Paul Howarth írta:
Zoltan Boszormenyi wrote:
> Paul Howarth írta:
>> Zoltan Boszormenyi wrote:
>>> What puzzled me is starting postgresql failed at boot
>>> but not the manual "service postgresql start" after bootup.
>>> (Maybe different contexts are applied to the logged-in root
>>> and the init program?)
>>
>> Running the initscript should be exactly the same as the boot
>> process. Starting the service manually (without the initscript)
>> would be different though, as no domain transition would happen.
>
> Both
>
> service postgresql start
>
> and
>
> su - postgres
> PGDATA=/home1/pgsql pg_ctl start
>
> started successfully if I logged in as root or under "su -" from my
> mortal uid.
> (The postgresql initscript uses "runuser" instead of "su" IIRC.)
>
>> Do the AVCs logged during the boot process show the process running
>> as postgresql_t? If you do a "ps uaxZ", is it running as
>> postgresql_t or unconfined_t?
>
> It's running under postgresql_t.
Does it run under postgresql_t if you start it using pg_ctl?
$ su -
# service postgresql stop
# su - postgres
$ PGDATA=/var/lib/pgsql/data pg_ctl start
postmaster starting
$ ps axuZ | grep post | grep -v bash | grep -v grep | grep -v "su -" |
grep -v "ps "
user_u:system_r:unconfined_t postgres 5171 0.5 0.3 92280 3808
pts/0 S 18:32 0:00 /usr/bin/postmaster
user_u:system_r:unconfined_t postgres 5174 0.0 0.1 81324 1056
pts/0 S 18:32 0:00 postgres: logger process
user_u:system_r:unconfined_t postgres 5176 0.0 0.1 92264 1152
pts/0 S 18:32 0:00 postgres: writer process
user_u:system_r:unconfined_t postgres 5177 0.0 0.1 82460 992
pts/0 S 18:32 0:00 postgres: stats buffer process
user_u:system_r:unconfined_t postgres 5178 0.0 0.1 81456 1196
pts/0 S 18:32 0:00 postgres: stats collector process
$ pg_ctl stop
$ logout
# service postgresql start
A(z) postgresql szolgáltatás elindítása: [ OK ]
[root@host-81-17-177-202 ~]# ps axuZ | grep post | grep -v bash | grep
-v grep | grep -v "su -" | grep -v "ps "
user_u:system_r:unconfined_t postgres 5307 9.5 0.3 92284 3808
? S 18:36 0:00 /usr/bin/postmaster -p 5432 -D
/var/lib/pgsql/data
user_u:system_r:unconfined_t postgres 5309 0.0 0.1 81328 1056
? S 18:36 0:00 postgres: logger process
user_u:system_r:unconfined_t postgres 5311 0.0 0.1 92268 1112
? S 18:36 0:00 postgres: writer process
user_u:system_r:unconfined_t postgres 5312 0.0 0.0 82464 920
? S 18:36 0:00 postgres: stats buffer process
user_u:system_r:unconfined_t postgres 5313 0.0 0.1 81460 1196
? S 18:36 0:00 postgres: stats collector process
Both times it's running under unconfined_t, so it doesn't matter
whether it's running under "su - postgres" or "runuser -
postgres".
It seems what matters is that it's started from a logged in user:
# ps auxZ | grep bash
user_u:system_r:unconfined_t zozo 4979 0.0 0.1 59836 1708
pts/0 Ss 18:28 0:00 bash
user_u:system_r:unconfined_t root 5002 0.0 0.1 59840 1688
pts/0 S 18:28 0:00 -bash
I logged in through GDM if that's interesting, running "su - " in a
gnome-terminal.
>> I've just responded to another poster with almost exactly
the same
>> issue. I think this might be worth a wiki page.
>
> It would be a good idea.
I'll do that when the other poster's last issue (default file
contexts) is resolved.
Paul.
Best regards,
Zoltán Böszörményi