PostgreSQL WAL log shipping does not work on Fedora 6 with SE Linux enabled... no error message. What gives?

[Aleksey Tsalolikhin]

Hi.  I am trying to enable WAL log shipping on our PostgreSQL 8.1.10
(upgrade to 8.3.7 is in the works) running on Fedora Core 6 (upgrade
to a more recent version is in the works).

My PostgreSQL archive_command is 'rsync %p postgres@node2:/file/to/$f
</dev/null'

This works fine only if and only if SE Linux is disabled on node 1
(the source node).

I used audit2allow on the SELinux messages, and generated an SE Linux
module to allow
Postgres to rsync the files out...

allow postgresql_t ssh_exec_t:file { read execute execute_no_trans };
allow postgresql_t ssh_port_t:tcp_socket name_connect;
allow postgresql_t user_home_t:dir { search getattr };
allow postgresql_t user_home_t:file { read getattr };

But the automated rsync by PostgreSQL still does now work.  (Works
fine if I disable SELinux, by the way.)

The error I get in the PostgreSQL log is:

LOG:  archive command "/usr/local/bin/rsync -e /usr/bin/ssh
pg_xlog/000000010000001D00000015
postgres@node2:WAL/000000010000001D00000015 </dev/null" failed: return
code 65280
Could not create directory '/home/postgres/.ssh'.
Host key verification failed.
rsync: connection unexpectedly closed (0 bytes received so far) [sender]
rsync error: unexplained error (code 255) at io.c(632) [sender=3.0.4]

If anybody has any clue as to whats going on here, I would sure
appreciate your help.

"ssh node2" works fine from node1, I log in using key-based authentication

What stumps me is there are no further complaints from SELinux in any
log, but clearly SELinux is blocking the connection.

Thanks,
-at

[Aleksey Tsalolikhin]

I remembered SELinux protects /home directories especially.

So I moved "postgres" user's home directory from /home/postgres
to /data/postgres, and the WAL rsync works now under SELinux.

Thanks!
Aleksey