mongodb / mongodb-selinux

SELinux policy for MongoDB

This is the official SELinux policy for the MongoDB server.

Security-Enhanced Linux (SELinux) is an implementation of mandatory access controls (MAC) in the Linux kernel, checking for allowed operations after standard discretionary access controls (DAC) are checked.

Scope

• policies apply to computers running RHEL7 and RHEL8 only.
• covers standard mongodb-server systemd based installations only.
• both community and enterprise versions are supported.

Supplied policies do not cover any daemons or tools other than mongod, such as: mongos, mongocryptd, or mongo shell

Installation

You will need to install following packages in order to apply this policy:

• git
• make
• checkpolicy
• policycoreutils
• selinux-policy-devel

to apply policy:

git clone https://github.com/mongodb/mongodb-selinux
cd mongodb-selinux
make
sudo make install

to uninstall policy:

sudo make uninstall

Standard installation

Present SELinux policies are automatically applied when mongodb-server package is installed on a supported system.

In order for mongod service to run, following assumptions are made:

• daemon binary is installed in /usr/bin/mongod
• database is located in /var/lib/mongo
• log file must be located in /var/log/mongodb/
• runtime data (PID) should be in /var/run/mongodb/ or /run/mongodb/. On RHEL systems /var/run is a symbolic link to /run. This should not be changed
• default unix socket file goes to /tmp, which must stay a default location provided by operating system. It can not be a symbolic link to another location
• default user created and configured by installer is used to run service
• systemd unit file /usr/lib/systemd/system/mongod.service created by installer is used to run service
• daemon should use ports provided by operating system in mongod_port_t, which by default are: tcp/27017-27019,28017-28019
• when used with snmp, standard snmp ports should be used provided in snmp_port_t, defaults are: tcp/199,1161,161-162 and udp/161-162. When using ports with number under 1024, standard unix considerations are in place.

Special Cases

There are following selinux booleans provided for use with enterprise features:

mongod_can_connect_snmp mongod_can_connect_ldap mongod_can_use_kerberos

These booleans are disabled by default. They can be turned on using setsebool command:

setsebool -P mongod_can_connect_snmp on

using -P switch would persist setting across reboots and re-installations

Admin interface

SELinux "mongodb_admin" macro from reference package is not provided. Mongo daemon could be managed by a standard superuser running in unconfined_t domain

mongodb-selinux's Issues

SE-Linux and var_lib_nfs

Following messeages is seen in audit log for MongoDB 6.0
type=AVC msg=audit(1679898913.000:2101220): avc: denied { search } for pid=314191 comm="ftdc" name="nfs" dev="dm-6" ino=6292236 scontext=system_u:system_r:mongod_t:s0 tcontext=system_u:object_r:var_lib_nfs_t:s0 tclass=dir permissive=0

Adding following to mongodb.te and unloading, compiling and adding rules again helped.
Seems the rule was lost between MongoDB 4.4 and 5.0

Patch file:

--- mongodb.te.orig	2023-03-27 15:50:01.215714756 +0200
+++ mongodb.te	2023-03-27 15:50:57.510360567 +0200
@@ -65,6 +65,16 @@
 allow mongod_t var_run_t:dir { open read getattr lock search ioctl add_name remove_name write };
 type_transition mongod_t var_run_t:dir mongod_runtime_t;
 
+require {
+	type var_lib_nfs_t;
+	type autofs_t;
+	type mongod_t;
+	class dir search;
+}
+#============= mongod_t ==============
+allow mongod_t autofs_t:dir search;
+allow mongod_t var_lib_nfs_t:dir search;
+
 # this is required to create mongodb-XXXXX.sock files
 files_rw_generic_tmp_dir(mongod_t)
 fs_manage_tmpfs_sockets(mongod_t)

Feature Request: Provide prebuilt RPM package

It would be convenient if this were provided as a prebuilt RPM package in the repository alongside the other MongoDB packages.

After applying these to RHEL9.2 all users including root loose systemctl control over mongod

If I apply this selinxu policies, root and all users loose control of mongod using systemctl:

[root@phapi207 mongodb-selinux]# make install
cp build/targeted/mongodb.pp /usr/share/selinux/targeted/mongodb.pp
/usr/sbin/semodule --priority 200 --store targeted --install /usr/share/selinux/targeted/mongodb.pp
libsemanage.semanage_direct_install_info: Overriding mongodb module at lower priority 100 with module at priority 200.
/sbin/fixfiles -R mongodb-enterprise-server restore || true
mongodb-enterprise-server not found

/sbin/fixfiles -R mongodb-org-server restore || true
2k
/sbin/restorecon -R /var/lib/mongo || true
/sbin/restorecon -R /run/mongodb || true
[root@phapi207 mongodb-selinux]# systemctl status mongod
Failed to get properties: Access denied

If I remove simply wiht "make uninstall" systemctl access is restored. Any hints what changed ? RHEL 9.1 and 8.8 systems do not have this issue.

make[1]: *** No rule to make target 'selinux/mongodb.te', needed by 'build/targeted/mongodb.pp'. Stop.

Please, can you help me?