database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-08-09 22:24:09 +03:00
Code Activity

Update SELinux policy to allow UDP for multicast repl in galera.

Browse Source
This commit is contained in:
Nirbhay Choubey
2015-06-23 13:48:39 -04:00
parent 327409443f
commit 71d1f35847
2 changed files with 30 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
policy/selinux/README
View File

@@ -1,18 +1,20 @@
Note: The included SELinux policy files can be used for MariaDB Galera cluster. Note: The included SELinux policy files can be used for MariaDB Galera cluster.
However, since these policies had been tested for a limited set of scenarios, However, since these policies had been tested for a limited set of scenarios,
it is highly recommended to run SELinux in "permissive" mode even with these it is highly recommended that you run mysqld in "permissive" mode even with
policies installed and report any denials on mariadb.org/jira. these policies installed and report any denials on mariadb.org/jira.
How to generate and load the policy module of MariaDB Galera cluster ? How to generate and load the policy module of MariaDB Galera cluster ?
* Generate the SELinux policy module.
# cd <source>/policy/selinux/
# make -f /usr/share/selinux/devel/Makefile mariadb-server.pp
* Generate the SELinux policy module. * Load the generated policy module.
# cd <source>/policy/selinux/ # semodule -i /path/to/mariadb-server.pp
# make -f /usr/share/selinux/devel/Makefile mariadb-server.pp
* Load the generated policy module. * Lastly, run the following command to allow tcp/4568 and udp/4567.
# semodule -i /path/to/mariadb-server.pp # semanage port -a -t mysqld_port_t -p tcp 4568
# semanage port -a -t mysqld_port_t -p udp 4567
* Lastly, run the following command to allow 4568.
# semanage port -a -t mysqld_port_t -p tcp 4568
How to run mysqld in permissve mode ?
# semanage permissive -a mysqld_t

28
policy/selinux/mariadb-server.te
View File

@@ -4,25 +4,25 @@
module mariadb-server 1.0; module mariadb-server 1.0;
require { require {
type user_tmp_t; type user_tmp_t;
type kerberos_port_t; #type kerberos_master_port_t;
type mysqld_safe_t; type mysqld_safe_t;
type tmp_t; type tmp_t;
type tmpfs_t; type tmpfs_t;
type hostname_exec_t; type hostname_exec_t;
type ifconfig_exec_t; type ifconfig_exec_t;
type sysctl_net_t; type sysctl_net_t;
type proc_net_t; type proc_net_t;
type port_t; type port_t;
type mysqld_t; type mysqld_t;
type var_lib_t; type var_lib_t;
type rsync_exec_t; type rsync_exec_t;
type bin_t; type bin_t;
type shell_exec_t; type shell_exec_t;
type anon_inodefs_t; type anon_inodefs_t;
type fixed_disk_device_t; type fixed_disk_device_t;
class lnk_file read; class lnk_file read;
class process { getattr signull }; class process { getattr signull };
class unix_stream_socket connectto; class unix_stream_socket connectto;
class capability { sys_resource sys_nice }; class capability { sys_resource sys_nice };
class tcp_socket { name_bind name_connect }; class tcp_socket { name_bind name_connect };
@@ -32,7 +32,10 @@ require {
class dir { write search getattr add_name read remove_name open }; class dir { write search getattr add_name read remove_name open };
# MariaDB additions # MariaDB additions
type kerberos_port_t;
type tram_port_t; type tram_port_t;
type mysqld_port_t;
class udp_socket name_bind;
class process setpgid; class process setpgid;
class netlink_tcpdiag_socket { create nlmsg_read }; class netlink_tcpdiag_socket { create nlmsg_read };
} }
@@ -56,8 +59,8 @@ allow mysqld_t tmpfs_t:file { write getattr read create unlink open };
allow mysqld_t fixed_disk_device_t:blk_file { read write open }; allow mysqld_t fixed_disk_device_t:blk_file { read write open };
allow mysqld_t ifconfig_exec_t:file { read execute open execute_no_trans getattr }; allow mysqld_t ifconfig_exec_t:file { read execute open execute_no_trans getattr };
#This rule allows connecting on 4444 #This rule allows connecting on 4444/4567/4568
allow mysqld_t kerberos_port_t:tcp_socket { name_bind name_connect }; #allow mysqld_t kerberos_master_port_t:tcp_socket { name_bind name_connect };
allow mysqld_t mysqld_safe_t:dir { getattr search }; allow mysqld_t mysqld_safe_t:dir { getattr search };
allow mysqld_t mysqld_safe_t:file { read open }; allow mysqld_t mysqld_safe_t:file { read open };
@@ -82,8 +85,13 @@ allow mysqld_t bin_t:file { getattr read execute open execute_no_trans ioctl };
# MariaDB additions # MariaDB additions
allow mysqld_t self:process setpgid; allow mysqld_t self:process setpgid;
# This rule allows port 4567 # This rule allows port tcp/4444
allow mysqld_t kerberos_port_t:tcp_socket { name_bind name_connect };
# This rule allows port tcp/4567 (tram_port_t may not be available on
# older versions)
allow mysqld_t tram_port_t:tcp_socket name_bind; allow mysqld_t tram_port_t:tcp_socket name_bind;
# This rule allows port udp/4567 (see README)
allow mysqld_t mysqld_port_t:udp_socket name_bind;
# Rules related to XtraBackup # Rules related to XtraBackup
allow mysqld_t self:netlink_tcpdiag_socket { create nlmsg_read }; allow mysqld_t self:netlink_tcpdiag_socket { create nlmsg_read };