問題描述：

在新裝的CentOS7上，安裝了MongoDB3.4，掛載了一個大的數據盤后，修改/etc/mongo.conf，將配置文件中的log和data目錄放在新的數據盤下，并修改文件的訪問權限。改完后的mongo.conf:

# mongod.conf# for documentation of all options, see: # http://docs.mongodb.org/manual/reference/configuration-options/# where to write logging data. systemLog:destination: filelogAppend: truepath: /data/mongodb/log/mongod.log# Where and how to store data. storage:dbPath: /data/mongodb/data .....

文件權限：

# ls -alh drwxr-xr-x. 5 mongod mongod 4.0K 11月 1 14:53 mongodb# cd mongodb # ls -alh drwxr-xr-x. 3 mongod mongod 4.0K 11月 9 19:08 data drwxr-xr-x. 2 mongod mongod 4.0K 11月 9 19:06 log drwxr-xr-x. 2 mongod mongod 4.0K 11月 1 14:54 run

執行systemctl start mongod命令后，查看狀態發現并沒有啟動，查看/var/log/message，發現以下錯誤

Nov 9 06:06:44 [localhost] setroubleshoot: failed to retrieve rpm info for /data/mongodb/run/mongod.pid Nov 9 06:06:44 [localhost] setroubleshoot: SELinux is preventing /usr/bin/mongod from write access on the file /data/mongodb/run/mongod.pid. For complete SELinux messages run: sealert -l f7148e11-b126-401e-ba9f-a9a87c1e54ae Nov 9 06:06:44 [localhost] python: SELinux is preventing /usr/bin/mongod from write access on the file /data/mongodb/run/mongod.pid.#012#012***** Plugin restorecon (94.8 confidence) suggests ************************#012#012If you want to fix the label. #012/data/mongodb/run/mongod.pid default label should be default_t.#012Then you can run restorecon.#012Do#012# /sbin/restorecon -v /data/mongodb/run/mongod.pid#012#012***** Plugin catchall_labels (5.21 confidence) suggests *******************#012#012If you want to allow mongod to have write access on the mongod.pid file#012Then you need to change the label on /data/mongodb/run/mongod.pid#012Do#012# semanage fcontext -a -t FILE_TYPE '/data/mongodb/run/mongod.pid'#012where FILE_TYPE is one of the following: afs_cache_t, initrc_tmp_t, mongod_log_t, mongod_tmp_t, mongod_var_lib_t, mongod_var_run_t, puppet_tmp_t, user_cron_spool_t.#012Then execute:#012restorecon -v '/data/mongodb/run/mongod.pid'#012#012#012***** Plugin catchall (1.44 confidence) suggests **************************#012#012If you believe that mongod should be allowed write access on the mongod.pid file by default.#012Then you should report this as a bug.#012You can generate a local policy module to allow this access.#012Do#012allow this access for now by executing:#012# ausearch -c 'mongod' --raw | audit2allow -M my-mongod#012# semodule -i my-mongod.pp#012

從提示中可以看出是SELinux的防護功能，阻止了訪問。

解決過程：

/var/log/message中的信息看起來比較費勁，里面有一句提示：

For complete SELinux messages run: sealert -l e73ba9e8-f74d-4835-9b53-85667546b28c

根據提示執行：

# sealert -l e73ba9e8-f74d-4835-9b53-85667546b28c SELinux is preventing /usr/bin/mongod from write access on the directory /data/mongodb/log.***** Plugin catchall_labels (83.8 confidence) suggests *******************If you want to allow mongod to have write access on the log directory Then 必須更改 /data/mongodb/log 中的標簽 Do # semanage fcontext -a -t FILE_TYPE '/data/mongodb/log' 其中 FILE_TYPE 為以下內容之一：mongod_log_t, mongod_tmp_t, mongod_var_lib_t, mongod_var_run_t, tmp_t, var_lib_t, var_log_t, var_run_t。 然后執行： restorecon -v '/data/mongodb/log'***** Plugin catchall (17.1 confidence) suggests ************************** ......

上面提示輸出中已經包含了，解決方法：

# semanage fcontext -a -t mongo_log_t '/data/mongodb/log' # restorecon -v '/data/mongodb/log' restorecon reset /data/mongodb/log context unconfined_u:object_r:unlabeled_t:s0->unconfined_u:object_r:mongod_log_t:s0

上面命令執行完畢后，就解決了/data/mongodb/log目錄的文件權限問題。

同樣的方法，再解決/data/mongodb/data和/data/mongodb/run目錄的問題。

啟動mongod，問題解決。

Nov 9 06:08:51 [localhost] systemd: Starting High-performance, schema-free document-oriented database... Nov 9 06:08:51 [localhost] systemd: Started High-performance, schema-free document-oriented database. Nov 9 06:08:51 [localhost] mongod: about to fork child process, waiting until server is ready for connections. Nov 9 06:08:51 [localhost] mongod: forked process: 18218 Nov 9 06:08:51 [localhost] mongod: child process started successfully, parent exiting

P.S. 除了上面通過提示信息解決問題外，還有一個比較暴力的方法，直接關閉SELinux，但是不太建議。

# setenforce 0 # getenforce Permissive

上面是臨時關閉，如果是永久關閉，就需要編輯/etc/selinux/config文件，將SELINUX=enforcing改為SELINUX=disabled，但是只有重啟后才會發揮作用。

總結

以上是生活随笔為你收集整理的CentOS7 SELinux阻止MongoDB启动的问题的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。