I noticed I am getting some SELinux errors when running mongod for the UniFi controller program. Namely, I am getting:
SELinux is preventing /usr/bin/mongod from search access on the directory /.
SELinux is preventing /usr/bin/mongod from search access on the directory /var/lib/nfs
SELinux is preventing /usr/bin/mongod from search access on the directory fs
SELinux is preventing /usr/bin/mongod from search access on the directory /var/lib/snapd
I don't see any reason as to why mongod needs search access to any of these directories and I am wondering if/how I can disable it trying to search them and I don't think giving it access to my entire system is really a solution.
The actual database is stored, it is in the default location (config file below) and the SELinux types are set correctly for those directories as the service does seem to run and no errors are thrown about accessing /var/lib/mongo
.
# mongod.conf
# for documentation of all options, see:
# http://docs.mongodb.org/manual/reference/configuration-options/
# where to write logging data.
systemLog:
destination: file
logAppend: true
path: /var/log/mongodb/mongod.log
# Where and how to store data.
storage:
dbPath: /var/lib/mongo
journal:
enabled: true
# engine:
# wiredTiger:
# how the process runs
processManagement:
fork: true # fork and run in background
pidFilePath: /var/run/mongodb/mongod.pid # location of pidfile
timeZoneInfo: /usr/share/zoneinfo
# network interfaces
net:
port: 27017
bindIp: 127.0.0.1 # Enter 0.0.0.0,:: to bind to all IPv4 and IPv6 addresses or, alternatively, use the net.bindIpAll setting.
Best Answer
I had the same issue with MongoDB-7 on RHEL9 and as @kwodzicki I don't want to modify SELinux creating a new policy and so on, because I don't need MongoDB access to NFS or retrieve statistic information because of FTDC for my DEV environment.
After read the documentation shared by @hq: Full Time Diagnostic Data Capture (FTDC) I solved this issue. Just in case, just add next lines to /etc/mongod.conf
Then restart MongoDB: