Can I use .pgpass in SELinux? [centos7, pgagent_96, postgresql 9.6.5]

Question

.pgpass seems to be not working. Could you check my pgagent setting?

OS : centos 7   ( I did NOT disable selinux )

Database : postgresql 9.6.5

pgagent : pgagent_96 3.4.0-9.rhel7  ( installed package using  yum )

1. I logged on centos server as user 'frank'

2. Before starting pgagent, I checked status of pgagent. ( I did not enable pgagent_96 service. )

    [frank@web]$ systemctl status pgagent_96.service ● pgagent_96.service - PgAgent for PostgreSQL 9.6 Loaded: loaded (/usr/lib/systemd/system/pgagent_96.service; disabled; vendor preset: disabled) Active: inactive (dead) 

3. I started pgagent. At first it looks successful. But after tens of seconds, it failed to create connection and died. ( While starting CentOs asked me frank's OS password. )

    [frank@web]$ systemctl start pgagent_96.service [frank@web]$ systemctl status pgagent_96.service ● pgagent_96.service - PgAgent for PostgreSQL 9.6 Loaded: loaded (/usr/lib/systemd/system/pgagent_96.service; disabled; vendor preset: disabled) Active: active (running) since 2017-10-16 16:42:11 KST; 5s ago Process: 9507 ExecStart=/usr/bin/pgagent_96 -s ${LOGFILE} hostaddr=${DBHOST} dbname=${DBNAME} user=${DBUSER} port=${DBPORT} (code=exited, status=0/SUCCESS) Main PID: 9510 (pgagent_96) CGroup: /system.slice/pgagent_96.service └─9510 /usr/bin/pgagent_96 -s /var/log/pgagent_96.log hostaddr=127.0.0.1 dbname=postgres user=postgres port=5432 16 Oct 16:42:11 web.frank.net systemd[1]: Starting PgAgent for PostgreSQL 9.6... 16 Oct 16:42:11 web.frank.net systemd[1]: Started PgAgent for PostgreSQL 9.6. 

(After tens of seconds... )

   [frank@web]$ systemctl status pgagent_96.service
    ● pgagent_96.service - PgAgent for PostgreSQL 9.6
       Loaded: loaded (/usr/lib/systemd/system/pgagent_96.service; disabled; vendor preset: disabled)
       Active: failed (Result: exit-code) since 2017-10-16 16:42:56 KST; 4min 9s ago
      Process: 9507 ExecStart=/usr/bin/pgagent_96 -s ${LOGFILE} hostaddr=${DBHOST} dbname=${DBNAME} user=${DBUSER} port=${DBPORT} (code=exited, status=0/SUCCESS)
     Main PID: 9510 (code=exited, status=1/FAILURE)

    16 Oct 16:42:11 web.frank.net systemd[1]: Starting PgAgent for PostgreSQL 9.6...
    16 Oct 16:42:11 web.frank.net systemd[1]: Started PgAgent for PostgreSQL 9.6.
    16 Oct 16:42:56 web.frank.net systemd[1]: pgagent_96.service: main process exited, code=exited, status=1/FAILURE
    16 Oct 16:42:56 web.frank.net systemd[1]: Unit pgagent_96.service entered failed state.
    16 Oct 16:42:56 web.frank.net systemd[1]: pgagent_96.service failed.

4. I checked pgagent log. ( Log in /var/log/pgagent_96.log )

    WARNING: Couldn't create the primary connection (attempt 1): fe_sendauth: no password supplied WARNING: Couldn't create the primary connection (attempt 2): fe_sendauth: no password supplied WARNING: Couldn't create the primary connection (attempt 3): fe_sendauth: no password supplied WARNING: Couldn't create the primary connection (attempt 4): fe_sendauth: no password supplied WARNING: Couldn't create the primary connection (attempt 5): fe_sendauth: no password supplied WARNING: Couldn't create the primary connection (attempt 6): fe_sendauth: no password supplied WARNING: Couldn't create the primary connection (attempt 7): fe_sendauth: no password supplied WARNING: Couldn't create the primary connection (attempt 8): fe_sendauth: no password supplied WARNING: Couldn't create the primary connection (attempt 9): fe_sendauth: no password supplied WARNING: Couldn't create the primary connection (attempt 10): fe_sendauth: no password supplied ERROR: Stopping pgAgent: Couldn't establish the primary connection with the database server. 

5. Checked my .pgpass file. ( .pgpass is in frank's home directory. /home/frank )

    [frank@web]$ ls -alZ .pgpass -rw-------. frank frank unconfined_u:object_r:user_home_t:s0 .pgpass [frank@web]$ ls -al .pgpass -rw-------. 1 frank frank 43 16 Oct 16:23 .pgpass [frank@web]$ id -Z unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 [frank@web]$ id uid=1000(frank) gid=1000(frank) groups=1000(frank),10(wheel) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 

6. Checked my pg_hba.conf.

    [frank@web]$ su - postgres -bash-4.2$ pwd /var/lib/pgsql/9.6/data -bash-4.2$ ls -alZ pg_hba.conf -rw-------. postgres postgres unconfined_u:object_r:postgresql_db_t:s0 pg_hba.conf( pg_hba.conf ) 

[Content of pg_hba.conf]

# TYPE  DATABASE        USER            ADDRESS                 METHOD
# "local" is for Unix domain socket connections only
#local   all             all                                     peer
local   all             all                                md5

# IPv4 local connections:
#host    all             all             127.0.0.1/32            ident
host    all   all   122.32.2.21/32       md5    (122.32.2.21  is my server's IP )

# IPv6 local connections:
#host    all             all             ::1/128                 ident
host    all             all             ::1/128                 md5

# Allow replication connections from localhost, by a user with the
# replication privilege.
#local   replication     postgres                                peer
#host    replication     postgres        127.0.0.1/32            ident
#host    replication     postgres        ::1/128                 ident

7. I changed postgres user's password like this.

    postgres=# ALTER USER postgres WITH PASSWORD 'pwd'; 

8. Content of .pgpass file.

    localhost:5432:postgres:postgres:pwd 

9. I changed owner, group of .pgpass from frank to postgres. But the result was same. I tested same thing for OS user 'root' (/root), 'postgres' (/var/lib/pgsql ), and other two normal users who has home directory in /home.

(1)Try to start as OS user 'root'

    [root@web frank]# ls -al .pgpass
    -rw-------. 1 postgres postgres 43 10월 16 17:08 .pgpass
    [root@web frank]# ls -alZ .pgpass
    -rw-------. postgres postgres unconfined_u:object_r:user_home_t:s0 .pgpass
    [root@web frank]# cat .pgpass
    localhost:5432:postgres:postgres:pwd
    [root@web frank]# systemctl start pgagent_96      (Here, centos asked frank's OS password )
    [root@web frank]# systemctl status pgagent_96
    ● pgagent_96.service - PgAgent for PostgreSQL 9.6
       Loaded: loaded (/usr/lib/systemd/system/pgagent_96.service; disabled; vendor preset: disabled)
       Active: failed (Result: exit-code) since 2017-10-16 23:33:15 KST; 3s ago
      Process: 25928 ExecStart=/usr/bin/pgagent_96 -s ${LOGFILE} hostaddr=${DBHOST} dbname=${DBNAME} user=${DBUSER} port=${DBPORT} (code=exited, status=0/SUCCESS)
     Main PID: 25930 (code=exited, status=1/FAILURE)

    16 Oct 23:32:30 web.frank.net systemd[1]: Starting PgAgent for Postgre....
    16 Oct 23:32:30 web.frank.net systemd[1]: Started PgAgent for PostgreS....
    16 Oct 23:33:15 web.frank.net systemd[1]: pgagent_96.service: main pro...E
    16 Oct 23:33:15 web.frank.net systemd[1]: Unit pgagent_96.service ente....
    16 Oct 23:33:15 web.frank.net systemd[1]: pgagent_96.service failed.
    Hint: Some lines were ellipsized, use -l to show in full.

(2)Try to start as OS user 'frank'

    [frank@web ~]$ systemctl start pgagent_96    (Here, centos asked frank's OS password )
    [frank@web ~]$ systemctl status pgagent_96
    ● pgagent_96.service - PgAgent for PostgreSQL 9.6
       Loaded: loaded (/usr/lib/systemd/system/pgagent_96.service; disabled; vendor preset: disabled)
       Active: failed (Result: exit-code) since 월 2017-10-16 23:41:03 KST; 1min 21s ago
      Process: 26531 ExecStart=/usr/bin/pgagent_96 -s ${LOGFILE} hostaddr=${DBHOST} dbname=${DBNAME} user=${DBUSER} port=${DBPORT} (code=exited, status=0/SUCCESS)
     Main PID: 26533 (code=exited, status=1/FAILURE)

    16 Oct 23:40:18 web.frank.net systemd[1]: Starting PgAgent for Postgre....
    16 Oct 23:40:18 web.frank.net systemd[1]: Started PgAgent for PostgreS....
    16 Oct 23:41:03 web.frank.net systemd[1]: pgagent_96.service: main pro...E
    16 Oct 23:41:03 web.frank.net systemd[1]: Unit pgagent_96.service ente....
    16 Oct 23:41:03 web.frank.net systemd[1]: pgagent_96.service failed.
    Hint: Some lines were ellipsized, use -l to show in full.

(3)Try to start as OS user 'postgres'

    -bash-4.2$ systemctl start pgagent_96       (Here, centos asked frank's OS password )
    -bash-4.2$ systemctl status pgagent_96
    ● pgagent_96.service - PgAgent for PostgreSQL 9.6
       Loaded: loaded (/usr/lib/systemd/system/pgagent_96.service; disabled; vendor preset: disabled)
       Active: failed (Result: exit-code) since 월 2017-10-16 23:54:22 KST; 21s ago
      Process: 27511 ExecStart=/usr/bin/pgagent_96 -s ${LOGFILE} hostaddr=${DBHOST} dbname=${DBNAME} user=${DBUSER} port=${DBPORT} (code=exited, status=0/SUCCESS)
     Main PID: 27515 (code=exited, status=1/FAILURE)

(4) Security context of 'root' and 'frank' and 'postgres'

( root )

[root@web ~]# id
uid=0(root) gid=0(root) groups=0(root) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

( frank )

[frank@web ~]$ id
uid=1000(frank) gid=1000(frank) groups=1000(frank),10(wheel) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

( postgres )

-bash-4.2$ id
uid=26(postgres) gid=26(postgres) groups=26(postgres) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

10. Of course, I can log in database like this. But I can not use .pgpass file.

     [root@web bin]# su - postgres -bash-4.2$ psql -h localhost -U postgres psql (9.6.5) postgres=# 

11. Currently, I think this problem may be related to security context of .pgpass. pgagent_96 or systemd may not be allowed to read .pgpass file ... ( Just my guess ^^ ) I checked if pgagent_96 or systemd can read .pgpass.

(1) I set PGPASSFILE variable in /etc/profile [Content of /etc/profile]

export PGDATA=/var/lib/pgsql/9.6/data
export PGPASSFILE=/var/lib/pgsql/.pgpass

(2) Tried to start pgagent_96 changing .pgpass context type from user_home_t to postgresql_db_t, bin_t, usr_t. But I got same error.

-bash-4.2$ echo $PGPASSFILE
/var/lib/pgsql/.pgpass
-bash-4.2$ ls -alZ .pgpass
-rw-------. postgres postgres unconfined_u:object_r:postgresql_db_t:s0 .pgpass
-bash-4.2$ systemctl start pgagent_96
     ====> failed to start pgAgent_96. same error.
-bash-4.2$ chcon --type bin_t .pgpass
-bash-4.2$ ls -alZ .pgpass
-rw-------. postgres postgres unconfined_u:object_r:bin_t:s0   .pgpass
-bash-4.2$ systemctl start pgagent_96
    ====> failed to start pgAgent_96. same error.
-bash-4.2$ chcon --type usr_t .pgpass
-bash-4.2$ ls -alZ .pgpass
-rw-------. postgres postgres unconfined_u:object_r:usr_t:s0   .pgpass
-bash-4.2$ systemctl start pgagent_96
    ====> failed to start pgAgent_96. same error.

[ Security context of pgagent_96, systemd, pg_hba.conf]

[root@web frank]# ls -alZ /usr/bin/pgagent_96
-rwxr-xr-x. root root system_u:object_r:bin_t:s0   /usr/bin/pgagent_96
[root@web frank]# ls -alZ /usr/lib/systemd/systemd
-rwxr-xr-x. root root system_u:object_r:init_exec_t:s0 /usr/lib/systemd/systemd
[root@web frank]# ls -alZ /var/lib/pgsql/9.6/data/pg_hba.conf
-rw-------. postgres postgres unconfined_u:object_r:postgresql_db_t:s0 /var/lib/pgsql/9.6/data/pg_hba.conf

Now, I don't know what I should try. Help me please...

UPDATE

12. I installed postgresql 10, pgagent_10. But the result is same... I want to start pgagent using systemctl command. I'll enable pagent service to start pgagent service automatically.

Answer 1

I had the same problem with CentOS 7. My solution for you is:
as first, check some variables in the service script:

cat /usr/lib/systemd/system/pgagent_96.service

1) by default User=pgagent and Group=pgagent - this is owner/group of your .pgpass file,
you need set
chown pgagent:pgagent .pgpass
chmod 0600 .pgpass
2) next, move .pgpass file into directory where user pgagent can read this file
(/home/frank isn't redable for user pgagent, try, for example, your postgres install dir /var/lib/pgsql/9.6 or /var/lib/pgsql)
3) check variable of location of the pgagent_96 configuration,
by default EnvironmentFile=/etc/pgagent/pgagent_96.conf - you need edit this file.

Next step, open pgagent_96.conf in an editor and do make changes:
a) change value of variable DBHOST=localhost (this is important)
b) add variable PGPASSFILE=/path/your/pgpasfile/.pgpass (PGPASSFILE=/var/lib/pgsql/.pgpass)

In my case pgagent started working without problems.