Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-63808

MongoDB and SELinux issues on CentOS 7

    • Type: Icon: Bug Bug
    • Resolution: Duplicate
    • Priority: Icon: Major - P3 Major - P3
    • None
    • Affects Version/s: None
    • Component/s: None
    • Labels:
    • Environment:
      MongoDB 5.0 and CentOS 7

      Problem Statement/Rationale

      I'm running MongoDB 5.0 on a Centos 7 virtual machine. SELinux is enabled and currently set to enforcing. SELinux is preventing Mongo from accessing multiple files and directories. As a result, /var/log/ is filling quite fast with messages. Attached, you can see my custom .te policy I put in place and compiled. This took care of most of the issues, so the fill up has been brought to a crawl, thankfully. But, as per the other screenshot, you can see that SELinux is still preventing Mongo on a couple of things, specifically /proc/<pid>/net/snmp and /proc/<pid>/net/netstat.

      Steps to Reproduce

      Establish a server with the same OS and version of Mongo with SELinux enabled. You should be able to see the same errors being produced in /var/log/messages

      Expected Results

      I would like to not have SELinux be blocking these things for Mongo any longer. I don't want /var/log/messages filling up with these types of alerts any longer.

      Actual Results

      /var/log/messages is filling up with SELinux alerts that are telling me that SELinux is preventing ftdc from open access on the specified files above.

      Additional Notes

      I'm thinking that if we added the getattr and open properties to the proc_net_t line in my .te policy file (screenshot attached), this would resolve it. But, we do not want Mongo to be able to those things, it is too permissive.

        1. image-2022-02-17-10-17-07-864.png
          51 kB
        2. image-2022-02-17-10-17-30-340.png
          51 kB
        3. image-2022-02-17-10-18-15-561.png
          207 kB
        4. image-2022-02-23-12-49-56-960.png
          116 kB

            chris.kelly@mongodb.com Chris Kelly
            cbator@powertrain.com Chris Bator
            0 Vote for this issue
            5 Start watching this issue