mariadb_server: Galera does not come up with SELinux enforcing on RHEL 9/10

[NavidSassan]

Bug description

A Galera cluster deployed with roles/mariadb_server does not form on RHEL 9 / 10 with SELinux enforcing. The nodes see each other over gcomm, but state transfer never completes and the joiner is killed by systemd after the start timeout.

Two independent causes were found, plus a third that is confirmed but not yet diagnosed.

1. binlog_format never reaches the deployed config (fixed in fix/mariadb-server-galera)

The config templates wrote binlog_format only inside a log_bin is set guard, and log_bin defaults to '' on every supported version. Following the Galera block in the role README therefore had no effect and wsrep recovery aborted with Only binlog_format= 'ROW' is currently supported. Configured value: 'MIXED'. The guard dates to 70e8d2c (2025-02-13); the README's Galera block predates it by three months and was never re-tested against it.

2. The Galera ports are not labelled for SELinux (fix known and tested, not yet written)

The role labels only 3306 and 3307 as mysqld_port_t. Galera additionally needs 4444 (rsync SST) and 4568 (IST), which carry kerberos_port_t and unreserved_port_t:

joiner: denied { name_bind }    comm="rsync"    src=4444  tcontext=...:kerberos_port_t:s0
donor:  denied { name_connect } comm="mariadbd" dest=4568 tcontext=...:unreserved_port_t:s0

condition	result
enforcing, ports unlabelled	SST hangs, joiner killed by systemd
permissive	SST succeeds in 11 s, node SYNCED
enforcing, 4444 + 4568 as mysqld_port_t on both nodes	SST succeeds in 14 s, both nodes Synced/Primary

Fix: a community.general.seport task mirroring the existing 3307 one, gated on mariadb_server__cnf_wsrep_on.

3. mariabackup SST fails under confinement (unresolved)

With wsrep_sst_method: 'mariabackup' and the ports labelled, the donor's mariabackup cannot reach the local socket:

Failed to connect to MariaDB server: Can't connect to local server through
socket '/var/lib/mysql/mysql.sock' (13 "Permission denied").

This is the Errcode: 13 recorded in roles/mariadb_server/tasks/main.yml since c621ae8. Donor permissive makes it work, donor enforcing makes it fail, reproduced three times, so the cause is SELinux. But no AVC is logged, even after semodule -DB, so the missing rule is unidentified. Not a filesystem issue: the socket is srwxrwxrwx mysql:mysql and the datadir drwxr-xr-x. /usr/bin/mariabackup being labelled bin_t was checked and ruled out - it is a symlink to mariadb-backup, whose label is already mysqld_exec_t.

Next step: semanage permissive -a mysqld_t on the donor and re-run, to force logging of everything the domain is denied.

Related: the wsrep exclusion in the role does not do what it claims

# excluded on purpose: in `mysqld_t`, wsrep recovery fails the start with `Errcode: 13`
- 'mariadb_server__cnf_wsrep_on is false'

On RHEL 9/10 this protects nothing. MariaDB-server declares (mysql-selinux >= 1.0.14 if selinux-policy-targeted), so the policy is installed regardless of the role, and rpm labels the binary at install time. Measured on a node where the role skipped both SELinux tasks:

rpm -q mysql-selinux        -> mysql-selinux-1.0.14-1.el9_6.noarch
ls -Z /usr/sbin/mariadbd    -> system_u:object_r:mysqld_exec_t:s0
ps -o label= -C mariadbd    -> system_u:system_r:mysqld_t:s0

The exclusion only takes effect on RHEL 8, where that dependency does not exist.

Steps to reproduce

1. Three RHEL 9 hosts, SELinux enforcing.
2. Inventory per the Galera block in roles/mariadb_server/README.md, plus mariadb_server__cnf_wsrep_on: true.
3. Run linuxfabrik.lfops.mariadb_server, bootstrapping the first node with mariadb_server__run_galera_new_cluster: true.

Or run the scenario on the branch: LFOPS_TEST_TARGETS='rocky9-vm,rocky9-vm-2,rocky9-vm-3' molecule test --scenario-name mariadb_server/galera

Expected behavior

The cluster forms, every node reports Synced / Primary, and a write on one node is readable on the others.

Environment

Rocky Linux 9, MariaDB 11.4.13 from rpm.mariadb.org, mysql-selinux-1.0.14-1.el9_6, SELinux enforcing, rsync and mariabackup SST. Not tested: RHEL 8, RHEL 10, MariaDB 10.6 / 10.11 / 11.8.

Additional context

Branch fix/mariadb-server-galera carries the binlog_format fix and a Molecule scenario (extensions/molecule/mariadb_server/galera). The scenario does not pass yet - it needs the port task from cause 2.

Residual non-fatal denials seen during rsync SST: noatsecure, rlimitinh, siginh from wsrep_sst_rsync executing ip (transition to ifconfig_t). SST completes with them present.

Containers cannot host this test: a container runs under the host's kernel policy with its filesystem relabelled to container_file_t, so mariadbd never carries mysqld_exec_t and never transitions into mysqld_t.