[DOCS-11073] Add more details about working around SELinux constraints Created: 30/Nov/17  Updated: 30/Oct/23  Resolved: 05/Jan/19

Status: Closed
Project: Documentation
Component/s: manual, Ops Manager
Affects Version/s: None
Fix Version/s: Server_Docs_20231030

Type: Improvement Priority: Major - P3
Reporter: Nic Cottrell Assignee: Kay Kim (Inactive)
Resolution: Fixed Votes: 1
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified
Environment:

SELinux


Issue Links:
Cloners
is cloned by DOCS-12099 [OM] Add more details about working a... Closed
Gantt Dependency
has to be done before DOCS-12099 [OM] Add more details about working a... Closed
Related
related to SERVER-38704 RPM Binary -- SELinux Module Denials Closed
Participants:
Days since reply: 5 years, 5 weeks, 4 days ago
Epic Link: DOCSP-1769
Story Points: 0.2

 Description   

We just had just problem while setting up Ops Manager at a client whose policy is to have SELinux enabled on all production environment, so disabling is not an option.

We needed to have dbPath set to /db and so SELinux was blocking even though permissions were correct.

The docs at https://docs.mongodb.com/manual/tutorial/install-mongodb-enterprise-on-red-hat/#install-enterprise-rhel-configure-selinux don't reflect the required solution:

sudo chcon -Rv --type=mongod_var_lib_t /<dbPath>

Maybe it could be added and explained under the section on semanage port

Related to:
https://jira.mongodb.org/browse/DOCS-4170



 Comments   
Comment by Kay Kim (Inactive) [ 05/Jan/19 ]

Updates about SELinux & non-default directories (done)

Am planning on reorging/cleaning up the install tutorials through another ticket.

Comment by Githook User [ 05/Jan/19 ]

Author:

{'email': 'kay.kim@mongodb.com', 'name': 'Kay Kim'}

Message: DOCS-11073: additional info about log path vs log dir
Branch: master
https://github.com/mongodb/docs/commit/d5f8dee6d7eb247de26a6a37c25376407d7c80a8

Comment by Githook User [ 05/Jan/19 ]

Author:

{'email': 'kay.kim@mongodb.com', 'name': 'Kay Kim'}

Message: DOCS-11073: additional info about log path vs log dir
Branch: v4.0
https://github.com/mongodb/docs/commit/edf51aab390af1b2515fe0a929928f0898394ac5

Comment by Githook User [ 05/Jan/19 ]

Author:

{'email': 'kay.kim@mongodb.com', 'name': 'Kay Kim'}

Message: DOCS-11073: SELINUX part2
Branch: v3.6
https://github.com/mongodb/docs/commit/69bc65822081738f8e3b1d6d7e117743347d48f8

Comment by Githook User [ 05/Jan/19 ]

Author:

{'email': 'kay.kim@mongodb.com', 'name': 'Kay Kim'}

Message: DOCS-11073: SELINUX
Branch: v3.4
https://github.com/mongodb/docs/commit/e3460009f1b75a024819ce2aca95e1a8e90032ad

Comment by Githook User [ 05/Jan/19 ]

Author:

{'email': 'kay.kim@mongodb.com', 'name': 'Kay Kim'}

Message: DOCS-11073: SELINUX
Branch: v3.2
https://github.com/mongodb/docs/commit/e38719972271e3a2c9db220769cb867286d29c99

Comment by Githook User [ 05/Jan/19 ]

Author:

{'email': 'kay.kim@mongodb.com', 'name': 'Kay Kim'}

Message: DOCS-11073: SELINUX
Branch: v3.6
https://github.com/mongodb/docs/commit/8a8c14c6af245e74879ff2e8daa5e016b64a6a2b

Comment by Githook User [ 22/Dec/18 ]

Author:

{'email': 'kay.kim@mongodb.com', 'name': 'Kay Kim'}

Message: DOCS-11073: add tip about sudo
Branch: v4.0
https://github.com/mongodb/docs/commit/280c26929dfd8f73275f32c9005bf95022af6715

Comment by Githook User [ 22/Dec/18 ]

Author:

{'email': 'kay.kim@mongodb.com', 'name': 'Kay Kim'}

Message: DOCS-11073: generalize types
Branch: v4.0
https://github.com/mongodb/docs/commit/b0b2de6f37941bc8c78798b3681bf97c6559607e

Comment by Githook User [ 22/Dec/18 ]

Author:

{'email': 'kay.kim@mongodb.com', 'name': 'Kay Kim'}

Message: DOCS-11073: generalize types
Branch: master
https://github.com/mongodb/docs/commit/c0b29943beaecaf05a764d037d60a483b7776504

Comment by Githook User [ 21/Dec/18 ]

Author:

{'email': 'kay.kim@mongodb.com', 'name': 'Kay Kim'}

Message: DOCS-11073: SELINUX
Branch: v4.0
https://github.com/mongodb/docs/commit/93e6dc892a36b1367b85cef8013a86f31f16e5ac

Comment by Githook User [ 21/Dec/18 ]

Author:

{'email': 'kay.kim@mongodb.com', 'name': 'Kay Kim'}

Message: DOCS-11073: SELINUX
Branch: master
https://github.com/mongodb/docs/commit/0f14b60c56cfd66eda021a39050e15622e895b67

Comment by Eric Sommer [ 20/Dec/18 ]

Also mongod_var_run_t for the pid directory: /usr/bin/chcon -R -u system_u -t mongod_var_run_t /data/app/pid

Comment by Matt Lord (Inactive) [ 13/Dec/18 ]

ravind.kumar, we should simply note that the same example steps used for the dbpath would be needed for any non-default directories that mongod uses (for logs, etc.).

chcon/restorecon/etc. don't recurse by default, but they have recursive flags (e.g. -R). 

Comment by Ravind Kumar (Inactive) [ 12/Dec/18 ]

matt.lord are there any other file / folder permissions we should cover here while we're at it? e.g. log path directories? does the semanage command auto-recurse, eg. if a user has directoryPerDB set.

Comment by Matt Lord (Inactive) [ 20/Sep/18 ]

I'm happy to help with this whenever you're ready to pick it back up. I agree that getting this information into the docs would be great. Changing the dbpath is very common. 

Just FYI, chcon makes temporary changes that would go away after a reboot. We'll want to use semanage to make permanent changes and restorecon to apply the new+correct extended file attributes on the given files.

For example:

sudo semanage fcontext -a -t mongod_var_lib_t /mongo/data && restorecon -R -v /mongo/data

For some related context, here is how you can see the policies being applied to mongodb:

semanage port -l | grep mongo && semanage fcontext -l | grep mongo 

Generated at Thu Feb 08 08:01:59 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.