Install MongoDB Enterprise on Red Hat or CentOS using .tgz Tarball

To Use Default Directories

By default, MongoDB runs using the mongod user account and uses the following default directories:

• /var/lib/mongo (the data directory)

• /var/log/mongodb (the log directory)

Create the MongoDB data and log directories:

sudo mkdir -p /var/lib/mongo
sudo mkdir -p /var/log/mongodb

By default, MongoDB runs using the mongod user account. Create a mongod and a mongodb group. Ensure that the mongod belongs to the group then set the owner and group of these directories to mongod:

sudo chown -R mongod:mongodb /var/lib/mongo
sudo chown -R mongod:mongodb /var/log/mongodb

To Use Non-Default Directories

To use a data directory and/or log directory other than the default directories:

1. Create the new directory or directories.

2. Edit the configuration file /etc/mongod.conf and modify the following fields accordingly:

   • storage.dbPath to specify a new data directory path (e.g. /some/data/directory)

   • systemLog.path to specify a new log file path (e.g. /some/log/directory/mongod.log)

3. Ensure that the user running MongoDB has access to the directory or directories:

   sudo chown -R mongod:mongod <directory>

   If you change the user that runs the MongoDB process, you must give the new user access to these directories.

4. Configure SELinux if enforced. See Configure SELinux.

Permit Access to cgroup

The current SELinux Policy does not allow the MongoDB process to access /sys/fs/cgroup, which is required to determine the available memory on your system. If you intend to run SELinux in enforcing mode, you will need to make the following adjustment to your SELinux policy:

1. Ensure your system has the checkpolicy package installed:

   sudo yum install checkpolicy

2. Create a custom policy file mongodb_cgroup_memory.te:

   cat > mongodb_cgroup_memory.te <<EOF
   module mongodb_cgroup_memory 1.0;
   require {
         type cgroup_t;
         type mongod_t;
         class dir search;
         class file { getattr open read };
   }
   #============= mongod_t ==============
   allow mongod_t cgroup_t:dir search;
   allow mongod_t cgroup_t:file { getattr open read };
   EOF

3. Once created, compile and load the custom policy module by running these three commands:

   checkmodule -M -m -o mongodb_cgroup_memory.mod mongodb_cgroup_memory.te
   semodule_package -o mongodb_cgroup_memory.pp -m mongodb_cgroup_memory.mod
   sudo semodule -i mongodb_cgroup_memory.pp

The MongoDB process is now able to access the correct files with SELinux set to enforcing.

Permit Access to netstat for FTDC

The current SELinux Policy does not allow the MongoDB process to open and read /proc/net/netstat, which is required for Full Time Diagnostic Data Capture (FTDC). If you intend to run SELinux in enforcing mode, you will need to make the following adjustment to your SELinux policy:

1. Ensure your system has the checkpolicy package installed:

   sudo yum install checkpolicy

2. Create a custom policy file mongodb_proc_net.te:

   cat > mongodb_proc_net.te <<EOF
   module mongodb_proc_net 1.0;
   require {
       type cgroup_t;
       type configfs_t;
       type file_type;
       type mongod_t;
       type proc_net_t;
       type sysctl_fs_t;
       type var_lib_nfs_t;
       class dir { search getattr };
       class file { getattr open read };
   }
   #============= mongod_t ==============
   allow mongod_t cgroup_t:dir { search getattr } ;
   allow mongod_t cgroup_t:file { getattr open read };
   allow mongod_t configfs_t:dir getattr;
   allow mongod_t file_type:dir { getattr search };
   allow mongod_t file_type:file getattr;
   allow mongod_t proc_net_t:file { open read };
   allow mongod_t sysctl_fs_t:dir search;
   allow mongod_t var_lib_nfs_t:dir search;
   EOF

3. Once created, compile and load the custom policy module by running these three commands:

   checkmodule -M -m -o mongodb_proc_net.mod mongodb_proc_net.te
   semodule_package -o mongodb_proc_net.pp -m mongodb_proc_net.mod
   sudo semodule -i mongodb_proc_net.pp

Using a Custom MongoDB Directory Path

1. Update the SELinux policy to allow the mongod service to use the new directory:

   sudo semanage fcontext -a -t <type> </some/MongoDB/directory.*>

   where specify one of the following types as appropriate:

   • mongod_var_lib_t for data directory

   • mongod_log_t for log file directory

   • mongod_var_run_t for pid file directory

   Note

   Be sure to include the .* at the end of the directory.

2. Update the SELinux user policy for the new directory:

   sudo chcon -Rv -u system_u -t <type> </some/MongoDB/directory>

   where specify one of the following types as appropriate:

   • mongod_var_lib_t for data directory

   • mongod_log_t for log directory

   • mongod_var_run_t for pid file directory

3. Apply the updated SELinux policies to the directory:

   sudo restorecon -R -v </some/MongoDB/directory>

For example:

• If using a non-default MongoDB data path of /mongodb/data:

  sudo semanage fcontext -a -t mongod_var_lib_t '/mongodb/data.*'
  sudo chcon -Rv -u system_u -t mongod_var_lib_t '/mongodb/data'
  sudo restorecon -R -v '/mongodb/data'

• If using a non-default MongoDB log directory of /mongodb/log (e.g. if the log file path is /mongodb/log/mongod.log):

  sudo semanage fcontext -a -t mongod_log_t '/mongodb/log.*'
  sudo chcon -Rv -u system_u -t mongod_log_t '/mongodb/log'
  sudo restorecon -R -v '/mongodb/log'

Using a Custom MongoDB Port

sudo semanage port -a -t mongod_port_t -p tcp <portnumber>