Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-10160

enabled cracklib plugin blocks all password changes with SELINUX=enforcing

Details

    Description

      When using default settings cracklib tries to read the password database from /usr/share/cracklib/. When using the standard SELINUX profile mysqdl doesn't have access to that directory though.

      Workarounds:

      • add additional access rules: 

            semanage fcontext -a -t mysqld_etc_t  "/usr/share/cracklib(/.*)?"
        		 
            restorecon -Rv /usr/share/cracklib

      • or copy cracklib dictionary to mysqld datadir and set cracklib_password_check_dictionary accordingly

      Attachments

        Issue Links

          relates to

          Bug - A problem which impairs or prevents the functions of the product. MDEV-18374 SELinux breaks cracklib_password_check plugin

          • Major - Major loss of function.
          • Closed

          Activity

            Ascending order - Click to sort in descending order
            hholzgra Hartmut Holzgraefe created issue -
            serg Sergei Golubchik made changes -
            Field Original Value New Value
            Component/s Documentation [ 10903 ]
            serg Sergei Golubchik made changes -
            Fix Version/s N/A [ 14700 ]
            serg Sergei Golubchik made changes -
            Assignee Ian Gilfillan [ greenman ]
            elenst Elena Stepanova made changes -
            Component/s Documentation [ 10903 ]
            Fix Version/s 10.1 [ 16100 ]
            Fix Version/s N/A [ 14700 ]
            Affects Version/s 10.1 [ 16100 ]
            Assignee Ian Gilfillan [ greenman ] Sergei Golubchik [ serg ]
            serg Sergei Golubchik made changes -
            Description When using default settings cracklib tries to read the password database from /usr/share/cracklib/. When using the standard SELINUX profile mysqdl doesn't have access to that directory though.

            Workarounds:

            * add additional access rules:

                semanage fcontext -a -t mysqld_etc_t "/usr/share/cracklib(/.*)?"
                restorecon -Rv /usr/share/cracklib

            * or copy cracklib dictionary to mysqld datadir and set cracklib_password_check_dictionary accordingly             		When using default settings cracklib tries to read the password database from /usr/share/cracklib/. When using the standard SELINUX profile mysqdl doesn't have access to that directory though.

            Workarounds:

            * add additional access rules:
            {code:bash}
                semanage fcontext -a -t mysqld_etc_t "/usr/share/cracklib(/.*)?"
                restorecon -Rv /usr/share/cracklib
            {code}
            * or copy cracklib dictionary to mysqld datadir and set cracklib_password_check_dictionary accordingly
            serg Sergei Golubchik made changes -
            Assignee Sergei Golubchik [ serg ] Ian Gilfillan [ greenman ]
            serg Sergei Golubchik made changes -
            Component/s Documentation [ 10903 ]
            serg Sergei Golubchik made changes -
            Fix Version/s N/A [ 14700 ]
            Fix Version/s 10.1 [ 16100 ]
            greenman Ian Gilfillan made changes -
            Resolution Fixed [ 1 ]
            Status Open [ 1 ] Closed [ 6 ]
            GeoffMontee Geoff Montee (Inactive) made changes -
            GeoffMontee Geoff Montee (Inactive) made changes -
            serg Sergei Golubchik made changes -
            Workflow MariaDB v3 [ 75852 ] MariaDB v4 [ 150474 ]

            People

              greenman Ian Gilfillan
              hholzgra Hartmut Holzgraefe
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.