Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-10160

enabled cracklib plugin blocks all password changes with SELINUX=enforcing

Details

    Description

      When using default settings cracklib tries to read the password database from /usr/share/cracklib/. When using the standard SELINUX profile mysqdl doesn't have access to that directory though.

      Workarounds:

      • add additional access rules: 

            semanage fcontext -a -t mysqld_etc_t  "/usr/share/cracklib(/.*)?"
        		 
            restorecon -Rv /usr/share/cracklib

      • or copy cracklib dictionary to mysqld datadir and set cracklib_password_check_dictionary accordingly

      Attachments

        Issue Links

          relates to

          Bug - A problem which impairs or prevents the functions of the product. MDEV-18374 SELinux breaks cracklib_password_check plugin

          • Major - Major loss of function.
          • Closed

          Activity

            Ascending order - Click to sort in descending order
            hholzgra Hartmut Holzgraefe created issue -
            serg Sergei Golubchik made changes -
            Field Original Value New Value
            Component/s Documentation [ 10903 ]
            serg Sergei Golubchik made changes -
            Fix Version/s N/A [ 14700 ]
            serg Sergei Golubchik made changes -
            Assignee Ian Gilfillan [ greenman ]
            elenst Elena Stepanova added a comment -

            I'm not sure how it should be fixed. By not reading the passwords?
            Assigning to serg for consideration.

            elenst Elena Stepanova added a comment - I'm not sure how it should be fixed. By not reading the passwords? Assigning to serg for consideration.
            elenst Elena Stepanova made changes -
            Component/s Documentation [ 10903 ]
            Fix Version/s 10.1 [ 16100 ]
            Fix Version/s N/A [ 14700 ]
            Affects Version/s 10.1 [ 16100 ]
            Assignee Ian Gilfillan [ greenman ] Sergei Golubchik [ serg ]
            serg Sergei Golubchik made changes -
            Description When using default settings cracklib tries to read the password database from /usr/share/cracklib/. When using the standard SELINUX profile mysqdl doesn't have access to that directory though.

            Workarounds:

            * add additional access rules:

                semanage fcontext -a -t mysqld_etc_t "/usr/share/cracklib(/.*)?"
                restorecon -Rv /usr/share/cracklib

            * or copy cracklib dictionary to mysqld datadir and set cracklib_password_check_dictionary accordingly             		When using default settings cracklib tries to read the password database from /usr/share/cracklib/. When using the standard SELINUX profile mysqdl doesn't have access to that directory though.

            Workarounds:

            * add additional access rules:
            {code:bash}
                semanage fcontext -a -t mysqld_etc_t "/usr/share/cracklib(/.*)?"
                restorecon -Rv /usr/share/cracklib
            {code}
            * or copy cracklib dictionary to mysqld datadir and set cracklib_password_check_dictionary accordingly
            serg Sergei Golubchik made changes -
            Assignee Sergei Golubchik [ serg ] Ian Gilfillan [ greenman ]
            serg Sergei Golubchik made changes -
            Component/s Documentation [ 10903 ]
            serg Sergei Golubchik made changes -
            Fix Version/s N/A [ 14700 ]
            Fix Version/s 10.1 [ 16100 ]
            greenman Ian Gilfillan added a comment -

            Documentation updated

            greenman Ian Gilfillan added a comment - Documentation updated
            greenman Ian Gilfillan made changes -
            Resolution Fixed [ 1 ]
            Status Open [ 1 ] Closed [ 6 ]
            hholzgra Hartmut Holzgraefe added a comment -

            Unfortunately the semanage/restorecon approach doesn't work as intended, it takes away permissions on the password list files from cracklib itself and so e.g. breaks PAM ...

            I'll update the KB page accordingly ...

            hholzgra Hartmut Holzgraefe added a comment - Unfortunately the semanage/restorecon approach doesn't work as intended, it takes away permissions on the password list files from cracklib itself and so e.g. breaks PAM ... I'll update the KB page accordingly ...
            GeoffMontee Geoff Montee (Inactive) made changes -
            GeoffMontee Geoff Montee (Inactive) added a comment -

            This can probably be fixed by adding an SELinux policy to the cracklib_password_check packages. See MDEV-18374 about that.

            GeoffMontee Geoff Montee (Inactive) added a comment - This can probably be fixed by adding an SELinux policy to the cracklib_password_check packages. See MDEV-18374 about that.
            GeoffMontee Geoff Montee (Inactive) made changes -
            serg Sergei Golubchik made changes -
            Workflow MariaDB v3 [ 75852 ] MariaDB v4 [ 150474 ]

            People

              greenman Ian Gilfillan
              hholzgra Hartmut Holzgraefe
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.