Subject: SELinux & Redhat

From: Jeff - <[email-masked]>
Date: Fri, 6 May 2005 10:43:49 -0400

I think we should put some notes about SELinux causing issues with  
pgsql in the OS notes or FAQ.

Myself and a few coworkers just spent a few hours tracking down why  
pg_dump would produce no output.  We'd fire it up in strace and we'd  
see all the successful write calls, but not output.

We copied pg_dump from another machine and it worked fine, and that  
machine was running the same OS & pg rpms.

Eventually we found it was SELinux was preventing pg_dump from  
producing output.

Any thoughts?  I could write up a short blurb but I'm not terribly  
familiar with selinux. we just disabled the whole thing to make it work.

For the record:
CentOS 4.0
postgresql-8.0.2-1PGDG.i686.rpm (and associated) rpms from  
postgresql.org's ftp server

--
Jeff Trout <[email-masked]>
http://www.jefftrout.com/
http://www.stuarthamm.net/

---

From: Bruce Momjian <[email-masked]>
Date: Fri, 6 May 2005 10:55:40 -0400 (EDT)

> postgresql.org's ftp server

A blurb about what?  No one else has reported such a problem so we have
no reason to assume it isn't a misconfiguration on your end.

-- 
  Bruce Momjian                        |  http://candle.pha.pa.us
  [email-masked]               |  (610) 359-1001
  +  If your life is a hard drive,     |  13 Roberts Road
  +  Christ can be your backup.        |  Newtown Square, Pennsylvania 19073

---

From: Peter Eisentraut <[email-masked]>
Date: Fri, 6 May 2005 17:13:39 +0200

> no reason to assume it isn't a misconfiguration on your end.

*Countless* people are constantly reporting problems that can be attributed to 
selinux.  We really need to write something about it.  Of course, most 
people, including myself, just solve these issues by turning off selinux, but 
I'd be interested in a more thorough treatment.

-- 
Peter Eisentraut
http://developer.postgresql.org/~petere/

---

From: Bruce Momjian <[email-masked]>
Date: Fri, 6 May 2005 11:21:26 -0400 (EDT)

> I'd be interested in a more thorough treatment.

Who makes SE Linux?  Is it SuSE?  What would we say in an FAQ?  I would
rather report something to people using that OS.

---

From: Tom Lane <[email-masked]>
Date: Fri, 06 May 2005 11:23:54 -0400

> Eventually we found it was SELinux was preventing pg_dump from  

That's a new one on me.  Why was it doing that --- mislabeling on
the pg_dump executable, or what?

			regards, tom lane

---

From: Tom Lane <[email-masked]>
Date: Fri, 06 May 2005 11:28:42 -0400

> *Countless* people are constantly reporting problems that can be
> attributed to selinux.

That's mostly because selinux outright broke postgres in the initial
FC3 releases :-(.  I have to take most of the blame for this myself;
I didn't realize there might be problems, and didn't test adequately.
I believe the problems are all resolved in the latest Fedora RPMs,
though this pg_dump report may be something new.

			regards, tom lane

---

From: Devrim GUNDUZ <[email-masked]>
Date: Fri, 6 May 2005 18:33:20 +0300 (EEST)

Hi,

> the pg_dump executable, or what?

Looking at the strace report that someone has sent me before, there is a 
problem with devices:

===================================================================
<snip>
fstat64(1, {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 3), ...}) = 0
ioctl(1, SNDCTL_TMR_TIMEBASE or TCGETS, 0xbfe16a8c) = -1 ENOTTY
(Inappropriate ioctl for device)
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1,
0) = 0xb7dee000
write(1, "pg_dump dumps a database as a te"..., 2367) = 2367
munmap(0xb7dee000, 4096)                = 0
exit_group(0)                           = ?
===================================================================

This one is from a server with SELinux enabled. My server does not produce 
this, and uses virtual console (as expected?). However with SELinux 
enabled, it wants to use ramdisk (expected? I think no...)

Regards,
- --
Devrim GUNDUZ 
devrim~gunduz.org, devrim~PostgreSQL.org, devrim.gunduz~linux.org.tr
http://www.tdmsoft.com.tr                      http://www.gunduz.org

---

From: Alvaro Herrera <[email-masked]>
Date: Fri, 6 May 2005 11:42:38 -0400

> rather report something to people using that OS.

It's linux-distribution agnostic.  Redhat is including it on its
distributions, as is Debian.  Not sure about the others but that is
already a large population.  (Of course it's Linux only.)

-- 
Alvaro Herrera (<alvherre[@]dcc.uchile.cl>)
"Aprende a avergonzarte más ante ti que ante los demás" (Demócrito)

---

From: Jeff - <[email-masked]>
Date: Fri, 6 May 2005 11:46:26 -0400

> the pg_dump executable, or what?

We've got a stock CentOS 4 install
I nabbed the rpms I mentioned (8.0.2) (-rw-r--r--  1 root root  
2955126 May  4 11:51 postgresql-8.0.2-1PGDG.i686.rpm & company)

from /etc/selinux/targeted/contexts/files/file_contexts I see

file_contexts:/usr/bin/pg_dump  --       
system_u:object_r:postgresql_exec_t
file_contexts:/usr/bin/pg_dumpall       --       
system_u:object_r:postgresql_exec_t

Syslog logs:

May  6 09:01:25 starslice kernel: audit(1115384485.559:0): avc:   
denied  { execute_no_trans } for  pid=4485 exe=/bin/bash path=/usr/ 
bin/pg_dump dev=sda3 ino=5272966  
scontext=user_u:system_r:postgresql_t  
tcontext=system_u:object_r:postgresql_exec_t tclass=file

SELinux is on and under system-config-securitylevel's selinux tab,  
"SELinux Protection services" disable postgresql is not clicked.

When I run pg_dump w/these settings the following happens running  
pg_dump (.broken is hte original file from the rpm)

bash-3.00$ /usr/bin/pg_dump.broken planet
bash-3.00$

Stracing it I get
....
write(1, "file_pkey; Type: CONSTRAINT; Sch"..., 4096) = 4096
write(1, "\n-- Name: userprofile_pkey; Type"..., 4096) = 4096
write(1, "_idx_1 OWNER TO planet;\n\n--\n-- N"..., 4096) = 4096
rt_sigaction(SIGPIPE, {SIG_IGN}, {SIG_DFL}, 8) = 0
send(3, "X\0\0\0\4", 5, 0)              = 5
rt_sigaction(SIGPIPE, {SIG_DFL}, {SIG_IGN}, 8) = 0
close(3)                                = 0
write(1, "me: top3_cmtcount_idx; Type: IND"..., 3992) = 3992
munmap(0xb7df0000, 4096)                = 0
exit_group(0)                           = ?

and what is interesting is it seems only sometimes things get logged  
to syslog about the failure.

If I copy the file (not mv) it will work (possibly due to xattrs  
being set?)

and if I disable pg checking, (or selinux all together) it works.

COOL, HUH?

---

From: Tom Lane <[email-masked]>
Date: Fri, 06 May 2005 11:57:47 -0400

> bash-3.00$ /usr/bin/pg_dump.broken planet

Does it work if you direct the output into a file, instead of letting it
come to your terminal (which seems a bit useless anyway)?

I've been bugging dwalsh about the fact that the selinux policy
disallows writes to /dev/tty to things it thinks are daemons;
that seems pretty stupid.  But pg_dump isn't a daemon so there's
no reason for it to be restricted this way anyway...

> to syslog about the failure.

Someone told me there's a rate limit on selinux complaints going to
syslog, to keep it from swamping your logs.  I suspect there are some
actual bugs there too, because I've noticed cases where an action was
blocked and there wasn't any log message, nor enough activity to
justify a rate limit.  Feel free to file a bugzilla report if you can
get a reproducible case.

			regards, tom lane

---

From: Jeff - <[email-masked]>
Date: Fri, 6 May 2005 13:37:49 -0400

> come to your terminal (which seems a bit useless anyway)?

Interesting.

Redirecting it worked, but I'm pretty sure at one point it didn't  
work. (I could also be smoking crack).

Hmm.. piping it into another app worked.

I only found out about this when another developer here tried to run  
it and got nothing.

in any case, it might be something useful to jot somewhere.

---

From: Mischa Sandberg <[email-masked]>
Date: Fri, 6 May 2005 14:39:11 -0700

After reading the comparisons between Opteron and Xeon processors for Linux,
I'd like to add an Opteron box to our stable of Dells and Sparcs, for comparison.

IBM, Sun and HP have their fairly pricey Opteron systems.
The IT people are not swell about unsupported purchases off ebay.
Anyone care to suggest any other vendors/distributors?
Looking for names with national support, so that we can recommend as much to our
customers.

Many thanks in advance.
-- 
"Dreams come true, not free." -- S.Sondheim

---

From: Ian Meyer <[email-masked]>
Date: Fri, 6 May 2005 18:09:19 -0400

Mischa,

What kind of budget are you on? penguincomputing.com deals with
Opteron servers. I looked at a couple of their servers before deciding
on a HP DL145.

Ian

On 5/6/05, Mischa Sandberg <[email-masked]> wrote:
> ---------------------------(end of broadcast)---------------------------
> TIP 9: the planner will ignore your desire to choose an index scan if your
>       joining column's datatypes do not match
>

---

From: Steve Poe <[email-masked]>
Date: Fri, 06 May 2005 15:29:28 -0700

Mischa,

I certainly understand your concern, but the  price and support 
sometimes go hand-in-hand. You may have to pick your batttles if your 
want more bang for the buck or more support. I might be wrong on this, 
but not everything you buy on E-Bay is unsupported.

We purchase a dual Operton from Sun off their E-Bay store  for about $3K 
less than the "buy it now" price.

 From an IT perspective, support is not as critical if I can do it 
myself. If it is for business 24/7 operations, then the company should 
be able to put some money behind what they want to put their business 
on. Your mileage may vary.

Steve

---

From: "Gavin M. Roy" <[email-masked]>
Date: Fri, 06 May 2005 15:44:49 -0700

Please wait a week before buying Sun v20z's or v40z's from off of Ebay 
(j/k). (As I'm in the process of picking up a few)  From everything I 
hear the v20z/v40z's are a great way to go and I'll know more in 15 days 
or so.

Regards,

Gavin

Steve Poe wrote:

> We purchase a dual Operton from Sun off their E-Bay store  for about 
> $3K less than the "buy it now" price.
>
> TIP 6: Have you searched our list archives?
>
>               http://archives.postgresql.org

---

From: Andrew Sullivan <[email-masked]>
Date: Sat, 7 May 2005 10:57:46 -0400

> IBM, Sun and HP have their fairly pricey Opteron systems.

We've had some quite good experiences with the HP boxes.  They're not
cheap, it's true, but boy are they sweet.

A

-- 
Andrew Sullivan  | [email-masked]
In the future this spectacle of the middle classes shocking the avant-
garde will probably become the textbook definition of Postmodernism. 
                --Brad Holland

---

From: Josh Berkus <[email-masked]>
Date: Sat, 7 May 2005 14:00:34 -0700

A-

> cheap, it's true, but boy are they sweet.

Question, though: is HP still using their proprietary RAID card?   And, if so, 
have they fixed its performance problems?

-- 
Josh Berkus
Aglio Database Solutions
San Francisco

---

From: Sam Vilain <[email-masked]>
Date: Mon, 09 May 2005 09:59:07 +1200

> Anyone care to suggest any other vendors/distributors?

Check out the Tyan Transport systems.  Tyan are an ex Sparc clone manufacturer, and
released the second available Opteron board - widely considered the first serious
Opteron board to hit the market.

Sam.

---

From: Mischa Sandberg <[email-masked]>
Date: Sun, 8 May 2005 15:33:11 -0700

Thanks to everyone for their pointers to suppliers of Opteron systems.

The system I'm pricing is under a tighter budget than a production machine,
because it will be for perftests. Our customers tend to run on Dells but
occasionally run on (Sun) Opterons.

---

From: Geoffrey <[email-masked]>
Date: Sun, 08 May 2005 22:17:41 -0400

> Looking for names with national support, so that we can recommend as much to our

Monarch Computer http://www.monarchcomputer.com/

They have prebuilt and custom built systems.

-- 
Until later, Geoffrey

---

From: John A Meinel <[email-masked]>
Date: Mon, 09 May 2005 10:18:15 -0500

> They have prebuilt and custom built systems.

I believe we have had some issues with their workstation class systems.
Just a high rate of part failure, and DOA systems.

I believe they RMA'd without too great of difficulties, but it was
something like 50%.

John
=:->

---

From: Geoffrey <[email-masked]>
Date: Mon, 09 May 2005 16:00:59 -0400

> I believe they RMA'd without too great of difficulties, but it was

Ouch, that's not been my experiences.  I'd like to hear if anyone else 
has had such problems with Monarch.

-- 
Until later, Geoffrey

---

From: Andrew Sullivan <[email-masked]>
Date: Fri, 13 May 2005 17:07:35 -0400

> have they fixed its performance problems?

According to my folks here, we're using the CCISS controllers, so I
guess they are.  The systems are nevertheless performing very well --
we did a load test that was pretty impressive.  Also, Chris Browne
pointed me to this for the drivers:

http://sourceforge.net/projects/cciss/

A

-- 
Andrew Sullivan  | [email-masked]
A certain description of men are for getting out of debt, yet are
against all taxes for raising money to pay it off.
		--Alexander Hamilton

---

From: Richard Rowell <[email-masked]>
Date: Fri, 10 Jun 2005 07:34:21 -0500

I will second the nod to Penguin computing.  We have a bit of Penguin
hardware here (though the majority is Dell).  We did have issues with
one machine a couple of years ago, but Penguin was very pro-active in
addressing that.

We recently picked up a Dual Opteron system from them and have been very
pleased with it so far.  

I would be careful of the RHES that it ships with though.  We had
machine lockups immediately after the suggested  kernel update (had to
down grade manually).  Also, the RH supplied Postgres binary has issues,
so you would need to compile Postgres yourself until the next RH update.

-- 
--
Richard Rowell
[email-masked]
Bowman Systems
(318) 213-8780