Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-13462

Can't start mysql with Galera and SELinux enabled

Details

    Description

      This is similar, but not the same as, MDEV-12102. The latter was fixed in 10.1 but the same appears again. The issue is that the mariadb.systemd script fails when Galera is enabled. Also, in the case SELinux has to be enabled to reproduce.

      The issue seems to be with the galera_recover script that fails when run from mariadb.service but runs fine from the commandline when SELinux is enabled, with SELinux disabled all runs fine. This also means that the galera_new_cluster script also does not work, as this restarts mariadb using systemd. Disabling SELinux will fix this. Also, all runs fine with Galera not configured, so SELinux has to be enabled and Galera configured for this issue to appear.

      Attachments

        Activity

          I can verify this by just putting wsrep_on=1 into my.cnf (no other galera configuration are really required for verification).

          journalctl -xe shows these when SELinux is enabled:

          Aug 10 14:34:10 systemd[1]: Unit mariadb.service entered failed state.
          Aug 10 14:34:10 systemd[1]: mariadb.service failed.
          Aug 10 14:34:10 setroubleshoot[22179]: SELinux is preventing /usr/sbin/mysqld from open access on the file /tmp/wsrep_recovery.v8iHyw. For complete SELinux messages. run sealert -l 8c7415a6-1153-4fab-ad95-2ee327791
          Aug 10 14:34:10 python[22179]: SELinux is preventing /usr/sbin/mysqld from open access on the file /tmp/wsrep_recovery.v8iHyw.
          

          The service is able to start properly when SELinux is disabled

          anikitin Andrii Nikitin (Inactive) added a comment - I can verify this by just putting wsrep_on=1 into my.cnf (no other galera configuration are really required for verification). journalctl -xe shows these when SELinux is enabled: Aug 10 14:34:10 systemd[1]: Unit mariadb.service entered failed state. Aug 10 14:34:10 systemd[1]: mariadb.service failed. Aug 10 14:34:10 setroubleshoot[22179]: SELinux is preventing /usr/sbin/mysqld from open access on the file /tmp/wsrep_recovery.v8iHyw. For complete SELinux messages. run sealert -l 8c7415a6-1153-4fab-ad95-2ee327791 Aug 10 14:34:10 python[22179]: SELinux is preventing /usr/sbin/mysqld from open access on the file /tmp/wsrep_recovery.v8iHyw. The service is able to start properly when SELinux is disabled

          Wasn't it fixed in MDEV-10767? In commit bb7a70c955 on 2017-09-21?
          After that commit mysqld does not need open access on the file /tmp/wsrep_recovery.v8iHyw.

          serg Sergei Golubchik added a comment - Wasn't it fixed in MDEV-10767 ? In commit bb7a70c955 on 2017-09-21? After that commit mysqld does not need open access on the file /tmp/wsrep_recovery.v8iHyw.

          This does look to be fixed by MDEV-10767. I did not file this bug, but ran across it when looking at a customer issue (but I did not see the original MDEV-10767). It seems fine to close this to me. Many thanks!

          ccalender Chris Calender (Inactive) added a comment - This does look to be fixed by MDEV-10767 . I did not file this bug, but ran across it when looking at a customer issue (but I did not see the original MDEV-10767 ). It seems fine to close this to me. Many thanks!
          seppo Seppo Jaakola added a comment -

          the fix in MDEV-10767 appears to skip exactly this problematic /tmp/wsrep_recovery.* access, so I assume this case should be closed

          seppo Seppo Jaakola added a comment - the fix in MDEV-10767 appears to skip exactly this problematic /tmp/wsrep_recovery.* access, so I assume this case should be closed

          People

            sachin.setiya.007 Sachin Setiya (Inactive)
            karlsson Anders Karlsson
            Votes:
            2 Vote for this issue
            Watchers:
            7 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.