Install MongoDB Enterprise Edition on Red Hat or CentOS¶

By default, MongoDB runs using the mongod user account and uses the following default directories:

• /var/lib/mongo (the data directory)
• /var/log/mongodb (the log directory)

➤ If you installed via the package manager,

The default directories are created, and the owner and group for these directories are set to mongod.

➤ If you installed by downloading the tarballs,

The default MongoDB directories are not created. To create the MongoDB data and log directories:

sudo mkdir -p /var/lib/mongo
sudo mkdir -p /var/log/mongodb

By default, MongoDB runs using the mongod user account. Once created, set the owner and group of these directories to mongod:

sudo chown -R mongod:mongod <directory>

To use a data directory and/or log directory other than the default directories:

1. Create the new directory or directories.
2. Edit the configuration file /etc/mongod.conf and modify the following fields accordingly:
   • storage.dbPath to specify a new data directory path (e.g. /some/data/directory)
   • systemLog.path to specify a new log file path (e.g. /some/log/directory/mongod.log)
3. Ensure that the user running MongoDB has access to the directory or directories:

   sudo chown -R mongod:mongod <directory>

   If you change the user that runs the MongoDB process, you must give the new user access to these directories.

4. Configure SELinux if enforced. See Configure SELinux.

The current SELinux Policy does not allow the MongoDB process to access /sys/fs/cgroup, which is required to determine the available memory on your system. If you intend to run SELinux in enforcing mode, you will need to make the following adjustment to your SELinux policy:

1. Ensure your system has the checkpolicy package installed:

   sudo yum install checkpolicy

2. Create a custom policy file mongodb_cgroup_memory.te:

   cat > mongodb_cgroup_memory.te <<EOF
   module mongodb_cgroup_memory 1.0;
   
   require {
   type cgroup_t;
   type mongod_t;
   class dir search;
   class file { getattr open read };
   }
   
   #============= mongod_t ==============
   allow mongod_t cgroup_t:dir search;
   allow mongod_t cgroup_t:file { getattr open read };
   EOF

3. Once created, compile and load the custom policy module by running these three commands:

   checkmodule -M -m -o mongodb_cgroup_memory.mod mongodb_cgroup_memory.te
   semodule_package -o mongodb_cgroup_memory.pp -m mongodb_cgroup_memory.mod
   sudo semodule -i mongodb_cgroup_memory.pp

The MongoDB process is now able to access the correct files with SELinux set to enforcing.

The current SELinux Policy does not allow the MongoDB process to open and read /proc/net/netstat, which is required for Full Time Diagnostic Data Capture (FTDC). If you intend to run SELinux in enforcing mode, you will need to make the following adjustment to your SELinux policy:

1. Ensure your system has the checkpolicy package installed:

   sudo yum install checkpolicy

2. Create a custom policy file mongodb_proc_net.te:

   cat > mongodb_proc_net.te <<EOF
   module mongodb_proc_net 1.0;
   
   require {
   type proc_net_t;
   type mongod_t;
   class file { open read };
   }
   
   #============= mongod_t ==============
   allow mongod_t proc_net_t:file { open read };
   EOF

3. Once created, compile and load the custom policy module by running these three commands:

   checkmodule -M -m -o mongodb_proc_net.mod mongodb_proc_net.te
   semodule_package -o mongodb_proc_net.pp -m mongodb_proc_net.mod
   sudo semodule -i mongodb_proc_net.pp

1. Update the SELinux policy to allow the mongod service to use the new directory:

   sudo semanage fcontext -a -t <type> </some/MongoDB/directory.*>

   where specify one of the following types as appropriate:

   • mongod_var_lib_t for data directory
   • mongod_log_t for log file directory
   • mongod_var_run_t for pid file directory

   Note

   Be sure to include the .* at the end of the directory.

2. Update the SELinux user policy for the new directory:

   sudo chcon -Rv -u system_u -t <type> </some/MongoDB/directory>

   where specify one of the following types as appropriate:

   • mongod_var_lib_t for data directory
   • mongod_log_t for log directory
   • mongod_var_run_t for pid file directory
3. Apply the updated SELinux policies to the directory:

   restorecon -R -v </some/MongoDB/directory>

For example:例如：

• If using a non-default MongoDB data path of /mongodb/data:

  sudo semanage fcontext -a -t mongod_var_lib_t '/mongodb/data.*'
  sudo chcon -Rv -u system_u -t mongod_var_lib_t '/mongodb/data'
  restorecon -R -v '/mongodb/data'

• If using a non-default MongoDB log directory of /mongodb/log (e.g. if the log file path is /mongodb/log/mongod.log):

  sudo semanage fcontext -a -t mongod_log_t '/mongodb/log.*'
  sudo chcon -Rv -u system_u -t mongod_log_t '/mongodb/log'
  restorecon -R -v '/mongodb/log'