Thread: Using an alternate PGDATA on RHEL4 with SELinux enabled

I just tried installing Postgres 8.1.4 (RPMs from postgresql.org web site)
on a clean RHEL4 Update 2 machine that had SELinux enabled.

When I created a /etc/sysconfig/pgsql/postgresql config file with

PGDATA=/data/pgdata

I was unable to get the start script (/etc/init.d/postgresql) to populate
the data directory nor launch postgres (after I manually did an initdb on
the directory)

The file permissions were

drwx------  11 postgres postgres  4096 Jul 27 12:51 pgdata

But the pgstartup.log was still reporting that initdb coudln't create write
to /data/pgdata (Permission denied)

When I manually copied and pasted the line that was in
/etc/init.d/postgresql to the command line, it ran just fine (executing as
root)

runuser -l postgres -c "/usr/bin/initdb --pgdata='/data/pgdata'
--auth='ident sameuser'" >> "/var/lib/pgsql/pgstartup.log" 2>&1 < /dev/null

But there's some voodoo going on when this is executed inside of the start
script ...

I started monkeying around with cutting the start script down to the point
where I finally got this error to appear (I believe it was removing the
</dev/null redirect):

Your default context is user_u:system_r:unconfined_t. Do you want to choose
a different one? [n]

If I just hit enter, the script would continue and successfully create the
data directory and launch postgres

To be perfectly clear: If I don't set a custom PGDATA in
/etc/sysconfig/pgsql/postgresql, everything works fine ... the data
directory is created in /var/lib/pgsql/data as expected ... it's only with
the custom PGDATA ..

Long story short, I have disabled SELinux on this box because this isn't the
first time SELinux stuff has burned hours of my day and this is an internal
box so I don't feel it's worth the battle right now ... but figured that
maybe someone else out there might benefit from reading this ...

-Dave

"David Esposito" <pgsql-general@esposito.newnetco.com> writes:
> I just tried installing Postgres 8.1.4 (RPMs from postgresql.org web site)
> on a clean RHEL4 Update 2 machine that had SELinux enabled.
> When I created a /etc/sysconfig/pgsql/postgresql config file with
> PGDATA=/data/pgdata
> I was unable to get the start script (/etc/init.d/postgresql) to populate
> the data directory nor launch postgres (after I manually did an initdb on
> the directory)

The default selinux policy prevents postgres from writing anywhere
except under /var/lib/pgsql.  If you want a nondefault PGDATA location
then you have to tweak the policy.

            regards, tom lane

> -----Original Message-----
> From: Tom Lane [mailto:tgl@sss.pgh.pa.us]
>
> The default selinux policy prevents postgres from writing anywhere
> except under /var/lib/pgsql.  If you want a nondefault PGDATA location
> then you have to tweak the policy.
>

It's not that simple ... if I su to postgres, I can initdb and launch
postmaster in any directory I wish (as long as it has rwx for the postgres
user) ... it's only if I try to do this from the init.d start script that
the problem occurs ...

"David Esposito" <pgsql-general@esposito.newnetco.com> writes:
>> -----Original Message-----
>> From: Tom Lane [mailto:tgl@sss.pgh.pa.us]
>> The default selinux policy prevents postgres from writing anywhere
>> except under /var/lib/pgsql.  If you want a nondefault PGDATA location
>> then you have to tweak the policy.

> It's not that simple ... if I su to postgres, I can initdb and launch
> postmaster in any directory I wish (as long as it has rwx for the postgres
> user) ... it's only if I try to do this from the init.d start script that
> the problem occurs ...

Yes, it is that simple.  Processes launched from start scripts inherit
a different (much more restrictive) selinux context than ones launched
from interactive shells.

            regards, tom lane