PostgreSQL not working after creating a symbolic link on the pg_hba.conf file

Question

I'm trying to create a symbolic link on /var/lib/pgsql/data/pg_hba.conf (default path on Fedora) pointing to the real file located somewhere else, for example /var/lib/pgsql/data/pg_hba.conf -> /home/pg_hba.conf (command for this example: sudo ln -sf /home/pg_hba.conf /var/lib/pgsql/data/pg_hba.conf).

I set /home/pg_hba.conf permissions (-rw-------), owner (postgres) and group (postgres) to be just like the original /var/lib/pgsql/data/pg_hba.conf file, I even tried to chmod 777. When I switch to user postgres and I cat /var/lib/pgsql/data/pg_hba.conf (which is now a symlink) it successfully prints the content of the /home/pg_hba.conf file.

However when I try to apply the changes by doing sudo systemctl restart postgresql I get the following error

Job for postgresql.service failed because the control process exited with error code.

See "systemctl status postgresql.service" and "journalctl -xeu postgresql.service" for details.

I checked the logs but there's no other useful information.

It's only working when I point my symlink to a file in the same directory (/var/lib/pgsql/data/) which is totally useless (ex: /var/lib/pgsql/data/pg_hba.conf -> /var/lib/pgsql/data/pg_hba.conf.bak)

If I point to anywhere else it doesn't work, even in /var/lib/pgsql which is actually the Home directory of the postgres user!

I'm new to Linux so I tried to create a symbolic link with my ~/.bashrc file just for the sake of trying (ex: ~./bashrc -> /home/.bashrc) I wrote an echo "TEST!" inside this file and applied the new configuration with . ~/.bashrc and it works just fine, my TEST! is successfully printed out.

So what's the deal with PostgreSQL? How can I fix this error and keep a symbolic link on the pg_hba.conf file?

Thanks for your answers

Answer 1

Well, after more research about this issue, turns out the root cause comes from SELinux.

I managed to get it working by completely disabling SELinux (obviously not recommended)

/usr/bin/setenforce Permissive

I've also tried with chcon and semanage (documentation) but without any success

chcon -R -t postgresql_db_t /home
semanage fcontext -a -t postgresql_db_t /home

If anybody knows how to do this without completely disabling SELinux I'd be really interested to know.

Obviously fighting against SELinux is not the way to go so I'm giving up what I was trying to achieve but that was very interesting to learn (I've never heard of SELinux before). Even if my answer is just explaining the root cause without giving the fix, I think this is much more constructive than a "trust me bro, don't do this"...