ClusterLabs / ClusterLabs/resource-agents

SELinux semodule(s) for `ocf:heartbeat:galera`

Open
#1,782 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Shell
Stars
519
Forks
608
Avg merge
6d 1h
Merged PRs (30d)
7

Description

Hi.
As groovy as ClusterLabs are many will agree you guys often neglect SELinux.
May I suggest you include/supply module(s) with/for GALERA agent - many will be grateful! & nobody can tell better than the authors/developers what is really needed/critical for SELinux - as opposed to us users compiling custom module.

On CentOS 8 setting resource as:
```
-> $ pcs resource create mariadb ocf:heartbeat:galera cluster_host_map="c8kubernode1:10.0.1.1;c8kubernode2:10.0.1.2;c8kubernode3:10.0.1.3" wsrep_cluster_address="gcomm://10.0.1.1,10.0.1.2,10.0.1.3" log=/var/log/mariadb/mariadb.log user=mysql group=mysql check_user="pacemaker" check_passwd="#989" additional_parameters="--basedir=/usr" op monitor OCF_CHECK_LEVEL="0" timeout="30s" interval="20s" op monitor role="Master" OCF_CHECK_LEVEL="0" timeout="30s" interval="10s" op monitor role="Slave" OCF_CHECK_LEVEL="0" timeout="30s" interval="30s" promotable promoted-max=3 meta failure-timeout=30s
```
results in failed resource - I did end up with:
-> $ semanage permissive -a mysqld_t
which is not good (very! bad!) practice!!! But even that was not enough and further customization was needed.

pcs-0.10.12-7.el8.x86_64
resource-agents-4.9.0-19.el8.x86_64

many thanks, L.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the ocf:heartbeat:galera resource agent and the CentOS 8 failure described in the issue, including the mysqld_t SELinux setting. Determine which SELinux module(s) are needed for the agent and verify that the Galera resource can run without making mysqld_t permissive.

Written by the indexing model from the issue text.

Assessment

Tech stack
linux, mysql, shell
Domain
databases, infrastructure, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.