[MDEV-10160] enabled cracklib plugin blocks all password changes with SELINUX=enforcing Created: 2016-05-31  Updated: 2019-01-25  Resolved: 2016-08-08

Status: Closed
Project: MariaDB Server
Component/s: Admin statements, Authentication and Privilege System, Documentation
Affects Version/s: 10.1.14, 10.1
Fix Version/s: N/A

Type: Bug Priority: Major
Reporter: Hartmut Holzgraefe Assignee: Ian Gilfillan
Resolution: Fixed Votes: 0
Labels: None
Environment:

linux with SELINUX=enforcing

Issue Links:
Relates
relates to MDEV-18374 SELinux breaks cracklib_password_chec... Closed

 Description   

When using default settings cracklib tries to read the password database from /usr/share/cracklib/. When using the standard SELINUX profile mysqdl doesn't have access to that directory though.

Workarounds:

  • add additional access rules: 

        semanage fcontext -a -t mysqld_etc_t  "/usr/share/cracklib(/.*)?"
    		 
        restorecon -Rv /usr/share/cracklib

  • or copy cracklib dictionary to mysqld datadir and set cracklib_password_check_dictionary accordingly

 Comments   
Comment by Elena Stepanova [ 2016-05-31 ]

I'm not sure how it should be fixed. By not reading the passwords?
Assigning to serg for consideration.

Comment by Ian Gilfillan [ 2016-08-08 ]

Documentation updated

Comment by Hartmut Holzgraefe [ 2016-08-08 ]

Unfortunately the semanage/restorecon approach doesn't work as intended, it takes away permissions on the password list files from cracklib itself and so e.g. breaks PAM ...

I'll update the KB page accordingly ...

Comment by Geoff Montee (Inactive) [ 2019-01-25 ]

This can probably be fixed by adding an SELinux policy to the cracklib_password_check packages. See MDEV-18374 about that.

Generated at Thu Feb 08 07:40:07 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.