Set SELinux contexts for MySQL Server for datadir, logdir, errolog, pid, socket, port:
semange help:
semanage -h
semanage fcontext -h
List the current MySQL contexts:
#semanage fcontext -l | grep -i mysql
List port available for MySQL:
#semanage port -l | grep mysql
Add port to mysqld template:
#semanage -a -t mysqld_port_t -p tcp 3375
Add port range to mysqld template:
#semanage port -a -t mysqld_port_t -p tcp 35000-38000
Remove the mysql templete tcp port:
#semanage port -d -t mysqld_port_t -p tcp 3375
Set the data directory context:
Default location for data directory - /var/lib/mysql/, the SELinux context used is mysqld_db_t.
# semanage fcontext -a -t mysqld_db_t "/path/to/my/custom/datadir(/.*)?"
# restorecon -Rv /path/to/my/custom/datadir
Set the log directory context:
# semanage fcontext -a -t mysqld_db_t "/path/to/my/custom/logdir(/.*)?"
# restorecon -Rv /path/to/my/custom/logdir
Set error log file context:
The default location for RedHat RPMs is /var/log/mysqld.log, the SELinux context used is mysqld_log_t.
# semanage fcontext -a -t mysqld_log_t "/path/to/my/custom/error.log"
# restorecon -Rv /path/to/my/custom/error.log
Set PID file context:
The default location for the PID file is /var/run/mysqld/mysqld.pid, the SELinux context used is mysqld_var_run_t.
# semanage fcontext -a -t mysqld_var_run_t "/path/to/my/custom/pidfile/directory/.*?"
# restorecon -Rv /path/to/my/custom/pidfile/directory
Set the unix-domain socket context:
The default location for the unix-domain socket is /var/lib/mysql/mysql.sock, the SELinux context used is mysqld_var_run_t.
# semanage fcontext -a -t mysqld_var_run_t "/path/to/my/custom/mysql\.sock"
# restorecon -Rv /path/to/my/custom/mysql.sock
Set the TCP port context:
The default TCP port is 3306, the SELinux context used is mysqld_port_t
# semanage port -a -t mysqld_port_t -p tcp 13306
List:
#semanage port -l | grep mysql
Remove content from context:
#semanage fcontext -d /path/to/my/custom/error.log
Tools require:
# yum install policycoreutils-python
Explore more about mysqld_selinux - https://linux.die.net/man/8/mysqld_selinux
semange help:
semanage -h
semanage fcontext -h
List the current MySQL contexts:
#semanage fcontext -l | grep -i mysql
List port available for MySQL:
#semanage port -l | grep mysql
Add port to mysqld template:
#semanage -a -t mysqld_port_t -p tcp 3375
Add port range to mysqld template:
#semanage port -a -t mysqld_port_t -p tcp 35000-38000
Remove the mysql templete tcp port:
#semanage port -d -t mysqld_port_t -p tcp 3375
Set the data directory context:
Default location for data directory - /var/lib/mysql/, the SELinux context used is mysqld_db_t.
# semanage fcontext -a -t mysqld_db_t "/path/to/my/custom/datadir(/.*)?"
# restorecon -Rv /path/to/my/custom/datadir
Set the log directory context:
# semanage fcontext -a -t mysqld_db_t "/path/to/my/custom/logdir(/.*)?"
# restorecon -Rv /path/to/my/custom/logdir
Set error log file context:
The default location for RedHat RPMs is /var/log/mysqld.log, the SELinux context used is mysqld_log_t.
# semanage fcontext -a -t mysqld_log_t "/path/to/my/custom/error.log"
# restorecon -Rv /path/to/my/custom/error.log
Set PID file context:
The default location for the PID file is /var/run/mysqld/mysqld.pid, the SELinux context used is mysqld_var_run_t.
# semanage fcontext -a -t mysqld_var_run_t "/path/to/my/custom/pidfile/directory/.*?"
# restorecon -Rv /path/to/my/custom/pidfile/directory
Set the unix-domain socket context:
The default location for the unix-domain socket is /var/lib/mysql/mysql.sock, the SELinux context used is mysqld_var_run_t.
# semanage fcontext -a -t mysqld_var_run_t "/path/to/my/custom/mysql\.sock"
# restorecon -Rv /path/to/my/custom/mysql.sock
Set the TCP port context:
The default TCP port is 3306, the SELinux context used is mysqld_port_t
# semanage port -a -t mysqld_port_t -p tcp 13306
List:
#semanage port -l | grep mysql
Remove content from context:
#semanage fcontext -d /path/to/my/custom/error.log
Tools require:
# yum install policycoreutils-python
Explore more about mysqld_selinux - https://linux.die.net/man/8/mysqld_selinux
Comments
Post a Comment