<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h3 class="title">
      <a name="selinux-troubleshooting">
      </a>
      8.7.6 Troubleshooting SELinux
     </h3>
    </div>
   </div>
  </div>
  <a class="indexterm" name="idm46045231512576">
  </a>
  <p>
   Troubleshooting SELinux typically involves placing SELinux into
      permissive mode, rerunning problematic operations, checking for
      access denial messages in the SELinux audit log, and placing
      SELinux back into enforcing mode after problems are resolved.
  </p>
  <p>
   To avoid placing the entire system into permissive mode using
   <span class="command">
    <strong>
     setenforce
    </strong>
   </span>
   , you can permit only the MySQL
      service to run permissively by placing its SELinux domain
      (
   <code class="filename">
    mysqld_t
   </code>
   ) into permissive mode using the
   <span class="command">
    <strong>
     semanage
    </strong>
   </span>
   command:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting one-line language-terminal"><div class="docs-select-all right" id="sa72910845"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">semanage permissive <span class="token property">-a</span> mysqld_t</code></pre>
  </div>
  <p>
   When you are finished troubleshooting, use this command to place
      the
   <code class="literal">
    mysqld_t
   </code>
   domain back into enforcing mode:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting one-line language-terminal"><div class="docs-select-all right" id="sa10145374"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">semanage permissive <span class="token property">-d</span> mysqld_t</code></pre>
  </div>
  <p>
   SELinux writes logs for denied operations to
   <code class="filename">
    /var/log/audit/audit.log
   </code>
   . You can check for
      denials by searching for
   <span class="quote">
    “
    <span class="quote">
     denied
    </span>
    ”
   </span>
   messages.
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting one-line language-simple"><div class="docs-select-all right" id="sa54104283"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-simple">grep "denied" <span class="token operator">/</span>var<span class="token operator">/</span>log<span class="token operator">/</span>audit<span class="token operator">/</span>audit<span class="token punctuation">.</span>log</code></pre>
  </div>
  <p>
   The following sections describes a few common areas where
      SELinux-related issues may be encountered.
  </p>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h4 class="title">
       <a name="selinux-troubleshooting-file-contexts">
       </a>
       File Contexts
      </h4>
     </div>
    </div>
   </div>
   <p>
    If a MySQL directory or file has an incorrect SELinux context,
        access may be denied. This issue can occur if MySQL is
        configured to read from or write to a non-default directory or
        file. For example, if you configure MySQL to use a non-default
        data directory, the directory may not have the expected SELinux
        context.
   </p>
   <p>
    Attempting to start the MySQL service on a non-default data
        directory with an invalid SELinux context causes the following
        startup failure.
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa61082054"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">systemctl</span> start mysql<span class="token punctuation">.</span>service
Job for mysqld<span class="token punctuation">.</span>service failed because the control process exited with error code<span class="token punctuation">.</span>
See <span class="token atrule">"systemctl status mysqld.service"</span> and <span class="token atrule">"journalctl -xe"</span> for details<span class="token punctuation">.</span></code></pre>
   </div>
   <p>
    In this case, a
    <span class="quote">
     “
     <span class="quote">
      denial
     </span>
     ”
    </span>
    message is logged to
    <code class="filename">
     /var/log/audit/audit.log
    </code>
    :
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa2640654"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">grep</span> <span class="token atrule">"denied"</span> /var/log/audit/audit<span class="token punctuation">.</span>log
type<span class="token attr-value"><span class="token punctuation">=</span>AVC</span> msg<span class="token attr-value"><span class="token punctuation">=</span>audit(1587133719.786:194):</span> avc<span class="token punctuation">:</span>  denied  <span class="token punctuation">{</span> write <span class="token punctuation">}</span> for  pid<span class="token attr-value"><span class="token punctuation">=</span>7133</span> comm=<span class="token atrule">"mysqld"</span>
name=<span class="token atrule">"mysql"</span> dev=<span class="token atrule">"dm-0"</span> ino<span class="token attr-value"><span class="token punctuation">=</span>51347078</span> scontext<span class="token attr-value"><span class="token punctuation">=</span>system_u:system_r:mysqld_t:s0</span>
tcontext<span class="token attr-value"><span class="token punctuation">=</span>unconfined_u:object_r:default_t:s0</span> tclass<span class="token attr-value"><span class="token punctuation">=</span>dir</span> permissive<span class="token attr-value"><span class="token punctuation">=</span>0</span></code></pre>
   </div>
   <p>
    For information about setting the proper SELinux context for
        MySQL directories and files, see
    <a class="xref" href="selinux-file-context.html" title="8.7.4 SELinux File Context">
     Section 8.7.4, “SELinux File Context”
    </a>
    .
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h4 class="title">
       <a name="selinux-troubleshooting-port-access">
       </a>
       Port Access
      </h4>
     </div>
    </div>
   </div>
   <p>
    SELinux expects services such as MySQL Server to use specific
        ports. Changing ports without updating the SELinux policies may
        cause a service failure.
   </p>
   <p>
    The
    <code class="literal">
     mysqld_port_t
    </code>
    port type defines the ports
        that the MySQL listens on. If you configure the MySQL Server to
        use a non-default port, such as port 3307, and do not update the
        policy to reflect the change, the MySQL service fails to start:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa52647986"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">systemctl</span> start mysqld<span class="token punctuation">.</span>service
Job for mysqld<span class="token punctuation">.</span>service failed because the control process exited with error code<span class="token punctuation">.</span>
See <span class="token atrule">"systemctl status mysqld.service"</span> and <span class="token atrule">"journalctl -xe"</span> for details<span class="token punctuation">.</span></code></pre>
   </div>
   <p>
    In this case, a denial message is logged to
    <code class="filename">
     /var/log/audit/audit.log
    </code>
    :
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa95531422"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">grep</span> <span class="token atrule">"denied"</span> /var/log/audit/audit<span class="token punctuation">.</span>log
type<span class="token attr-value"><span class="token punctuation">=</span>AVC</span> msg<span class="token attr-value"><span class="token punctuation">=</span>audit(1587134375.845:198):</span> avc<span class="token punctuation">:</span>  denied  <span class="token punctuation">{</span> name_bind <span class="token punctuation">}</span> for  pid<span class="token attr-value"><span class="token punctuation">=</span>7340</span>
comm=<span class="token atrule">"mysqld"</span> src<span class="token attr-value"><span class="token punctuation">=</span>3307</span> scontext<span class="token attr-value"><span class="token punctuation">=</span>system_u:system_r:mysqld_t:s0</span>
tcontext<span class="token attr-value"><span class="token punctuation">=</span>system_u:object_r:unreserved_port_t:s0</span> tclass<span class="token attr-value"><span class="token punctuation">=</span>tcp_socket</span> permissive<span class="token attr-value"><span class="token punctuation">=</span>0</span></code></pre>
   </div>
   <p>
    For information about setting the proper SELinux port context
        for MySQL, see
    <a class="xref" href="selinux-context-tcp-port.html" title="8.7.5 SELinux TCP Port Context">
     Section 8.7.5, “SELinux TCP Port Context”
    </a>
    .
        Similar port access issues can occur when enabling MySQL
        features that use ports that are not defined with the required
        context. For more information, see
    <a class="xref" href="selinux-context-mysql-feature-ports.html" title="8.7.5.2 Setting the TCP Port Context for MySQL Features">
     Section 8.7.5.2, “Setting the TCP Port Context for MySQL Features”
    </a>
    .
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h4 class="title">
       <a name="selinux-troubleshooting-app-changes">
       </a>
       Application Changes
      </h4>
     </div>
    </div>
   </div>
   <p>
    SELinux may not be aware of application changes. For example, a
        new release, an application extension, or a new feature may
        access system resources in a way that is not permitted by
        SELinux, resulting in access denials. In such cases, you can use
        the
    <span class="command">
     <strong>
      audit2allow
     </strong>
    </span>
    utility to create custom
        policies to permit access where it is required. The typical
        method for creating custom policies is to change the SELinux
        mode to permissive, identify access denial messages in the
        SELinux audit log, and use the
    <span class="command">
     <strong>
      audit2allow
     </strong>
    </span>
    utility to create custom policies to permit access.
   </p>
   <p>
    For information about using the
    <span class="command">
     <strong>
      audit2allow
     </strong>
    </span>
    utility, refer to your distribution's SELinux documentation.
   </p>
   <p>
    If you encounter access issues for MySQL that you believe should
        be handled by standard MySQL SELinux policy modules, please open
        a bug report in your distribution's bug tracking system.
   </p>
  </div>
 </div>
 <br/>
</div>
