<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h2 class="title">
      <a name="selinux">
      </a>
      8.7 SELinux
     </h2>
    </div>
   </div>
  </div>
  <div class="toc">
   <dl class="toc">
    <dt>
     <span class="section">
      <a href="selinux-checking.html">
       8.7.1 Check if SELinux is Enabled
      </a>
     </span>
    </dt>
    <dt>
     <span class="section">
      <a href="selinux-mode.html">
       8.7.2 Changing the SELinux Mode
      </a>
     </span>
    </dt>
    <dt>
     <span class="section">
      <a href="selinux-policies.html">
       8.7.3 MySQL Server SELinux Policies
      </a>
     </span>
    </dt>
    <dt>
     <span class="section">
      <a href="selinux-file-context.html">
       8.7.4 SELinux File Context
      </a>
     </span>
    </dt>
    <dt>
     <span class="section">
      <a href="selinux-context-tcp-port.html">
       8.7.5 SELinux TCP Port Context
      </a>
     </span>
    </dt>
    <dt>
     <span class="section">
      <a href="selinux-troubleshooting.html">
       8.7.6 Troubleshooting SELinux
      </a>
     </span>
    </dt>
   </dl>
  </div>
  <a class="indexterm" name="idm46045231672656">
  </a>
  <p>
   Security-Enhanced Linux (SELinux) is a mandatory access control
    (MAC) system that implements access rights by applying a security
    label referred to as an
   <span class="emphasis">
    <em>
     SELinux context
    </em>
   </span>
   to each
    system object. SELinux policy modules use SELinux contexts to define
    rules for how processes, files, ports, and other system objects
    interact with each other. Interaction between system objects is only
    permitted if a policy rule allows it.
  </p>
  <p>
   An SELinux context (the label applied to a system object) has the
    following fields:
   <code class="literal">
    user
   </code>
   ,
   <code class="literal">
    role
   </code>
   ,
   <code class="literal">
    type
   </code>
   , and
   <code class="literal">
    security level
   </code>
   . Type
    information rather than the entire SELinux context is used most
    commonly to define rules for how processes interact with other
    system objects. MySQL SELinux policy modules, for example, define
    policy rules using
   <code class="literal">
    type
   </code>
   information.
  </p>
  <p>
   You can view SELinux contexts using operating system commands such
    as
   <span class="command">
    <strong>
     ls
    </strong>
   </span>
   and
   <span class="command">
    <strong>
     ps
    </strong>
   </span>
   with the
   <code class="literal">
    -Z
   </code>
   option. Assuming that SELinux is enabled and a
    MySQL Server is running, the following commands show the SELinux
    context for the
   <a class="link" href="mysqld.html" title="6.3.1 mysqld — The MySQL Server">
    <span class="command">
     <strong>
      mysqld
     </strong>
    </span>
   </a>
   process and MySQL data
    directory:
  </p>
  <p>
   <a class="link" href="mysqld.html" title="6.3.1 mysqld — The MySQL Server">
    <span class="command">
     <strong>
      mysqld
     </strong>
    </span>
   </a>
   process:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa35109598"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">ps</span> <span class="token property">-eZ</span> | grep mysqld
system_u<span class="token punctuation">:</span>system_r<span class="token punctuation">:</span>mysqld_t<span class="token punctuation">:</span>s0    5924 ?        00<span class="token punctuation">:</span>00<span class="token punctuation">:</span>03 mysqld</code></pre>
  </div>
  <p>
   MySQL data directory:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa21607084"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">cd</span> /var/lib
<span class="token prompt">$&gt; </span><span class="token command">ls</span> <span class="token property">-Z</span> | grep mysql
system_u<span class="token punctuation">:</span>object_r<span class="token punctuation">:</span>mysqld_db_t<span class="token punctuation">:</span>s0 mysql</code></pre>
  </div>
  <p>
   where:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      <code class="literal">
       system_u
      </code>
      is an SELinux user identity for
        system processes and objects.
     </p>
    </li>
    <li class="listitem">
     <p>
      <code class="literal">
       system_r
      </code>
      is an SELinux role used for system
        processes.
     </p>
    </li>
    <li class="listitem">
     <p>
      <code class="literal">
       objects_r
      </code>
      is an SELinux role used for system
        objects.
     </p>
    </li>
    <li class="listitem">
     <p>
      <code class="literal">
       mysqld_t
      </code>
      is the type associated with the
        mysqld process.
     </p>
    </li>
    <li class="listitem">
     <p>
      <code class="literal">
       mysqld_db_t
      </code>
      is the type associated with the
        MySQL data directory and its files.
     </p>
    </li>
    <li class="listitem">
     <p>
      <code class="literal">
       s0
      </code>
      is the security level.
     </p>
    </li>
   </ul>
  </div>
  <p>
   For more information about interpreting SELinux contexts, refer to
    your distribution's SELinux documentation.
  </p>
 </div>
 <br/>
</div>
