ceph/qa/suites/fs/workload/tasks/5-workunit/postgres.yaml

   1 # I would expect setting the context on the postgresql database directories
   2 # would correctly trickle down to the files created by the postgresql daemon,
   3 # but this does not appear to work. I would still see denials like:
   4
   5 #     type=AVC msg=audit(1655861665.521:21354): avc:  denied  { create } for  pid=131994 comm="postmaster" name="replorigin_checkpoint.tmp" scontext=system_u:system_r:postgresql_t:s0 tcontext=system_u:object_r:cephfs_t:s0 tclass=file permissive=1'
   6
   7 # Instead, we'll just set the context for the mount and be done with it. I've
   8 # left in the context setting for the directories below.
   9
  10 overrides:
  11   ceph-fuse:
  12     client.0:
  13       mountpoint: /tmp/cephfs
  14       mntopts: ["context=system_u:object_r:postgresql_db_t:s0"]
  15   kclient:
  16     client.0:
  17       mountpoint: /tmp/cephfs
  18       mntopts: ["context=system_u:object_r:postgresql_db_t:s0"]
  19 tasks:
  20 - exec:
  21     client.0:
  22       - sudo ls -l /tmp/cephfs/ && sudo df -h /tmp/cephfs/
  23       - sudo mkdir -m 755 --context=system_u:system_r:postgresql_t:s0 /tmp/cephfs/postgres && sudo chown postgres:postgres /tmp/cephfs/postgres
  24       - sudo -u postgres -- mkdir -m 700 --context=system_u:system_r:postgresql_t:s0 /tmp/cephfs/postgres/data
  25       - sudo semanage fcontext -a -t postgresql_db_t "/tmp/cephfs/postgres(/.*)?"
  26       - sudo grep -i postgresql /etc/selinux/targeted/contexts/files/file_contexts.local
  27       - sudo restorecon -R -v /tmp/cephfs/postgres
  28       - sudo ls -lZaR /tmp/cephfs/postgres/
  29       - sudo mkdir -p /etc/systemd/system/postgresql.service.d/ && printf '[Service]\nEnvironment=PGDATA=/tmp/cephfs/postgres/data\nEnvironment=PGLOG=/tmp/cephfs/postgres/pgstartup.log\n' | sudo tee /etc/systemd/system/postgresql.service.d/env.conf
  30       - sudo -u postgres -- postgresql-setup --initdb
  31       - sudo ls -lZaR /tmp/cephfs/postgres/
  32       - sudo systemctl start postgresql
  33       - sudo -u postgres -- pgbench -s 500 -i
  34       - sudo -u postgres -- pgbench -c 100 -j 4 --progress=5 --time=900
  35       - sudo systemctl stop postgresql
  36       - sudo ls -lZaR /tmp/cephfs/postgres/