<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h3 class="title">
      <a name="selinux-file-context">
      </a>
      8.7.4 SELinux File Context
     </h3>
    </div>
   </div>
  </div>
  <a class="indexterm" name="idm46045231610304">
  </a>
  <p>
   The MySQL Server reads from and writes to many files. If the
      SELinux context is not set correctly for these files, access to
      the files could be denied.
  </p>
  <p>
   The instructions that follow use the
   <code class="literal">
    semanage
   </code>
   binary to manage file context; on RHEL, it's part of the
   <code class="literal">
    policycoreutils-python-utils
   </code>
   package:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting one-line language-terminal"><div class="docs-select-all right" id="sa33778886"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">yum install <span class="token property">-y</span> policycoreutils-python-utils</code></pre>
  </div>
  <p>
   After installing the
   <code class="literal">
    semanage
   </code>
   binary, you can
      list MySQL file contexts using
   <code class="literal">
    semanage
   </code>
   with
      the
   <code class="literal">
    fcontext
   </code>
   option.
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting one-line language-terminal"><div class="docs-select-all right" id="sa60693652"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">semanage fcontext <span class="token property">-l</span> | grep <span class="token property">-i</span> mysql</code></pre>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h4 class="title">
       <a name="selinux-context-data-dir">
       </a>
       Setting the MySQL Data Directory Context
      </h4>
     </div>
    </div>
   </div>
   <a class="indexterm" name="idm46045231600432">
   </a>
   <p>
    The default data directory location is
    <code class="filename">
     /var/lib/mysql/
    </code>
    ; and the SELinux context
        used is
    <code class="literal">
     mysqld_db_t
    </code>
    .
   </p>
   <p>
    If you edit the configuration file to use a different location
        for the data directory, or for any of the files normally in the
        data directory (such as the binary logs), you may need to set
        the context for the new location. For example:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa11768816"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">semanage fcontext <span class="token property">-a</span> <span class="token property">-t</span> mysqld_db_t <span class="token atrule">"/path/to/my/custom/datadir(/.*)?"</span>
restorecon <span class="token property">-Rv</span> /path/to/my/custom/datadir

semanage fcontext <span class="token property">-a</span> <span class="token property">-t</span> mysqld_db_t <span class="token atrule">"/path/to/my/custom/logdir(/.*)?"</span>
restorecon <span class="token property">-Rv</span> /path/to/my/custom/logdir</code></pre>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h4 class="title">
       <a name="selinux-context-error-log">
       </a>
       Setting the MySQL Error Log File Context
      </h4>
     </div>
    </div>
   </div>
   <a class="indexterm" name="idm46045231593808">
   </a>
   <p>
    The default location for RedHat RPMs is
    <code class="filename">
     /var/log/mysqld.log
    </code>
    ; and the SELinux
        context type used is
    <code class="literal">
     mysqld_log_t
    </code>
    .
   </p>
   <p>
    If you edit the configuration file to use a different location,
        you may need to set the context for the new location. For
        example:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa57333900"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">semanage fcontext <span class="token property">-a</span> <span class="token property">-t</span> mysqld_log_t <span class="token atrule">"/path/to/my/custom/error.log"</span>
restorecon <span class="token property">-Rv</span> /path/to/my/custom/error<span class="token punctuation">.</span>log</code></pre>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h4 class="title">
       <a name="selinux-context-pid-file">
       </a>
       Setting the PID File Context
      </h4>
     </div>
    </div>
   </div>
   <a class="indexterm" name="idm46045231587536">
   </a>
   <p>
    The default location for the PID file is
    <code class="filename">
     /var/run/mysqld/mysqld.pid
    </code>
    ; and the SELinux
        context type used is
    <code class="literal">
     mysqld_var_run_t
    </code>
    .
   </p>
   <p>
    If you edit the configuration file to use a different location,
        you may need to set the context for the new location. For
        example:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa46590078"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">semanage fcontext <span class="token property">-a</span> <span class="token property">-t</span> mysqld_var_run_t <span class="token atrule">"/path/to/my/custom/pidfile/directory/.*?"</span>
restorecon <span class="token property">-Rv</span> /path/to/my/custom/pidfile/directory</code></pre>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h4 class="title">
       <a name="selinux-context-unix-domain-socket">
       </a>
       Setting the Unix Domain Socket Context
      </h4>
     </div>
    </div>
   </div>
   <a class="indexterm" name="idm46045231581120">
   </a>
   <p>
    The default location for the Unix domain socket is
    <code class="filename">
     /var/lib/mysql/mysql.sock
    </code>
    ; and the SELinux
        context type used is
    <code class="literal">
     mysqld_var_run_t
    </code>
    .
   </p>
   <p>
    If you edit the configuration file to use a different location,
        you may need to set the context for the new location. For
        example:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa72850745"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">semanage fcontext <span class="token property">-a</span> <span class="token property">-t</span> mysqld_var_run_t <span class="token atrule">"/path/to/my/custom/mysql\.sock"</span>
restorecon <span class="token property">-Rv</span> /path/to/my/custom/mysql<span class="token punctuation">.</span>sock</code></pre>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h4 class="title">
       <a name="selinux-context-secure-file-priv">
       </a>
       Setting the secure_file_priv Directory Context
      </h4>
     </div>
    </div>
   </div>
   <a class="indexterm" name="idm46045231574720">
   </a>
   <p>
    For MySQL versions since 5.6.34, 5.7.16, and 8.0.11.
   </p>
   <p>
    Installing the MySQL Server RPM creates a
    <code class="filename">
     /var/lib/mysql-files/
    </code>
    directory but does
        not set the SELinux context for it. The
    <code class="filename">
     /var/lib/mysql-files/
    </code>
    directory is intended
        to be used for operations such as
    <code class="literal">
     SELECT ... INTO
        OUTFILE
    </code>
    .
   </p>
   <p>
    If you enabled the use of this directory by setting
    <code class="literal">
     secure_file_priv
    </code>
    , you may need to set the
        context like so:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa94966940"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">semanage fcontext <span class="token property">-a</span> <span class="token property">-t</span> mysqld_db_t <span class="token atrule">"/var/lib/mysql-files/(/.*)?"</span>
restorecon <span class="token property">-Rv</span> /var/lib/mysql-files</code></pre>
   </div>
   <p>
    Edit this path if you used a different location. For security
        purposes, this directory should never be within the data
        directory.
   </p>
   <p>
    For more information about this variable, see the
    <a class="link" href="server-system-variables.html#sysvar_secure_file_priv">
     <code class="literal">
      secure_file_priv
     </code>
    </a>
    documentation.
   </p>
  </div>
 </div>
 <br/>
</div>
