On a clean installation built from Fedora-Live-Workstation-x86_64-21_Beta-4.iso, I installed mongodb-server but it failed to start due to selinux: "SELinux is preventing mongod from name_bind access on the tcp_socket port 27017."
Following the selinux instructions from the journal resolves this: # grep mongod /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp
Should I bugzilla this, and if so, is it against mongodb or selinux-policy?
NOTICE & DISCLAIMER This email including attachments (this "Document") is confidential and may contain legally privileged information. If you have received this Document in error please notify the sender immediately and delete this Document from your system without using, copying, disclosing or disseminating it or placing any reliance upon its contents. We cannot accept liability for any breaches of confidence arising through use of this Document.
The information contained in this Document is provided solely for information purposes on an "as is" basis without warranty of any kind, either express or implied, including without limitation any implied warranty of satisfactory or merchantable quality, fitness for a particular purpose or freedom from error or infringement. The user relies on the information contained herein, and its accuracy or otherwise, entirely at their own risk.
Any opinions expressed in this Document are those of the author and do not necessarily reflect the opinions of Telsis. We will not accept responsibility for any commitments made by our employees, agents or representatives outside the scope of our business.
On 11/19/2014 09:16 AM, Paul Knox-Kennedy wrote:
On a clean installation built from Fedora-Live-Workstation-x86_64-21_Beta-4.iso, I installed mongodb-server but it failed to start due to selinux: "SELinux is preventing mongod from name_bind access on the tcp_socket port 27017."
Following the selinux instructions from the journal resolves this: # grep mongod /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp
Should I bugzilla this, and if so, is it against mongodb or selinux-policy?
Is this a standard port the mongodb should be listening on?
The better solution would have been to label the port as a mysql_port_t.
semanage port -a -t mysql_port_t -t tcp 27017
NOTICE & DISCLAIMER This email including attachments (this "Document") is confidential and may contain legally privileged information. If you have received this Document in error please notify the sender immediately and delete this Document from your system without using, copying, disclosing or disseminating it or placing any reliance upon its contents. We cannot accept liability for any breaches of confidence arising through use of this Document.
The information contained in this Document is provided solely for information purposes on an "as is" basis without warranty of any kind, either express or implied, including without limitation any implied warranty of satisfactory or merchantable quality, fitness for a particular purpose or freedom from error or infringement. The user relies on the information contained herein, and its accuracy or otherwise, entirely at their own risk.
Any opinions expressed in this Document are those of the author and do not necessarily reflect the opinions of Telsis. We will not accept responsibility for any commitments made by our employees, agents or representatives outside the scope of our business.
On Wed, Nov 19, 2014 at 6:19 PM, Daniel J Walsh dwalsh@redhat.com wrote:
On 11/19/2014 09:16 AM, Paul Knox-Kennedy wrote:
On a clean installation built from Fedora-Live-Workstation-x86_64-21_Beta-4.iso, I installed mongodb-server but it failed to start due to selinux: "SELinux is preventing mongod from name_bind access on the tcp_socket port 27017."
Following the selinux instructions from the journal resolves this: # grep mongod /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp
Should I bugzilla this, and if so, is it against mongodb or selinux-policy?
Is this a standard port the mongodb should be listening on?
http://docs.mongodb.org/manual/reference/default-mongodb-port/
Seems like the answer is yes.
On 11/19/2014 12:38 PM, drago01 wrote:
On Wed, Nov 19, 2014 at 6:19 PM, Daniel J Walsh dwalsh@redhat.com wrote:
On 11/19/2014 09:16 AM, Paul Knox-Kennedy wrote:
On a clean installation built from Fedora-Live-Workstation-x86_64-21_Beta-4.iso, I installed mongodb-server but it failed to start due to selinux: "SELinux is preventing mongod from name_bind access on the tcp_socket port 27017."
Following the selinux instructions from the journal resolves this: # grep mongod /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp
Should I bugzilla this, and if so, is it against mongodb or selinux-policy?
Is this a standard port the mongodb should be listening on?
http://docs.mongodb.org/manual/reference/default-mongodb-port/
Seems like the answer is yes.
Well I guess this is why you shouldn't fly blind.
Could you actually show me the actual AVC message.
It should be in the bottom of the alert.
Looks like it already is labeled mongod_port_t.
sepolicy network -p 27017 27017: tcp unreserved_port_t 1024-32767 27017: udp unreserved_port_t 1024-32767 27017: tcp mongod_port_t 27017-27019
Looks like I fixed a bug in git back in october
Author: Dan Walsh dwalsh@redhat.com Date: Mon Oct 27 19:18:21 2014 -0400
Allow mongodb to bind to the mongo port and mongos to run as mongod_t
Looks like this has made it into F21 policy and Rawhide, but not in F20.
/selinux-policy-3.13.1-98.fc21
Lukas could you back port this into RHEL7 and F20 policy.
From: test-bounces@lists.fedoraproject.org [mailto:test-bounces@lists.fedoraproject.org] On Behalf Of Daniel J Walsh Sent: 19 November 2014 19:45 To: For testing and quality assurance of Fedora releases; Lukas Vrabec Subject: Re: Mongodb-server fails to start with selinux enforcing
...
Looks like this has made it into F21 policy and Rawhide, but not in F20.
/selinux-policy-3.13.1-98.fc21
The current version in F21 updates and updates-testing seems to be selinux-policy-3.13.1-92.fc21, which doesn't have this fix [0] (which I only found after my original post). I guess this will come through once the freeze is over.
[0] https://bugzilla.redhat.com/show_bug.cgi?id=1162235
NOTICE & DISCLAIMER This email including attachments (this "Document") is confidential and may contain legally privileged information. If you have received this Document in error please notify the sender immediately and delete this Document from your system without using, copying, disclosing or disseminating it or placing any reliance upon its contents. We cannot accept liability for any breaches of confidence arising through use of this Document.
The information contained in this Document is provided solely for information purposes on an "as is" basis without warranty of any kind, either express or implied, including without limitation any implied warranty of satisfactory or merchantable quality, fitness for a particular purpose or freedom from error or infringement. The user relies on the information contained herein, and its accuracy or otherwise, entirely at their own risk.
Any opinions expressed in this Document are those of the author and do not necessarily reflect the opinions of Telsis. We will not accept responsibility for any commitments made by our employees, agents or representatives outside the scope of our business.