1

I'm trying to install MongoDB on CentOS 7.2 from the mongodb.org repository. So far so good, but the hoster has created a secondary disk (/mongo) for all the MongoDB data files. This clashes with the SELinux permissions, making MongoDB unable to start. I've got it to start by running setenforce 0, but that's not really the way I'd like to run a production server.

I've got quite some Linux experience, but all my SELinux experience is just turning it off. I've found this CentOS SELinux tutorial, which made me think running

[user@machine lib]$ sudo chcon -Rv --type mongod_var_lib_t /mongo
changing security context of ‘/mongo/mongod.lock’
changing security context of ‘/mongo/journal/WiredTigerLog.0000000001’
changing security context of ‘/mongo/journal/WiredTigerPreplog.0000000001’
changing security context of ‘/mongo/journal/WiredTigerPreplog.0000000002’
changing security context of ‘/mongo/journal’
changing security context of ‘/mongo/WiredTiger.lock’
changing security context of ‘/mongo/WiredTiger’
changing security context of ‘/mongo/WiredTiger.wt’
changing security context of ‘/mongo/WiredTiger.turtle’
changing security context of ‘/mongo/WiredTigerLAS.wt’
changing security context of ‘/mongo/sizeStorer.wt’
changing security context of ‘/mongo/_mdb_catalog.wt’
changing security context of ‘/mongo/storage.bson’
changing security context of ‘/mongo/collection-0-7567754672580995921.wt’
changing security context of ‘/mongo/index-1-7567754672580995921.wt’
changing security context of ‘/mongo/diagnostic.data/metrics.2016-04-14T06-51-54Z-00000’
changing security context of ‘/mongo/diagnostic.data/metrics.interim’
changing security context of ‘/mongo/diagnostic.data’
changing security context of ‘/mongo’
[user@machine lib]$ ls -Z /mongo
-rw-r--r--. mongod mongod system_u:object_r:mongod_var_lib_t:s0 collection-0-7567754672580995921.wt
drwxr-xr-x. mongod mongod system_u:object_r:mongod_var_lib_t:s0 diagnostic.data
-rw-r--r--. mongod mongod system_u:object_r:mongod_var_lib_t:s0 index-1-7567754672580995921.wt
drwxr-xr-x. mongod mongod system_u:object_r:mongod_var_lib_t:s0 journal
-rw-r--r--. mongod mongod system_u:object_r:mongod_var_lib_t:s0 _mdb_catalog.wt
-rw-r--r--. mongod mongod system_u:object_r:mongod_var_lib_t:s0 mongod.lock
-rw-r--r--. mongod mongod system_u:object_r:mongod_var_lib_t:s0 sizeStorer.wt
-rw-r--r--. mongod mongod system_u:object_r:mongod_var_lib_t:s0 storage.bson
-rw-r--r--. mongod mongod system_u:object_r:mongod_var_lib_t:s0 WiredTiger
-rw-r--r--. mongod mongod system_u:object_r:mongod_var_lib_t:s0 WiredTigerLAS.wt
-rw-r--r--. mongod mongod system_u:object_r:mongod_var_lib_t:s0 WiredTiger.lock
-rw-r--r--. mongod mongod system_u:object_r:mongod_var_lib_t:s0 WiredTiger.turtle
-rw-r--r--. mongod mongod system_u:object_r:mongod_var_lib_t:s0 WiredTiger.wt

would solve the issue. Afterwards, I did a touch /.autorelabel and rebooted. That, unfortunately, didn't fix the problem at hand. How would I go around fixing this?

The current error is: [user@machine lib]$ systemctl status mongod ● mongod.service - SYSV: Mongo is a scalable, document-oriented database. Loaded: loaded (/etc/rc.d/init.d/mongod) Active: failed (Result: exit-code) since Thu 2016-04-14 09:02:54 CEST; 2s ago Docs: man:systemd-sysv-generator(8) Process: 2180 ExecStart=/etc/rc.d/init.d/mongod start (code=exited, status=1/FAILURE)

Apr 14 09:02:54 LMG-TA-MONGO01.boolhosting.tld systemd[1]: Starting SYSV: Mongo is a scalable, document-oriented database....
Apr 14 09:02:54 LMG-TA-MONGO01.boolhosting.tld runuser[2187]: pam_unix(runuser:session): session opened for user mongod by (uid=0)
Apr 14 09:02:54 LMG-TA-MONGO01.boolhosting.tld runuser[2187]: pam_unix(runuser:session): session closed for user mongod
Apr 14 09:02:54 LMG-TA-MONGO01.boolhosting.tld mongod[2180]: Starting mongod: [FAILED]
Apr 14 09:02:54 LMG-TA-MONGO01.boolhosting.tld systemd[1]: mongod.service: control process exited, code=exited status=1
Apr 14 09:02:54 LMG-TA-MONGO01.boolhosting.tld systemd[1]: Failed to start SYSV: Mongo is a scalable, document-oriented database..
Apr 14 09:02:54 LMG-TA-MONGO01.boolhosting.tld systemd[1]: Unit mongod.service entered failed state.
Apr 14 09:02:54 LMG-TA-MONGO01.boolhosting.tld systemd[1]: mongod.service failed.
  • You could just remount the secondary disk at the appropriate location in the filesystem. – Michael Hampton Apr 14 '16 at 7:22
  • 1
    Wouldn't I still need to set the correct SELinux permissions then? Other than that, it does sound like a nice solution. – Xudonax Apr 14 '16 at 7:45
  • You'll generally get the right contexts automatically, when you use the default directory structure. – Michael Hampton Apr 14 '16 at 7:45
  • That doesn't really change anything, unfortunately :( ls -Z still shows the right security context, but Mongo doesn't want to start with the exact same error as above. – Xudonax Apr 14 '16 at 7:50
  • There's nothing useful there. Check MongoDB's own logs. – Michael Hampton Apr 14 '16 at 7:51
3

If you want to configure SELINUX for Mongo in simple way - try audit2why on your /var/log/audit/audit.log to see what kinds of violations would have been denied, and build custom policies with audit2allow. It works in 80% of incidents.

If you'll still have problems - run audit2why and fix another issues manually. Maybe we can help you on this step.

  • That pretty much fixed it. It only required yet another reinstall to start working afterwards. Now all I have to do is fix some kernel settings. Thanks! – Xudonax Apr 14 '16 at 8:36
  • @Xudonax - what sort of kernel settings needed to be changed? – Nic Cottrell Nov 30 '17 at 9:11
  • @NicCottrell I think it was some stuff in sysctl, max memory etc. But don't quote me on that, I'm not quite sure anymore and don't have access to that machine anymore – Xudonax Dec 2 '17 at 22:23
1

Running sudo sealert -a /var/log/audit/audit.log gave some useful insights here and recommendations for SELinux config changes. (We have changed the dbPath value in mongod.conf also.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.