尝试连接到Mysql安装MediaWiki时权限被拒绝

Question

i have a problem from all afternoon and i'm quite stuck with it so, let's explain it.

I'm running MariaDB which is a flavuor of mysql for Fedora Linux Distibution. I'm trying to install in my local machine a php cms which needs database backend, so i've created the database (it's not the first time so i'm supposed to know what i'm doing), let's say it's called myDb ok? Then i've created the user, let's say myDbUser@localhost ok? Then've granted the privileges on the db to the user (GRANT ALL for being specific). Then i've tested the user and the granted privileges from the command line of the db, everything works fine, i can login and i can see the db.

Then i run the installing script of the cms ok?

Database type:  MySQL (or compatible)
Database host: localhost
Database name: myDb
Database username: myDbUser
Database password: passowrd

The same data that work from the command line. But the result is:

DB connection error: Permission denied (localhost).
Check the host, username and password and try again. 

Given that the username and the password work fine from the command line i assume that it's a problem of the "host"..

So i spent the whole evening trying to understand what is wrong with it and the only thing i came out with (i know it's not much) is the output of this command:

netstat -tln
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:2393            0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:3306            0.0.0.0:*               LISTEN     
tcp6       0      0 ::1:631                 :::*                    LISTEN     
tcp6       0      0 :::80                   :::*                    LISTEN   

I tried everyone of those IP without any success. I got always the same error so any idea, hint, clue, even a fragment of though? Thanks.

EDIT: So further researches have shown that the problem is NOT a database problem, it is instead a CMS problem. That is because i can connect to the db from the command line with the given user and password.

EDIT2: Other researches states that the problem could be a permission problem. I'm logging into the db from the root user of my machine but the webserver is accessing it from an other user. I still don't have idea of how to solve this.

EDIT3: Here is the log file of the apache server:

/var/www/html/Wiki/includes/limit.sh: line 61: ulimit: cpu time: cannot modify limit: Permission denied
/var/www/html/Wiki/includes/limit.sh: line 90: ulimit: file size: cannot modify limit: Permission denied

anyone faced a similar problem before and can help? I have those two links: 1 2 but they doesn't seem to help me more cause i don't get why this script cannot run those commands.

Answer 1

如果您不熟悉MySQL权限的工作原理，只需为MediaWiki安装程序提供root密码，它就会为自己创建具有正确权限的用户。

Answer 2

You can try giving permissions like 'youUser'@'%', using '%' instead of localhost. This should work.

Answer 3

Well, it came out it wasn't a problem of MySql or PHP at all. Instead it was a problem of security, the server didn't have the permission to access the mysql channel. I had to fix it using those commands:

              # grep httpd /var/log/audit/audit.log | audit2allow
              # semodule -i mypol.pp

I really had an hard time finding out this solution, i had to go looking for system messages with journalctl (a command i didn't know before). So it was a big pita* but i found it out, eventually.

So if anyone will have a similar problem at least the answer is there.

Answer 4

Actually, what you needed was

setsebool -P httpd_can_network_connect_db 1

I always, every! single! time!, bump into one or more of selinux issues when I set up a new host. And every single time I end up googling the problem for, usually, hours, before I end up running sealert -a and deal with it myself.

So, you must understand a bit how to read the

sealert -a /var/log/audit/audit.log

which showed you the grep solution applied. You need to read a bit further up. Your output would have looked like below (notice the problem, first pasted line, and the suggested solutions with their confidence, you're chosen one falls rather short):

SELinux is preventing /usr/sbin/httpd from name_connect access on the tcp_socket .

*****  Plugin catchall_boolean (47.5 confidence) suggests  *******************

If you want to allow HTTPD scripts and modules to connect to the network using TCP.
Then you must tell SELinux about this by enabling the 'httpd_can_network_connect'boolean.
Do
setsebool -P httpd_can_network_connect 1

*****  Plugin catchall_boolean (47.5 confidence) suggests  *******************

If you want to allow HTTPD scripts and modules to connect to databases over the network.
Then you must tell SELinux about this by enabling the 'httpd_can_network_connect_db'boolean.
Do
setsebool -P httpd_can_network_connect_db 1

*****  Plugin catchall (6.38 confidence) suggests  ***************************

If you believe that httpd should be allowed name_connect access on the  tcp_socket by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep httpd /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp


Additional Information:
Source Context                unconfined_u:system_r:httpd_t:s0
Target Context                system_u:object_r:mysqld_port_t:s0
Target Objects                 [ tcp_socket ]
Source                        httpd
Source Path                   /usr/sbin/httpd
Port                          3306
Host                          <Unknown>
Source RPM Packages           httpd-2.2.15-54.el6.centos.x86_64
Target RPM Packages
Policy RPM                    selinux-policy-3.7.19-292.el6.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     publicsrv
Platform                      Linux publicsrv 2.6.32-642.el6.x86_64 #1 SMP Tue
                              May 10 17:27:01 UTC 2016 x86_64 x86_64
Alert Count                   26
First Seen                    Sat 01 Oct 2016 09:14:01 PM EEST
Last Seen                     Sat 01 Oct 2016 11:23:12 PM EEST
Local ID                      064b82b4-2e50-42ea-9a07-11468d0a62a6

Raw Audit Messages
type=AVC msg=audit(1475353392.72:578): avc:  denied  { name_connect } for  pid=5858 comm="httpd" dest=3306 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:mysqld_port_t:s0 tclass=tcp_socket


type=SYSCALL msg=audit(1475353392.72:578): arch=x86_64 syscall=connect success=no exit=EACCES a0=e a1=7f0cd22a6008 a2=10 a3=40 items=0 ppid=5852 pid=5858 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=1 comm=httpd exe=/usr/sbin/httpd subj=unconfined_u:system_r:httpd_t:s0 key=(null)

Hash: httpd,httpd_t,mysqld_port_t,tcp_socket,name_connect

audit2allow

#============= httpd_t ==============

#!!!! This avc can be allowed using one of the these booleans:
#     httpd_can_network_connect, httpd_can_network_connect_db
allow httpd_t mysqld_port_t:tcp_socket name_connect;

audit2allow -R

#============= httpd_t ==============

#!!!! This avc can be allowed using one of the these booleans:
#     httpd_can_network_connect, httpd_can_network_connect_db
allow httpd_t mysqld_port_t:tcp_socket name_connect;