/usr/bin/mysqld_safe_helper: Cannot change uid/gid (errno: 1) (转)

From: https://www.rootusers.com/how-to-fix-mariadb-10-0-29-selinux-update-failure/

安装mysql 10.0.29后，启动mysql失败：

[root@server centos]# systemctl status mysql
â mysql.service - LSB: start and stop MySQL
   Loaded: loaded (/etc/rc.d/init.d/mysql; bad; vendor preset: disabled)
   Active: failed (Result: exit-code) since Sat -- :: UTC; 4s ago
     Docs: man:systemd-sysv-generator()
  Process:  ExecStop=/etc/rc.d/init.d/mysql stop (code=exited, status=/SUCCESS)
  Process:  ExecStart=/etc/rc.d/init.d/mysql start (code=exited, status=/FAILURE)

Jan  :: server systemd[]: Starting LSB: start and stop MySQL...
Jan  :: server mysql[]: Starting MySQL. :: mysqld_safe Logging to '/var/lib/mysql/server.err'.
Jan  :: server mysql[]:  :: mysqld_safe Starting mysqld daemon with databases from /var/lib/mysql
Jan  :: server mysql[]: /usr/bin/mysqld_safe_helper: Cannot change uid/gid (errno: )
Jan  :: server mysql[]: ERROR!
Jan  :: server systemd[]: mysql.service: control process exited, code=exited status=
Jan  :: server systemd[]: Failed to start LSB: start and stop MySQL.
Jan  :: server systemd[]: Unit mysql.service entered failed state.
Jan  :: server systemd[]: mysql.service failed.

可以看到，myql服务状态是down。错误显示mysqld_safe_helper 试图更改UID/GID：

Jan  :: server mysql[]: /usr/bin/mysqld_safe_helper: Cannot change uid/gid (errno: )

根据错误提示，执行 journalctl -xe命令：

[root@server mysql]# journalctl -xe
Jan  :: server setroubleshoot[]: SELinux is preventing /usr/bin/mysqld_safe_helper from using the setgid capability. For complete SELinux messages. run sealert -l 640a7d54-35ab-43b5--db6f159e1449
Jan  :: server python[]: SELinux is preventing /usr/bin/mysqld_safe_helper from using the setgid capability.

                        *****  Plugin catchall (. confidence) suggests   **************************

                        If you believe that mysqld_safe_helper should have the setgid capability by default.
                        Then you should report this as a bug.
                        You can generate a local policy module to allow this access.
                        Do
                        allow this access for now by executing:
                        # ausearch -c 'mysqld_safe_hel' --raw | audit2allow -M my-mysqldsafehel
                        # semodule -i my-mysqldsafehel.pp

通过以上日志可以看出SELinux阻止了mysqld_safe_helper 的行为，因此mysql服务启动失败是因为SELinux的权限问题。

为了获取更多信息，执行以下命令：

[root@server mysql]# sealert -a /var/log/audit/audit.log
SELinux is preventing /usr/bin/mysqld_safe_helper from using the setuid capability.

*****  Plugin catchall (. confidence) suggests   **************************

If you believe that mysqld_safe_helper should have the setuid capability by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'mysqld_safe_hel' --raw | audit2allow -M my-mysqldsafehel
# semodule -i my-mysqldsafehel.pp

Additional Information:
Source Context                system_u:system_r:mysqld_safe_t:s0
Target Context                system_u:system_r:mysqld_safe_t:s0
Target Objects                Unknown [ capability ]
Source                        mysqld_safe_hel
Source Path                   /usr/bin/mysqld_safe_helper
Port
Host
Source RPM Packages           MariaDB-server-10.0.-.el7.centos.x86_64
Target RPM Packages
Policy RPM                    selinux-policy-3.13.-.el7_3..noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     server
Platform                      Linux server
                              3.10.-514.2..el7.x86_64 # SMP Tue Dec
                              :: UTC  x86_64 x86_64
Alert Count
First Seen                    -- :: UTC
Last Seen                     -- :: UTC
Local ID                      f3462d4b-ed6b-4e94--7ab0970c0af0

Raw Audit Messages
type=AVC msg=audit(1484389402.769:): avc:  denied  { setuid } for  pid= comm="mysqld_safe_hel" capability=  scontext=system_u:system_r:mysqld_safe_t:s0 tcontext=system_u:system_r:mysqld_safe_t:s0 tclass=capability

type=SYSCALL msg=audit(1484389402.769:): arch=x86_64 syscall=setuid success=no exit=EPERM a0=3e4 a1=3e4 a2=7f2c90e772e0 a3=7f2c90e772e0 items= ppid= pid= auid= uid= gid= euid= suid= fsuid= egid= sgid= fsgid= tty=(none) ses= comm=mysqld_safe_hel exe=/usr/bin/mysqld_safe_helper subj=system_u:system_r:mysqld_safe_t:s0 key=(null)

Hash: mysqld_safe_hel,mysqld_safe_t,mysqld_safe_t,capability,setuid

根据以上建议，执行建议中的命令创建本地策略：

ausearch -c 'mysqld_safe_hel' --raw | audit2allow -M my-mysqldsafehel
semodule -i my-mysqldsafehel.pp

再次启动mysql服务，仍然失败。查看错误信息，仍是关于SELinux的：

SELinux is preventing /usr/bin/mysqld_safe_helper from using the setgid capability.

仍然按照以上步骤，执行建议命令。然后，再次重启mysql服务：

[root@server ~]# systemctl restart mysql
[root@server ~]# systemctl status mysql.service -l
â mysql.service - LSB: start and stop MySQL
   Loaded: loaded (/etc/rc.d/init.d/mysql; bad; vendor preset: disabled)
   Active: active (running) since Sat -- :: UTC; 29min ago

当然我们可以通过执行以下命令，通过临时关闭SELinux，解决这个问题：

setenforce 

但是如果想要永久解决该问题，并保证系统的安全，还是建议通过添加SELinux策略的方式解决启动服务失败的问题。