mysqld_selinux(8)

1mysqld_selinux(8)            SELinux Policy mysqld           mysqld_selinux(8)
2
3
4

NAME

6       mysqld_selinux  -  Security  Enhanced  Linux Policy for the mysqld pro‐
7       cesses
8

DESCRIPTION

10       Security-Enhanced Linux  secures  the  mysqld  processes  via  flexible
11       mandatory access control.
12
13       The  mysqld  processes  execute with the mysqld_t SELinux type. You can
14       check if you have these processes running by executing the  ps  command
15       with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep mysqld_t
20
21
22

ENTRYPOINTS

24       The  mysqld_t  SELinux  type  can be entered via the mysqld_exec_t file
25       type.
26
27       The default entrypoint paths for the mysqld_t domain are the following:
28
29       /usr/sbin/mysqld(-max|-debug)?,  /usr/sbin/ndbd,   /usr/libexec/mysqld,
30       /usr/bin/mysql_upgrade, /usr/bin/mysqld_safe_helper
31

PROCESS TYPES

33       SELinux defines process types (domains) for each process running on the
34       system
35
36       You can see the context of a process using the -Z option to ps
37
38       Policy governs the access confined processes have  to  files.   SELinux
39       mysqld  policy  is  very  flexible allowing users to setup their mysqld
40       processes in as secure a method as possible.
41
42       The following process types are defined for mysqld:
43
44       mysqld_t, mysqld_safe_t
45
46       Note: semanage permissive -a mysqld_t can be used to make  the  process
47       type  mysqld_t  permissive.  SELinux does not deny access to permissive
48       process types, but the AVC (SELinux denials) messages are still  gener‐
49       ated.
50
51

BOOLEANS

53       SELinux  policy is customizable based on least access required.  mysqld
54       policy is extremely flexible and has several booleans that allow you to
55       manipulate the policy and run mysqld with the tightest access possible.
56
57
58
59       If  you  want to allow mysqld to connect to all ports, you must turn on
60       the mysql_connect_any boolean. Disabled by default.
61
62       setsebool -P mysql_connect_any 1
63
64
65
66       If you want to allow mysqld to connect to http port, you must  turn  on
67       the mysql_connect_http boolean. Disabled by default.
68
69       setsebool -P mysql_connect_http 1
70
71
72
73       If you want to allow users to resolve user passwd entries directly from
74       ldap rather then using a sssd server, you  must  turn  on  the  authlo‐
75       gin_nsswitch_use_ldap boolean. Disabled by default.
76
77       setsebool -P authlogin_nsswitch_use_ldap 1
78
79
80
81       If  you  want  to  determine whether exim can connect to databases, you
82       must turn on the exim_can_connect_db boolean. Disabled by default.
83
84       setsebool -P exim_can_connect_db 1
85
86
87
88       If you want to allow all domains to execute in fips_mode, you must turn
89       on the fips_mode boolean. Enabled by default.
90
91       setsebool -P fips_mode 1
92
93
94
95       If you want to determine whether ftpd can connect to databases over the
96       TCP network, you must turn on the ftpd_connect_db boolean. Disabled  by
97       default.
98
99       setsebool -P ftpd_connect_db 1
100
101
102
103       If  you want to allow HTTPD scripts and modules to connect to databases
104       over the network, you must  turn  on  the  httpd_can_network_connect_db
105       boolean. Disabled by default.
106
107       setsebool -P httpd_can_network_connect_db 1
108
109
110
111       If  you  want  to allow confined applications to run with kerberos, you
112       must turn on the kerberos_enabled boolean. Disabled by default.
113
114       setsebool -P kerberos_enabled 1
115
116
117
118       If you want to allow system to run with  NIS,  you  must  turn  on  the
119       nis_enabled boolean. Disabled by default.
120
121       setsebool -P nis_enabled 1
122
123
124
125       If  you  want to allow confined applications to use nscd shared memory,
126       you must turn on the nscd_use_shm boolean. Disabled by default.
127
128       setsebool -P nscd_use_shm 1
129
130
131
132       If you want to allow PowerDNS to connect to databases over the network,
133       you  must  turn on the pdns_can_network_connect_db boolean. Disabled by
134       default.
135
136       setsebool -P pdns_can_network_connect_db 1
137
138
139

PORT TYPES

141       SELinux defines port types to represent TCP and UDP ports.
142
143       You can see the types associated with a port  by  using  the  following
144       command:
145
146       semanage port -l
147
148
149       Policy  governs  the  access  confined  processes  have to these ports.
150       SELinux mysqld policy is very flexible allowing users  to  setup  their
151       mysqld processes in as secure a method as possible.
152
153       The following port types are defined for mysqld:
154
155
156       mysqld_port_t
157
158
159
160       Default Defined Ports:
161                 tcp 1186,3306,63132-63164
162

MANAGED FILES

164       The  SELinux  process  type  mysqld_t can manage files labeled with the
165       following file types.  The paths listed are the default paths for these
166       file types.  Note the processes UID still need to have DAC permissions.
167
168       cluster_conf_t
169
170            /etc/cluster(/.*)?
171
172       cluster_var_lib_t
173
174            /var/lib/pcsd(/.*)?
175            /var/lib/cluster(/.*)?
176            /var/lib/openais(/.*)?
177            /var/lib/pengine(/.*)?
178            /var/lib/corosync(/.*)?
179            /usr/lib/heartbeat(/.*)?
180            /var/lib/heartbeat(/.*)?
181            /var/lib/pacemaker(/.*)?
182
183       cluster_var_run_t
184
185            /var/run/crm(/.*)?
186            /var/run/cman_.*
187            /var/run/rsctmp(/.*)?
188            /var/run/aisexec.*
189            /var/run/heartbeat(/.*)?
190            /var/run/corosync-qnetd(/.*)?
191            /var/run/corosync-qdevice(/.*)?
192            /var/run/corosync.pid
193            /var/run/cpglockd.pid
194            /var/run/rgmanager.pid
195            /var/run/cluster/rgmanager.sk
196
197       faillog_t
198
199            /var/log/btmp.*
200            /var/log/faillog.*
201            /var/log/tallylog.*
202            /var/run/faillock(/.*)?
203
204       hugetlbfs_t
205
206            /dev/hugepages
207            /usr/lib/udev/devices/hugepages
208
209       krb5_host_rcache_t
210
211            /var/cache/krb5rcache(/.*)?
212            /var/tmp/nfs_0
213            /var/tmp/DNS_25
214            /var/tmp/host_0
215            /var/tmp/imap_0
216            /var/tmp/HTTP_23
217            /var/tmp/HTTP_48
218            /var/tmp/ldap_55
219            /var/tmp/ldap_487
220            /var/tmp/ldapmap1_0
221
222       lastlog_t
223
224            /var/log/lastlog.*
225
226       mysqld_db_t
227
228            /var/lib/mysql(-files|-keyring)?(/.*)?
229
230       mysqld_log_t
231
232            /var/log/mysql.*
233            /var/log/mysql(/.*)?
234            /var/log/mariadb(/.*)?
235
236       mysqld_tmp_t
237
238
239       mysqld_var_run_t
240
241            /var/run/mysql(/.*)?
242            /var/run/mysqld(/.*)?
243            /var/run/mariadb(/.*)?
244            /var/lib/mysql/mysql.sock
245
246       root_t
247
248            /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
249            /
250            /initrd
251
252       security_t
253
254            /selinux
255
256

FILE CONTEXTS

258       SELinux requires files to have an extended attribute to define the file
259       type.
260
261       You can see the context of a file using the -Z option to ls
262
263       Policy governs the access  confined  processes  have  to  these  files.
264       SELinux  mysqld  policy  is very flexible allowing users to setup their
265       mysqld processes in as secure a method as possible.
266
267       EQUIVALENCE DIRECTORIES
268
269
270       mysqld policy stores data with multiple different  file  context  types
271       under  the  /var/log/mysql  directory.   If you would like to store the
272       data in a different directory you can use the semanage command to  cre‐
273       ate an equivalence mapping.  If you wanted to store this data under the
274       /srv dirctory you would execute the following command:
275
276       semanage fcontext -a -e /var/log/mysql /srv/mysql
277       restorecon -R -v /srv/mysql
278
279       mysqld policy stores data with multiple different  file  context  types
280       under  the  /var/run/mysql  directory.   If you would like to store the
281       data in a different directory you can use the semanage command to  cre‐
282       ate an equivalence mapping.  If you wanted to store this data under the
283       /srv dirctory you would execute the following command:
284
285       semanage fcontext -a -e /var/run/mysql /srv/mysql
286       restorecon -R -v /srv/mysql
287
288       STANDARD FILE CONTEXT
289
290       SELinux defines the file context types for the mysqld, if you wanted to
291       store  files  with  these types in a diffent paths, you need to execute
292       the semanage command  to  sepecify  alternate  labeling  and  then  use
293       restorecon to put the labels on disk.
294
295       semanage fcontext -a -t mysqld_tmp_t '/srv/mymysqld_content(/.*)?'
296       restorecon -R -v /srv/mymysqld_content
297
298       Note:  SELinux  often  uses  regular expressions to specify labels that
299       match multiple files.
300
301       The following file types are defined for mysqld:
302
303
304
305       mysqld_db_t
306
307       - Set files with the mysqld_db_t type, if you want to treat  the  files
308       as mysqld database content.
309
310
311
312       mysqld_etc_t
313
314       -  Set  files  with  the mysqld_etc_t type, if you want to store mysqld
315       files in the /etc directories.
316
317
318       Paths:
319            /etc/mysql(/.*)?, /etc/my.cnf.d(/.*)?, /etc/my.cnf
320
321
322       mysqld_exec_t
323
324       - Set files with the mysqld_exec_t type, if you want to  transition  an
325       executable to the mysqld_t domain.
326
327
328       Paths:
329            /usr/sbin/mysqld(-max|-debug)?,                    /usr/sbin/ndbd,
330            /usr/libexec/mysqld,                       /usr/bin/mysql_upgrade,
331            /usr/bin/mysqld_safe_helper
332
333
334       mysqld_home_t
335
336       -  Set  files  with the mysqld_home_t type, if you want to store mysqld
337       files in the users home directory.
338
339
340       Paths:
341            /root/.my.cnf, /home/[^/]+/.my.cnf
342
343
344       mysqld_initrc_exec_t
345
346       - Set files with the mysqld_initrc_exec_t type, if you want to  transi‐
347       tion an executable to the mysqld_initrc_t domain.
348
349
350
351       mysqld_log_t
352
353       -  Set  files with the mysqld_log_t type, if you want to treat the data
354       as mysqld log data, usually stored under the /var/log directory.
355
356
357       Paths:
358            /var/log/mysql.*, /var/log/mysql(/.*)?, /var/log/mariadb(/.*)?
359
360
361       mysqld_safe_exec_t
362
363       - Set files with the mysqld_safe_exec_t type, if you want to transition
364       an executable to the mysqld_safe_t domain.
365
366
367       Paths:
368            /usr/bin/mysqld_safe, /usr/libexec/mysqld_safe-scl-helper
369
370
371       mysqld_tmp_t
372
373       -  Set  files  with  the mysqld_tmp_t type, if you want to store mysqld
374       temporary files in the /tmp directories.
375
376
377
378       mysqld_unit_file_t
379
380       - Set files with the mysqld_unit_file_t type, if you want to treat  the
381       files as mysqld unit content.
382
383
384       Paths:
385            /usr/lib/systemd/system/mysqld.*,    /usr/lib/systemd/system/mari‐
386            adb.*
387
388
389       mysqld_var_run_t
390
391       - Set files with the mysqld_var_run_t type, if you want  to  store  the
392       mysqld files under the /run or /var/run directory.
393
394
395       Paths:
396            /var/run/mysql(/.*)?,     /var/run/mysqld(/.*)?,    /var/run/mari‐
397            adb(/.*)?, /var/lib/mysql/mysql.sock
398
399
400       Note: File context can be temporarily modified with the chcon  command.
401       If  you want to permanently change the file context you need to use the
402       semanage fcontext command.  This will modify the SELinux labeling data‐
403       base.  You will need to use restorecon to apply the labels.
404
405

COMMANDS

407       semanage  fcontext  can also be used to manipulate default file context
408       mappings.
409
410       semanage permissive can also be used to manipulate  whether  or  not  a
411       process type is permissive.
412
413       semanage  module can also be used to enable/disable/install/remove pol‐
414       icy modules.
415
416       semanage port can also be used to manipulate the port definitions
417
418       semanage boolean can also be used to manipulate the booleans
419
420
421       system-config-selinux is a GUI tool available to customize SELinux pol‐
422       icy settings.
423
424

AUTHOR

426       This manual page was auto-generated using sepolicy manpage .
427
428