SELinux preventing mongod search access

Question

I noticed I am getting some SELinux errors when running mongod for the UniFi controller program. Namely, I am getting:

SELinux is preventing /usr/bin/mongod from search access on the directory /.

SELinux is preventing /usr/bin/mongod from search access on the directory /var/lib/nfs

SELinux is preventing /usr/bin/mongod from search access on the directory fs

SELinux is preventing /usr/bin/mongod from search access on the directory /var/lib/snapd

I don't see any reason as to why mongod needs search access to any of these directories and I am wondering if/how I can disable it trying to search them and I don't think giving it access to my entire system is really a solution.

The actual database is stored, it is in the default location (config file below) and the SELinux types are set correctly for those directories as the service does seem to run and no errors are thrown about accessing /var/lib/mongo.

# mongod.conf                                                                   
                                                                                
# for documentation of all options, see:                                        
#   http://docs.mongodb.org/manual/reference/configuration-options/             
                                                                                
# where to write logging data.                                                  
systemLog:                                                                      
  destination: file                                                             
  logAppend: true                                                               
  path: /var/log/mongodb/mongod.log                                             
                                                                                
# Where and how to store data.                                                  
storage:                                                                        
  dbPath: /var/lib/mongo                                                        
  journal:                                                                      
    enabled: true                                                               
#  engine:                                                                      
#  wiredTiger:                                                                  
                                                                                
# how the process runs                                                          
processManagement:                                                              
  fork: true  # fork and run in background                                      
  pidFilePath: /var/run/mongodb/mongod.pid  # location of pidfile               
  timeZoneInfo: /usr/share/zoneinfo                                             
                                                                                
# network interfaces                                                            
net:                                                                            
  port: 27017                                                                   
  bindIp: 127.0.0.1  # Enter 0.0.0.0,:: to bind to all IPv4 and IPv6 addresses or, alternatively, use the net.bindIpAll setting.

Answer 1

From Install MongoDB on RedHat:

The current SELinux Policy does not allow the MongoDB process to access /sys/fs/cgroup, which is required to determine the available memory on your system.

he current SELinux Policy does not allow the MongoDB process to open and read /proc/net/netstat, which is required for Full Time Diagnostic Data Capture (FTDC).