ClusterLabs / ClusterLabs/resource-agents
SELinux semodule(s) for `ocf:heartbeat:galera`
- Dominant language
- Shell
- Stars
- 519
- Forks
- 608
- Avg merge
- 6d 1h
- Merged PRs (30d)
- 7
Description
Hi.
As groovy as ClusterLabs are many will agree you guys often neglect SELinux.
May I suggest you include/supply module(s) with/for GALERA agent - many will be grateful! & nobody can tell better than the authors/developers what is really needed/critical for SELinux - as opposed to us users compiling custom module.
On CentOS 8 setting resource as:
```
-> $ pcs resource create mariadb ocf:heartbeat:galera cluster_host_map="c8kubernode1:10.0.1.1;c8kubernode2:10.0.1.2;c8kubernode3:10.0.1.3" wsrep_cluster_address="gcomm://10.0.1.1,10.0.1.2,10.0.1.3" log=/var/log/mariadb/mariadb.log user=mysql group=mysql check_user="pacemaker" check_passwd="#989" additional_parameters="--basedir=/usr" op monitor OCF_CHECK_LEVEL="0" timeout="30s" interval="20s" op monitor role="Master" OCF_CHECK_LEVEL="0" timeout="30s" interval="10s" op monitor role="Slave" OCF_CHECK_LEVEL="0" timeout="30s" interval="30s" promotable promoted-max=3 meta failure-timeout=30s
```
results in failed resource - I did end up with:
-> $ semanage permissive -a mysqld_t
which is not good (very! bad!) practice!!! But even that was not enough and further customization was needed.
pcs-0.10.12-7.el8.x86_64
resource-agents-4.9.0-19.el8.x86_64
many thanks, L.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the ocf:heartbeat:galera resource agent and the CentOS 8 failure described in the issue, including the mysqld_t SELinux setting. Determine which SELinux module(s) are needed for the agent and verify that the Galera resource can run without making mysqld_t permissive.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux, mysql, shell
- Domain
- databases, infrastructure, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100