3

I noticed I am getting some SELinux errors when running mongod for the UniFi controller program. Namely, I am getting:

SELinux is preventing /usr/bin/mongod from search access on the directory /.

SELinux is preventing /usr/bin/mongod from search access on the directory /var/lib/nfs

SELinux is preventing /usr/bin/mongod from search access on the directory fs

SELinux is preventing /usr/bin/mongod from search access on the directory /var/lib/snapd

I don't see any reason as to why mongod needs search access to any of these directories and I am wondering if/how I can disable it trying to search them and I don't think giving it access to my entire system is really a solution.

The actual database is stored, it is in the default location (config file below) and the SELinux types are set correctly for those directories as the service does seem to run and no errors are thrown about accessing /var/lib/mongo.

# mongod.conf                                                                   
                                                                                
# for documentation of all options, see:                                        
#   http://docs.mongodb.org/manual/reference/configuration-options/             
                                                                                
# where to write logging data.                                                  
systemLog:                                                                      
  destination: file                                                             
  logAppend: true                                                               
  path: /var/log/mongodb/mongod.log                                             
                                                                                
# Where and how to store data.                                                  
storage:                                                                        
  dbPath: /var/lib/mongo                                                        
  journal:                                                                      
    enabled: true                                                               
#  engine:                                                                      
#  wiredTiger:                                                                  
                                                                                
# how the process runs                                                          
processManagement:                                                              
  fork: true  # fork and run in background                                      
  pidFilePath: /var/run/mongodb/mongod.pid  # location of pidfile               
  timeZoneInfo: /usr/share/zoneinfo                                             
                                                                                
# network interfaces                                                            
net:                                                                            
  port: 27017                                                                   
  bindIp: 127.0.0.1  # Enter 0.0.0.0,:: to bind to all IPv4 and IPv6 addresses or, alternatively, use the net.bindIpAll setting.

2 Answers 2

1

I had the same issue with MongoDB-7 on RHEL9 and as @kwodzicki I don't want to modify SELinux creating a new policy and so on, because I don't need MongoDB access to NFS or retrieve statistic information because of FTDC for my DEV environment.

After read the documentation shared by @hq: Full Time Diagnostic Data Capture (FTDC) I solved this issue. Just in case, just add next lines to /etc/mongod.conf

setParameter:
  diagnosticDataCollectionEnabled: false

Then restart MongoDB:

# systemctl restart mongod
2

From Install MongoDB on RedHat:

The current SELinux Policy does not allow the MongoDB process to access /sys/fs/cgroup, which is required to determine the available memory on your system.

he current SELinux Policy does not allow the MongoDB process to open and read /proc/net/netstat, which is required for Full Time Diagnostic Data Capture (FTDC).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .