[MDEV-30520] SELinux incorrectly labeled mariadbd Created: 2023-01-31  Updated: 2024-02-07

Status: Stalled
Project: MariaDB Server
Component/s: Packaging
Affects Version/s: 10.6.11
Fix Version/s: 10.5

Type: Bug Priority: Critical
Reporter: Frank Assignee: Daniel Black
Resolution: Unresolved Votes: 0
Labels: None
Environment:

Rocky9

Issue Links:
Relates
relates to MDEV-24941 SElinux incorrect label for server so... Open

 Description   

It looks like the rpm packaged version will have an SELinux problem on systems running RHEL-9 or one of it clones.
Using the MariaDB direct from the OS will work. Also the none LTS version from maria.org.

SElinux error:

type=AVC msg=audit(1675146674.414:430): avc:  denied  { connectto } for  pid=4435 comm="php-fpm" path="/var/lib/mysql/mysql.sock" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=unix_stream_socket permissive=0
 
type=SYSCALL msg=audit(1675146674.414:430): arch=c000003e syscall=42 success=no exit=-13 a0=9 a1=7ffddc679b90 a2=1b a3=5582de7da5b0 items=0 ppid=2851 pid=4435 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/remi/php82/root/usr/sbin/php-fpm" subj=system_u:system_r:httpd_t:s0 key=(null)ARCH=x86_64 SYSCALL=connect AUID="unset" UID="apache" GID="apache" EUID="apache" SUID="apache" FSUID="apache" EGID="apache" SGID="apache" FSGID="apache"
 
type=PROCTITLE msg=audit(1675146674.414:430): proctitle=7068702D66706D3A20706F6F6C2077696B6974657374312E6D64632D6265726C696E2E6E6574

I have found some hints for the problem:
https://unix.stackexchange.com/questions/718879/selinux-php-fpm-httpd-and-mariadb-socket-connection
https://almalinux.discourse.group/t/selinux-php-fpm-httpd-and-mariadb-socket-connection/1626

 Comments   
Comment by Daniel Black [ 2023-01-31 ]

It looks like the mariadb unix socket is missing a label.

Try:

# semanage fcontext -a -t mysqld_var_run_t /var/lib/mysql/mysql.sock
 
# restorecon -Rv /var/lib/mysql/mysql.sock

setsebool httpd_can_network_connect_db 1 might be be required as a coverall boolean from httpd -> (db sockets).

I agree we need to look closer at packaged selinux rules and the delta to the OS provided ones.

> Also the none LTS version from maria.org

Like https://mariadb.org/mariadb-10-11-is-lts/ - ETA 2 weeks.

Comment by Frank [ 2023-01-31 ]

I found the problem.
The process itself is started in the wrong context.
MariaDB 10.4:

ps axZ |grep mysql
 
system_u:system_r:mysqld_t:s0     1369 ?        Ssl   44:41 /usr/sbin/mysqld

MariaDB 10.6:

 ps axZ|grep maria
 
system_u:system_r:unconfined_service_t:s0 15682 ? Ssl   0:01 /usr/sbin/mariadbd

Comment by Daniel Black [ 2023-01-31 ]

Thank you. That sounds quite solvable.

Comment by Frank [ 2023-01-31 ]

As an dirty work around until the rpm package is fixed:

chcon -t mysqld_exec_t /usr/sbin/mariadbd

It will change:
ll -Z /usr/sbin/mariadbd
-rwxr-xr-x. 1 root root system_u:object_r:bin_t:s0 25120440 Nov 3 12:54 /usr/sbin/mariadbd
to:
ll -Z /usr/sbin/mariadbd
-rwxr-xr-x. 1 root root system_u:object_r:mysqld_exec_t:s0 25120440 Nov 3 12:54 /usr/sbin/mariadbd

Comment by Frank [ 2023-01-31 ]

Looking at the default file context list will show problem:
semanage fcontext -l|grep mysql:

/etc/my\.cnf                                       regular file       system_u:object_r:mysqld_etc_t:s0 
/etc/my\.cnf\.d(/.*)?                              all files          system_u:object_r:mysqld_etc_t:s0 
/etc/mysql(/.*)?                                   all files          system_u:object_r:mysqld_etc_t:s0 
/etc/rc\.d/init\.d/mysqld                          regular file       system_u:object_r:mysqld_initrc_exec_t:s0 
/etc/rc\.d/init\.d/mysqlmanager                    regular file       system_u:object_r:mysqlmanagerd_initrc_exec_t:s0 
/home/[^/]+/\.my\.cnf                              regular file       unconfined_u:object_r:mysqld_home_t:s0 
/root/\.my\.cnf                                    regular file       system_u:object_r:mysqld_home_t:s0 
/usr/bin/mariadb-upgrade                           regular file       system_u:object_r:mysqld_exec_t:s0 
/usr/bin/mariadbd-safe                             regular file       system_u:object_r:mysqld_safe_exec_t:s0 
/usr/bin/mariadbd-safe-helper                      regular file       system_u:object_r:mysqld_exec_t:s0 
/usr/bin/mysql_upgrade                             regular file       system_u:object_r:mysqld_exec_t:s0 
/usr/bin/mysqld_safe                               regular file       system_u:object_r:mysqld_safe_exec_t:s0 
/usr/bin/mysqld_safe_helper                        regular file       system_u:object_r:mysqld_exec_t:s0 
/usr/lib(64)?/nagios/plugins/check_mysql           regular file       system_u:object_r:nagios_services_plugin_exec_t:s0 
/usr/lib(64)?/nagios/plugins/check_mysql_query     regular file       system_u:object_r:nagios_services_plugin_exec_t:s0 
/usr/lib/systemd/system/mariadb.*                  regular file       system_u:object_r:mysqld_unit_file_t:s0 
/usr/lib/systemd/system/mysqld.*                   regular file       system_u:object_r:mysqld_unit_file_t:s0 
/usr/libexec/mariadbd                              regular file       system_u:object_r:mysqld_exec_t:s0 
/usr/libexec/mysqld                                regular file       system_u:object_r:mysqld_exec_t:s0 
/usr/libexec/mysqld_safe-scl-helper                regular file       system_u:object_r:mysqld_safe_exec_t:s0 
/usr/sbin/mysqld(-max|-debug)?                     regular file       system_u:object_r:mysqld_exec_t:s0 
/usr/sbin/mysqlmanager                             regular file       system_u:object_r:mysqlmanagerd_exec_t:s0 
/usr/sbin/ndbd                                     regular file       system_u:object_r:mysqld_exec_t:s0 
/usr/sbin/zabbix_proxy_mysql                       regular file       system_u:object_r:zabbix_exec_t:s0  
/usr/sbin/zabbix_server_mysql                      regular file       system_u:object_r:zabbix_exec_t:s0  
/usr/share/munin/plugins/mysql_.*                  regular file       system_u:object_r:services_munin_plugin_exec_t:s0 
/var/lib/mysql(-files|-keyring)?(/.*)?             all files          system_u:object_r:mysqld_db_t:s0 
/var/lib/mysql/mysql\.sock                         socket             system_u:object_r:mysqld_var_run_t:s0 
/var/log/mariadb(/.*)?                             all files          system_u:object_r:mysqld_log_t:s0 
/var/log/mariadb.log                               regular file       system_u:object_r:mysqld_log_t:s0 
/var/log/mysql(/.*)?                               all files          system_u:object_r:mysqld_log_t:s0 
/var/log/mysql.*                                   regular file       system_u:object_r:mysqld_log_t:s0 
/var/run/mariadb(/.*)?                             all files          system_u:object_r:mysqld_var_run_t:s0 
/var/run/mysql(/.*)?                               all files          system_u:object_r:mysqld_var_run_t:s0 
/var/run/mysqld(/.*)?                              all files          system_u:object_r:mysqld_var_run_t:s0 
/var/run/mysqld/mysqlmanager.*                     regular file       system_u:object_r:mysqlmanagerd_var_run_t:s0

semanage fcontext -l|grep mariadb

/usr/bin/mariadb-upgrade                           regular file       system_u:object_r:mysqld_exec_t:s0 
/usr/bin/mariadbd-safe                             regular file       system_u:object_r:mysqld_safe_exec_t:s0 
/usr/bin/mariadbd-safe-helper                      regular file       system_u:object_r:mysqld_exec_t:s0 
/usr/lib/systemd/system/mariadb.*                  regular file       system_u:object_r:mysqld_unit_file_t:s0 
/usr/libexec/mariadbd                              regular file       system_u:object_r:mysqld_exec_t:s0 
/var/log/mariadb(/.*)?                             all files          system_u:object_r:mysqld_log_t:s0 
/var/log/mariadb.log                               regular file       system_u:object_r:mysqld_log_t:s0 
/var/run/mariadb(/.*)?                             all files          system_u:object_r:mysqld_var_run_t:s0

For me the "magic" is this line:
/usr/sbin/mysqld(-max|-debug)? regular file system_u:object_r:mysqld_exec_t:s0
So the name for the binary must be fixed or an second default entry for
/usr/sbin/mariadbd(-max|-debug)? regular file system_u:object_r:mysqld_exec_t:s0
must be added.

Comment by Ivan [ 2023-07-24 ]

I confirm the issue on AlmaLinux 9.2 and MariaDB 10.11.

Comment by Oleksandr Byelkin [ 2023-07-26 ]

I do not see what review here

Comment by Oleksandr Byelkin [ 2023-07-26 ]

OK, there is pull request https://github.com/MariaDB/server/pull/2711

Comment by Glenn van Es [ 2023-10-06 ]

I was also facing this issue, got a permission denied error on our websites, when changing localhost to 127.0.0.1 in the config the websites worked initially, I still don't entirely understand why that does work. Plesk helped us out to fix the issue with the workaround here:
https://talk.plesk.com/threads/almalinux-9-mariadb-10-5-to-10-6-then-after-mariadb-10-6-to-10-11.371140/
Hope that it helps whoever stumbles on this bug and I hope it will be resolved in the next version.

Comment by Jamie Burchell [ 2023-10-24 ]

Ran in to this issue today when installing 10.11 from the MariaDB repo on Rocky Linux 9.

Also noticed each time the socket file was created, it did not maintain the correct label (system_u:object_r:mysqld_var_run_t:s0) until I ran restorecon on it.

There seems to be other issues with the packaging here as when uninstalling (dnf remove MariaDB MariaDB-server) it only removed 6 of the 18 packages it had installed, leaving behind:

Removed MariaDB-client-10.11.5-1.el9.x86_64 @@System
Removed MariaDB-common-10.11.5-1.el9.x86_64 @@System
Removed MariaDB-shared-10.11.5-1.el9.x86_64 @@System
Removed daxctl-libs-71.1-8.el9.x86_64 @@System
Removed libaio-0.3.111-13.el9.x86_64 @@System
Removed libpmem-1.12.1-1.el9.x86_64 @@System
Removed ndctl-libs-71.1-8.el9.x86_64 @@System
Removed perl-DBI-1.643-9.el9.x86_64 @@System
Removed perl-File-Copy-2.34-480.el9.noarch @@System
Removed perl-Math-BigInt-1:1.9998.18-460.el9.noarch @@System
Removed perl-Math-Complex-1.59-480.el9.noarch @@System
Removed perl-Sys-Hostname-1.23-480.el9.x86_64 @@System

Comment by Daniel Black [ 2023-10-24 ]

Did submit https://github.com/devexp-db/mysql-selinux/pull/5 to add to the upstream selinux package.

Comment by Daniel Black [ 2023-11-22 ]

Upstream policy merged into fc40.

Generated at Thu Feb 08 10:16:51 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.