MariaDB auth_pam.so plugin or other auth plugins cannot be used

Solution Verified - Updated -

Issue

  • MariaDB auth_pam.so plugin or other auth plugins cannot be used
  • Unable to login into the MariaDB db instance when selinux is set to enforcing mode.
  • We have created the user in the DB with
mysql (mariadb version)
> INSTALL SONAME 'auth_pam';
> create user <myldapuser>@localhost IDENTIFIED VIA pam USING 'mariadb';
  • I am able to log into the MariaDB db instance just fine via the ldap/ad authenticated account when selinux is set to permissive mode.
  • With selinux enforcing, we are getting below errors:
==> /var/log/secure <==
 mysqld: PAM audit_open() failed: Permission denied
==> /var/log/audit/audit.log <==
 avc:  denied
  • We are getting following avc in audit.log:
----
type=SYSCALL msg=audit(03/12/2015 10:48:34.935:47) : arch=x86_64 syscall=socket success=yes exit=36 a0=netlink a1=SOCK_RAW a2=igp a3=0xcccccccd items=0 ppid=1009 pid=1635 auid=unset uid=mysql gid=mysql euid=mysql suid=mysql fsuid=mysql egid=mysql sgid=mysql fsgid=mysql tty=(none) ses=unset comm=mysqld exe=/opt/rh/mariadb55/root/usr/libexec/mysqld subj=system_u:system_r:mysqld_t:s0 key=(null) 
type=AVC msg=audit(03/12/2015 10:48:34.935:47) : avc:  denied  { create } for  pid=1635 comm=mysqld scontext=system_u:system_r:mysqld_t:s0 tcontext=system_u:system_r:mysqld_t:s0 tclass=netlink_audit_socket 
----
type=SYSCALL msg=audit(03/12/2015 10:48:34.937:48) : arch=x86_64 syscall=sendto success=yes exit=144 a0=0x24 a1=0x7f65a0b75b20 a2=0x90 a3=0x0 items=0 ppid=1009 pid=1635 auid=unset uid=mysql gid=mysql euid=mysql suid=mysql fsuid=mysql egid=mysql sgid=mysql fsgid=mysql tty=(none) ses=unset comm=mysqld exe=/opt/rh/mariadb55/root/usr/libexec/mysqld subj=system_u:system_r:mysqld_t:s0 key=(null) 
type=AVC msg=audit(03/12/2015 10:48:34.937:48) : avc:  denied  { nlmsg_relay } for  pid=1635 comm=mysqld scontext=system_u:system_r:mysqld_t:s0 tcontext=system_u:system_r:mysqld_t:s0 tclass=netlink_audit_socket 

Environment

  • Red Hat Enterprise Linux 6
  • selinux-policy-3.7.19-260.el6_6.2

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase of over 48,000 articles and solutions.

Current Customers and Partners

Log in for full access

Log In
Close

Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.