SELinux config for v6 on RHEL 9

Eric_Barberan · April 21, 2023, 2:27pm

V6.0.5 / RHEL 9.1

Are there steps to configure selinux on RHEL9? The instructions in Configure SELinux point to a git repo to run some make installs, but the release notes in there say RHEL 7 & 8 only. Are there steps for RHEL 9?

github.com

mongodb/mongodb-selinux/blob/master/README.md

# SELinux policy for MongoDB

This is the official SELinux policy for the MongoDB server.

Security-Enhanced Linux (SELinux) is an implementation of mandatory access controls (MAC)
in the Linux kernel, checking for allowed operations after standard discretionary access
controls (DAC) are checked.

## Scope

* policies apply to computers running RHEL7 and RHEL8 only.
* covers standard mongodb-server systemd based installations only.
* both community and enterprise versions are supported.

Supplied policies do not cover any daemons or tools other than mongod, such as: mongos,
mongocryptd, or mongo shell

## Installation

You will need to install following packages in order to apply this policy:

This file has been truncated. show original

I tried it to see what would happen and I’m getting some errors. I’m not sure if it’s related to the release or the way I brought the repo onto the server (download onto a pc and moved up the server). It’s failing in the make looking for mongodb-enterprise-server or mongodb-org-server with “not found” which makes me think i missed something in the repo.

[root@]#unzip mongodb-selinux-master.zip

[root@]#cd mongodb-selinux-master/

[root@]#make
(cd selinux; make -f /usr/share/selinux/devel/Makefile)
make[1]: Entering directory '/home/xx/Mongo/mongodb-selinux-master/selinux'
Compiling targeted mongodb module
Creating targeted mongodb.pp policy package
rm tmp/mongodb.mod.fc tmp/mongodb.mod
make[1]: Leaving directory '/home/xx/Mongo/mongodb-selinux-master/selinux'
mkdir -p build/targeted
mv selinux/mongodb.pp build/targeted/

[root@]# make install
cp build/targeted/mongodb.pp /usr/share/selinux/targeted/mongodb.pp
/usr/sbin/semodule --priority 200 --store targeted --install /usr/share/selinux/targeted/mongodb.pp
libsemanage.semanage_direct_install_info: Overriding mongodb module at lower priority 100 with module at priority 200.
/sbin/fixfiles -R mongodb-enterprise-server restore || true
mongodb-enterprise-server not found

/sbin/fixfiles -R mongodb-org-server restore || true
mongodb-org-server not found

/sbin/restorecon -R /var/lib/mongo || true
/sbin/restorecon -R /run/mongodb || true
/sbin/restorecon: lstat(/run/mongodb) failed: No such file or directory

[root@]# systemctl status mongod
Failed to get properties: Access denied

Thanks for any guidance

Eric_Barberan · April 21, 2023, 2:32pm

Sorry I just saw this under the configure selinux

Starting in MongoDB 5.0, a new SELinux policy is available for MongoDB installations that:

* Use an `.rpm` installer.
* Use default configuration settings.
* Run on RHEL7 or RHEL8.

If your installation does not meet these requirements, refer to the [SELinux Instructions](https://www.mongodb.com/docs/manual/tutorial/install-mongodb-enterprise-on-red-hat-tarball/#std-label-install-enterprise-tarball-rhel-configure-selinux) for `.tgz` packages.

Let me give these a shot