2

I'm using freshly installed CentOS 5.7 Linux 64 bit with PGDG packages:

# rpm -qa|grep -i PG
postgresql-libs-8.4.8-2PGDG.rhel5
pgdg-centos-8.4-2
postgresql-8.4.8-2PGDG.rhel5
pgbouncer-1.3.4-1.rhel5
postgresql-server-8.4.8-2PGDG.rhel5

and get the following Apache-errors in /var/log/audit/audit.log

type=AVC msg=audit(1316700316.235:41): avc:  denied  { write } for
pid=2748 comm="httpd" name=".s.PGSQL.6432" dev=sda1 ino=754350
scontext=system_u:system_r:httpd_t:s0
tcontext=system_u:object_r:tmp_t:s0 tclass=sock_file
type=SYSCALL msg=audit(1316700316.235:41): arch=c000003e syscall=42
success=no exit=-13 a0=c a1=2b712748bee0 a2=6e a3=0 items=0 ppid=2721
pid=2748 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48
egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd"
exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)

And here are the files in question (PostgreSQL at "port" 5432 and pgbouncer at "port" 6432):

# ls -aZ /tmp/
srwxrwxrwx  postgres postgres system_u:object_r:postgresql_tmp_t .s.PGSQL.5432
-rw-------  postgres postgres system_u:object_r:postgresql_tmp_t
.s.PGSQL.5432.lock
srwxrwxrwx  postgres postgres system_u:object_r:tmp_t          .s.PGSQL.6432

Does anybody please know, how to permanently make the file .s.PGSQL.6432 above of the same postgresql_tmp_t "type" as s.PGSQL.5432 (which probably will solve the problem)?

By looking at the processes I think, that somehow I must move pgbouncer process from initrc_t to postgresql_t:

# ps uawxZ
system_u:system_r:initrc_t      postgres  2610  0.0  0.0  17020   780 ?        S    15:47   0:00 pgbouncer -d /etc/pgbouncer.ini
system_u:system_r:postgresql_t  postgres  2666  0.1  2.4 1192464 25216 ?       S    15:48   0:02 /usr/bin/postmaster -p 5432 -D    /var/lib/pgsql/data
system_u:system_r:httpd_t       root      2721  0.0  1.0 260608 10564 ?        Ss   15:48   0:00 /usr/sbin/httpd
system_u:system_r:httpd_t       apache    2747  0.0  0.9 261632  9728 ?        S    15:48   0:00 /usr/sbin/httpd
system_u:system_r:httpd_t       apache    2748  0.0  0.9 261632  9728 ?        S    15:48   0:00 /usr/sbin/httpd
Alexander Farber
  • 714
  • 4
  • 17
  • 38

2 Answers2

0

Try this:

# chcon -t postgresql_t /path/to/pgbouncer

and restart pgbouncer.

quanta
  • 51,413
  • 19
  • 159
  • 217
  • This command fails with `chcon: failed to change context of '/usr/bin/pgbouncer' to ‘system_u:object_r:postgresql_t:s0’: Permission denied` (even when run as root) and the modified solution by @Matthew Ife, although it allowed me to change the context, made it so that pgbouncer wouldn't even start. – cazort Aug 26 '21 at 19:33
0

Stealing from quanta a bit, but its probably more along the lines of..

# chcon -t postgresql_exec_t /path/to/pgbouncer

then restart.

Matthew Ife
  • 23,357
  • 3
  • 55
  • 72
  • When I changed the context of pgbouncer to this, it wouldn't even start. `Failed with result 'exit-code'.` and the log file doesn't show anything useful. I had to use `restorecon` to restore the context back to `bin_t` for it to start, so I'm back to ground zero. – cazort Aug 26 '21 at 19:32