SELinux is preventing pg_ctl from read access on the file postgresql.conf

Question

I am trying to setup a master-slave PostgreSQL 9.4 database on Fedora 22, with the slave database's PGDATA being different from the default /var/lib/pgsql/data/ directory. I wrote this to /etc/systemd/system/postgresql.service

.include /lib/systemd/system/postgresql.service
[Service]
Environment=PGDATA=/mnt/db/data

and ran

semanage fcontext -a -t postgresql_db_t "/mnt/db/pg_data(/.*)?"

However, the database won't start and running journalctl -xe gives the title error. How would I go about fixing it.

Answer 1

It looks like you changed the context of the /mnt/db/pg_data directory, but didn't apply the changes to everything underneath.

You can verify this by running ls -Z on the files in question. If you don't see 'postgresql_db_t', then the changes weren't applied.

restorecon -Rv /mnt/db/pg_data/ should set the SELinux contexts correctly. Forcing a relabel of your entire filesystem with touch ./autorelabel and a reboot would also work.

I also noticed that in your service file, you set the PGDATA variable to:

PGDATA=/mnt/db/data

instead of

PGDATA=/mnt/db/pg_data

As you did in your restorecon command, and that could cause problems as well because /mnt/db/data probably doesn't exist on your server.

Lastly, if pg_ctl doesn't have the correct SELinux context, it won't be able to read the data directory either.

So, verifying the context with ls -Z on pg_ctl and changing it if needed is also a good idea.

You can find nice documentation on these SELinux commands here:

https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security-Enhanced_Linux/sect-Security-Enhanced_Linux-Working_with_SELinux-SELinux_Contexts_Labeling_Files.html

https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security-Enhanced_Linux/sect-Security-Enhanced_Linux-SELinux_Contexts_Labeling_Files-Persistent_Changes_semanage_fcontext.html

Hope that helps. Good luck. =)