question unanswered so can mark it in case anybody knowns another better solution

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .