-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi Group,
I am seeing the errors (warning since I am on permissive mode) bellow
for mysql_upgrade after I enabled selinux.
Linux lrfurtado 2.6.26-2-xen-686 #1 SMP Thu Nov 25 02:32:31 UTC 2010
i686 GNU/Linux
cat /etc/debian_version
5.0.7
SELinux status: enabled
SELinuxfs mount: /selinux
Current mode: permissive
Mode from config file: permissive
Policy version: 23
Policy from config file: default
[ 31.271298] type=1400 audit(1294223212.646:7): avc: denied {
search } for pid=1372 comm="mysql_upgrade" name="bin" dev=xvda
ino=231661 scontext=system_u:system_r:mysqld_t:s0
tcontext=system_u:object_r:bin_t:s0 tclass=dir
[ 31.285387] type=1400 audit(1294223212.662:8): avc: denied { read
} for pid=1377 comm="mysql_upgrade" name="sh" dev=xvda ino=163914
scontext=system_u:system_r:mysqld_t:s0
tcontext=system_u:object_r:bin_t:s0 tclass=lnk_file
[ 31.285413] type=1400 audit(1294223212.662:9): avc: denied {
execute } for pid=1377 comm="mysql_upgrade" name="bash" dev=xvda
ino=163866 scontext=system_u:system_r:mysqld_t:s0
tcontext=system_u:object_r:shell_exec_t:s0 tclass=file
[ 31.285423] type=1400 audit(1294223212.662:10): avc: denied {
read } for pid=1377 comm="mysql_upgrade" name="bash" dev=xvda
ino=163866 scontext=system_u:system_r:mysqld_t:s0
tcontext=system_u:object_r:shell_exec_t:s0 tclass=file
[ 31.285459] type=1400 audit(1294223212.662:11): avc: denied {
execute_no_trans } for pid=1377 comm="mysql_upgrade"
path="/bin/bash"
dev=xvda ino=163866 scontext=system_u:system_r:mysqld_t:s0
tcontext=system_u:object_r:shell_exec_t:s0 tclass=file
[ 31.286542] type=1400 audit(1294223212.662:12): avc: denied {
getattr } for pid=1377 comm="sh" path="/bin/bash" dev=xvda
ino=163866
scontext=system_u:system_r:mysqld_t:s0
tcontext=system_u:object_r:shell_exec_t:s0 tclass=file
[ 31.287663] type=1400 audit(1294223212.662:13): avc: denied {
execute } for pid=1378 comm="sh" name="mysql" dev=xvda ino=231409
scontext=system_u:system_r:mysqld_t:s0
tcontext=system_u:object_r:bin_t:s0 tclass=file
[ 31.287678] type=1400 audit(1294223212.662:14): avc: denied {
read } for pid=1378 comm="sh" name="mysql" dev=xvda ino=231409
scontext=system_u:system_r:mysqld_t:s0
tcontext=system_u:object_r:bin_t:s0 tclass=file
when I run audit2allow I get the following:
#============= mysqld_t ==============
allow mysqld_t bin_t:dir search;
allow mysqld_t bin_t:file { read execute };
allow mysqld_t bin_t:lnk_file read;
allow mysqld_t shell_exec_t:file { read execute getattr
execute_no_trans };
I have also attached the output of:
sesearch --all | grep mysql > /tmp/mysql.policy
What's the proper fix here? I dont want to give the mysqld_t permission
to execute arbitrary scripts. The only solution I have right now is to
relabel mysql_upgrade so it runs as unconfined, and that's not much of
a solution.
Best Regards.
Luciano
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.14 (Darwin)
Comment: Using GnuPG with Mozilla -
http://enigmail.mozdev.org/
iQEcBAEBAgAGBQJNMF2mAAoJENgwSj9ZOOwrzbMH/2KBIxOUf68Z/7L1RKAN6pH8
kIIGmcTZRODa5PLTpEIMNPPHij3q2Pmx+nmQk4A0tbWKnmxZORLuEAodwOgZjdg5
pEXqc5SrISid4z5x2hU/x9sXkNaXXUZMXjz+TtdoGQvlAkiwlXZh2YZlcmQAQ2ax
tTrk/sc7KHoHmoDADubsDhbSohj3lqY7hvwTtlLlYQnLnEmwHBPKvr3kQOMS3RDT
4V4Rv5FkrzBRjOJo6FkzwI/UOdR+fIqGkts0L47/R/nSd8cv60IvncpVMqKTaTfY
7f/FfoYGT1w2iKaPx2xingFA8SWXyFQ/8GPKULSEZ3sdSjx+O06UKD6jHet3+oo=
=3Fq0
-----END PGP SIGNATURE-----