2

I have moved my /var/lib/mysql directory to an nfs share, updated all the config files and created symbolic links where appropriate. This works when I have selinux turned off, but mysqld fails to start when selinux is turned on. I have googled for a solution but haven't found any that works. I suspect I am missing something simple.

Here is what I tried:

yum install policycoreutils-python
semanage fcontext -a -t mysqld_db_t "/nfs/data0/mysql(/.*)?"
restorecon -Rv /nfs/data0/mysql

I suspect that I may be using the wrong context here, but not sure what the right one would be. Any suggestions?

UPDATE:

After following looking at the /var/log/audit/audit.log as suggested, I see the following errors:

type=AVC msg=audit(1398346018.436:3455): avc:  denied  { write } for  pid=10980 
   comm="httpd" name="mysql.sock" dev=0:13 ino=18438 
   scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:nfs_t:s0 
   tclass=sock_file
type=AVC msg=audit(1398346018.439:3456): avc:  denied  { search } for  pid=12395 
   comm="mysqld" name="mysql" dev=0:13 ino=14805 
   scontext=unconfined_u:system_r:mysqld_t:s0 tcontext=system_u:object_r:nfs_t:s0 
   tclass=dir
type=AVC msg=audit(1398346019.657:3457): avc:  denied  { open } for  pid=12395 
   comm="mysqld" name="cache_admin_menu.frm" dev=0:13 ino=23322 
   scontext=unconfined_u:system_r:mysqld_t:s0 tcontext=system_u:object_r:nfs_t:s0 
   tclass=file

Not sure what I need to do to address this. I have the following sebools enabled:

mysql_connect_any
httpd_can_network_connect_db
httpd_can_network_connect
httpd_can_network_memcache
httpd_can_sendmail
httpd_use_nfs
httpd_builtin_scripting

Thanks.

  • As a side note, are you sure MySQL over NFS is a great move to do? – Janne Pikkarainen Apr 25 '14 at 7:32
  • @Janne I don't want to run MySQL over NFS but since I don't have enough disk space locally, and the sysadmin won't allocate me more, then I have no choice but to do it this way. :-( – user5013 Apr 25 '14 at 20:29
1

This question is a bit old, but don't see one with the correct answer.

So I ran into this problem with AWS and EFS using a centos AMI to run mysql.

There are two problems that occur here. The permissions around the regular mysql files and the permissions around the mysql socket and its lock file.

It appears that the mysql socket is created with a context of mysqld_var_run_t and the lock file with a context of mysqld_db_t as are the regular mysql files.

Now, NFS mounts are usually given a context of nsf_t.

It appears that an nfs mount can only have on se context when being mounted. So what I had to do, when mounting via nfs was the following:

  1. mount the NFS share with the mysqld_db_t context.
  2. move the mysql socket to a different directory with the mysqld_db_t context.

So in fstab mount looks like this:

nfs-share-url:/ /data nfs4 nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2,noatime,context="system_u:object_r:mysqld_db_t:s0"  0 0

my.cnf looks like this:

datadir=/data
socket=/var/lib/mysql-files/mysql.sock

So permissions are correct on all files and mysql now stores data on the EFS NFS share.

0

I would cause auditd to start a new log file (kill -USR1 pidofauditd) then have SELinux in Permissive mode (setenforce 0) and then do what you normally do. This will generate suitable audit messages. Then

cat audit.log | audit2allow -M myLocalPolicy 
******************** IMPORTANT ***********************
To make this policy package active, execute:

semodule -i MyLocalPolicy.pp

Check the MyLocalPolicy.te file to see what the policy is doing and if you're happy install it with the semodule command provided.

  • I tried what you suggested but it still fails when I turn selinux back on. Here is what I did: killed all processes with auditd, setenforce 0, started mysql (started fine), cat audit.log | audit2allow -M myLocalPolicy, semodule -i myLocalPolicy.pp, stopped mysql, setenforce 1, started mysql and it failed to star. Did I miss something? – user5013 Apr 24 '14 at 17:10
  • 1
    @user5013 This usually works. Perhaps you need to run your system in permissive mode for longer to gather the messages. Did yu check your audit.log to see if new denie messages were being generated after you installed the local policy ? – user9517 Apr 25 '14 at 6:03
0

The "open" error indicates it may not be finding "mysql.sock". Have you tried adjusting the name to full path to where it is located on your system?

fyi - I only suggest as I found your issue when googling my similar error which is httpd but "write" on name='/tmp/mysql.sock' which I have defined under "socket" in MySQL's my.cnf and php.ini.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.