fix(roles/mariadb_server): mariadbd drops out of mysqld_t on upgrade - #327
Merged
Merged
Conversation
Member
|
Urgent. |
NavidSassan
requested changes
Aug 26, 2026
The comment claimed the exclusion keeps Galera nodes out of mysqld_t. It only does so on EL8. On EL9 and EL10 MariaDB-server declares (mysql-selinux >= 1.0.14 if selinux-policy-targeted), so the policy is installed and rpm labels the binary regardless of this role, and Galera nodes run confined either way. Measured on a Rocky 9 node where both SELinux tasks were skipped: mariadbd still ran in mysqld_t. Also name the actual failure behind Errcode: 13, which is the donor's mariabackup failing to reach the local socket during SST, and point at #328, where the Galera breakage is tracked. The socket drop-in gains the same treatment: once mariadbd runs in mysqld_t the base policy labels the socket through a type_transition, so the ExecStartPost only matters on hosts where it does not, which the comment now says instead of implying the chcon is always needed. verify.yml: ps exits 1 when no process matches, so the label check failed with a bare rc=1 instead of the fail_msg. Split into a "is it running" assert and the domain assert.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every MariaDB package upgrade resets
/usr/sbin/mariadbdtobin_t, because theMariaDB repo packages ship no file contexts for that binary name (MDEV-30520).
That stayed invisible until MariaDB 11.4.13 / 11.8.9 moved the galera recovery into
ExecStart(MDEV-40629): systemd now execs/bin/shand lands ininitrc_tinsteadof the unconfined
unconfined_service_t, andhttpd_tis deniedconnecttoon theMariaDB socket. Applications then return 500 with
SQLSTATE[HY000] [2002] Permission denied.To fix this: Install
mysql-selinux, which ships the contexts for all mariadbd binary names.The
semanage fcontext /usr/bin/mariadbdonly works on EL10, not on EL8 and EL9.Also drops the drop-in's
ExecStartPrechcon, which could never work because ofProtectSystem=full.