Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-10404

Improved systemd service hardening causes SELinux problems

Details

    • Bug
    • Status: Closed (View Workflow)
    • Major
    • Resolution: Fixed
    • 10.1.16
    • 10.1.17
    • Scripts & Clients
    • None
    • CentOS 7.2
    • 10.1.17-1

    Description

      In MDEV-10298, NoNewPrivileges=true was added to the systemd service file. But when SELinux is enabled, this prevents mysqld from transitioning from init_t to mysqld_t, and that in turn prevents connecting from httpd_t. So after upgrading to 10.1.16, I see in ps auxZ:

      system_u:system_r:init_t:s0     mysql     4080 11.8  7.2 779200 124164 ?       Ssl  08:54   0:00 /usr/sbin/mysqld

      When I comment out the NoNewPrivileges=true, and restart, I see:

      system_u:system_r:mysqld_t:s0   mysql     4185 27.0  7.3 779200 126220 ?       Ssl  08:55   0:00 /usr/sbin/mysqld

      Attachments

        Issue Links

          duplicates

          Bug - A problem which impairs or prevents the functions of the product. MDEV-10405 mysql.sock gets created with different SELinux context

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed
          is caused by

          Bug - A problem which impairs or prevents the functions of the product. MDEV-10298 Improve systemd service hardening

          • Major - Major loss of function.
          • Closed
          is duplicated by

          Bug - A problem which impairs or prevents the functions of the product. MDEV-16718 Job for mariadb.service failed because the control process exited with error code.

          • Major - Major loss of function.
          • Closed
          relates to

          Bug - A problem which impairs or prevents the functions of the product. MDEV-10519 MariaDB fails to start after upgrade from 10.1.14 - 10.1.16 (InnoDB Encryption)

          • Major - Major loss of function.
          • Closed
          links to

          Web Link systemd bug - NoNewPrivileges && SELinuxContext incompatible

          Web Link systemd bug - NoNewPrivileges effects on Selinux context switching undocumented

          Activity

            Ascending order - Click to sort in descending order
            danblack Daniel Black added a comment - - edited

            https://bugzilla.redhat.com/show_bug.cgi?id=1293493 seems to be a related systemd bug. I can't find a systemd discussion about it in their mailing list or in the freedesktop bugzilla.

            danblack Daniel Black added a comment - - edited https://bugzilla.redhat.com/show_bug.cgi?id=1293493 seems to be a related systemd bug. I can't find a systemd discussion about it in their mailing list or in the freedesktop bugzilla.
            danblack Daniel Black added a comment - - edited

            https://www.freedesktop.org/software/systemd/man/systemd.exec.html#SELinuxContext=

            Suggest testing:

            SELinuxContext=system_u:system_r:mysqld_t:s0

            note: may have troubles - https://bugzilla.redhat.com/show_bug.cgi?id=1293493#c11

            danblack Daniel Black added a comment - - edited https://www.freedesktop.org/software/systemd/man/systemd.exec.html#SELinuxContext= Suggest testing: SELinuxContext=system_u:system_r:mysqld_t:s0 note: may have troubles - https://bugzilla.redhat.com/show_bug.cgi?id=1293493#c11
            danblack Daniel Black added a comment -

            As per the systemd bug report (link above) this apparently isn't their bug to fix.

            danblack Daniel Black added a comment - As per the systemd bug report (link above) this apparently isn't their bug to fix.
            svoj Sergey Vojtovich added a comment -

            serg, I disabled NoNewPrivileges. If you have an idea how to fix SELinux please do fix it, or just close this bug for now.

            svoj Sergey Vojtovich added a comment - serg , I disabled NoNewPrivileges. If you have an idea how to fix SELinux please do fix it, or just close this bug for now.
            danblack Daniel Black added a comment -

            I agree with svoj keep the NoNewPrivileges disabled until selinux contains the required transition rule or something radically simple happens in the combined selinux/systemd space.

            danblack Daniel Black added a comment - I agree with svoj keep the NoNewPrivileges disabled until selinux contains the required transition rule or something radically simple happens in the combined selinux/systemd space.
            danblack Daniel Black added a comment -

            From systemd bug report:

            4.14 kernel fixs to add NNP to have selinux transition rule as per detailed commit:

            https://github.com/torvalds/linux/commit/af63f4193f9fbbbac50fc766417d74735afd87ef
            Wonder if the RHEL/Centos7 has backported this?

            Fedora fc26,27 are 4.15+ (https://apps.fedoraproject.org/packages/kernel)

            RHEL/Centos6 isn't systemd.

            I don't think the other distos mariadb builds packages for enable selinux.

            If all distro kernel capable we could give mariadb the transition to its domain via a macro like on line 599 and enable NNP again:
            and https://src.fedoraproject.org/rpms/selinux-policy/c/107eb82b3e182d72c7f2c7f8f03bda6dd790f441?branch=master#L599

            danblack Daniel Black added a comment - From systemd bug report: 4.14 kernel fixs to add NNP to have selinux transition rule as per detailed commit: https://github.com/torvalds/linux/commit/af63f4193f9fbbbac50fc766417d74735afd87ef Wonder if the RHEL/Centos7 has backported this? Fedora fc26,27 are 4.15+ ( https://apps.fedoraproject.org/packages/kernel ) RHEL/Centos6 isn't systemd. I don't think the other distos mariadb builds packages for enable selinux. If all distro kernel capable we could give mariadb the transition to its domain via a macro like on line 599 and enable NNP again: and https://src.fedoraproject.org/rpms/selinux-policy/c/107eb82b3e182d72c7f2c7f8f03bda6dd790f441?branch=master#L599

            People

              svoj Sergey Vojtovich
              hvdijk Harald van Dijk
              Votes:
              1 Vote for this issue
              Watchers:
              6 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.