mysqld_selinux(8)

1mysqld_selinux(8)            SELinux Policy mysqld           mysqld_selinux(8)
2
3
4

NAME

6       mysqld_selinux  -  Security  Enhanced  Linux Policy for the mysqld pro‐
7       cesses
8

DESCRIPTION

10       Security-Enhanced Linux  secures  the  mysqld  processes  via  flexible
11       mandatory access control.
12
13       The  mysqld  processes  execute with the mysqld_t SELinux type. You can
14       check if you have these processes running by executing the  ps  command
15       with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep mysqld_t
20
21
22

ENTRYPOINTS

24       The  mysqld_t  SELinux  type  can be entered via the mysqld_exec_t file
25       type.
26
27       The default entrypoint paths for the mysqld_t domain are the following:
28
29       /usr/sbin/mysqld(-max|-debug)?,  /usr/sbin/ndbd,   /usr/libexec/mysqld,
30       /usr/bin/mysql_upgrade, /usr/bin/mysqld_safe_helper
31

PROCESS TYPES

33       SELinux defines process types (domains) for each process running on the
34       system
35
36       You can see the context of a process using the -Z option to ps
37
38       Policy governs the access confined processes have  to  files.   SELinux
39       mysqld  policy  is  very  flexible allowing users to setup their mysqld
40       processes in as secure a method as possible.
41
42       The following process types are defined for mysqld:
43
44       mysqld_t, mysqld_safe_t
45
46       Note: semanage permissive -a mysqld_t can be used to make  the  process
47       type  mysqld_t  permissive.  SELinux does not deny access to permissive
48       process types, but the AVC (SELinux denials) messages are still  gener‐
49       ated.
50
51

BOOLEANS

53       SELinux  policy is customizable based on least access required.  mysqld
54       policy is extremely flexible and has several booleans that allow you to
55       manipulate the policy and run mysqld with the tightest access possible.
56
57
58
59       If  you  want to allow mysqld to connect to all ports, you must turn on
60       the mysql_connect_any boolean. Disabled by default.
61
62       setsebool -P mysql_connect_any 1
63
64
65
66       If you want to allow mysqld to connect to http port, you must  turn  on
67       the mysql_connect_http boolean. Disabled by default.
68
69       setsebool -P mysql_connect_http 1
70
71
72
73       If you want to allow users to resolve user passwd entries directly from
74       ldap rather then using a sssd server, you  must  turn  on  the  authlo‐
75       gin_nsswitch_use_ldap boolean. Disabled by default.
76
77       setsebool -P authlogin_nsswitch_use_ldap 1
78
79
80
81       If  you  want  to  determine whether exim can connect to databases, you
82       must turn on the exim_can_connect_db boolean. Disabled by default.
83
84       setsebool -P exim_can_connect_db 1
85
86
87
88       If you want to allow all domains to execute in fips_mode, you must turn
89       on the fips_mode boolean. Enabled by default.
90
91       setsebool -P fips_mode 1
92
93
94
95       If you want to determine whether ftpd can connect to databases over the
96       TCP network, you must turn on the ftpd_connect_db boolean. Disabled  by
97       default.
98
99       setsebool -P ftpd_connect_db 1
100
101
102
103       If  you want to allow HTTPD scripts and modules to connect to databases
104       over the network, you must  turn  on  the  httpd_can_network_connect_db
105       boolean. Disabled by default.
106
107       setsebool -P httpd_can_network_connect_db 1
108
109
110
111       If  you  want  to allow confined applications to run with kerberos, you
112       must turn on the kerberos_enabled boolean. Enabled by default.
113
114       setsebool -P kerberos_enabled 1
115
116
117
118       If you want to allow system to run with  NIS,  you  must  turn  on  the
119       nis_enabled boolean. Disabled by default.
120
121       setsebool -P nis_enabled 1
122
123
124
125       If  you  want to allow confined applications to use nscd shared memory,
126       you must turn on the nscd_use_shm boolean. Disabled by default.
127
128       setsebool -P nscd_use_shm 1
129
130
131
132       If you want to allow PowerDNS to connect to databases over the network,
133       you  must  turn on the pdns_can_network_connect_db boolean. Disabled by
134       default.
135
136       setsebool -P pdns_can_network_connect_db 1
137
138
139

PORT TYPES

141       SELinux defines port types to represent TCP and UDP ports.
142
143       You can see the types associated with a port  by  using  the  following
144       command:
145
146       semanage port -l
147
148
149       Policy  governs  the  access  confined  processes  have to these ports.
150       SELinux mysqld policy is very flexible allowing users  to  setup  their
151       mysqld processes in as secure a method as possible.
152
153       The following port types are defined for mysqld:
154
155
156       mysqld_port_t
157
158
159
160       Default Defined Ports:
161                 tcp 1186,3306,63132-63164
162

MANAGED FILES

164       The  SELinux  process  type  mysqld_t can manage files labeled with the
165       following file types.  The paths listed are the default paths for these
166       file types.  Note the processes UID still need to have DAC permissions.
167
168       cluster_conf_t
169
170            /etc/cluster(/.*)?
171
172       cluster_var_lib_t
173
174            /var/lib/pcsd(/.*)?
175            /var/lib/cluster(/.*)?
176            /var/lib/openais(/.*)?
177            /var/lib/pengine(/.*)?
178            /var/lib/corosync(/.*)?
179            /usr/lib/heartbeat(/.*)?
180            /var/lib/heartbeat(/.*)?
181            /var/lib/pacemaker(/.*)?
182
183       cluster_var_run_t
184
185            /var/run/crm(/.*)?
186            /var/run/cman_.*
187            /var/run/rsctmp(/.*)?
188            /var/run/aisexec.*
189            /var/run/heartbeat(/.*)?
190            /var/run/corosync-qnetd(/.*)?
191            /var/run/corosync-qdevice(/.*)?
192            /var/run/corosync.pid
193            /var/run/cpglockd.pid
194            /var/run/rgmanager.pid
195            /var/run/cluster/rgmanager.sk
196
197       faillog_t
198
199            /var/log/btmp.*
200            /var/log/faillog.*
201            /var/log/tallylog.*
202            /var/run/faillock(/.*)?
203
204       hugetlbfs_t
205
206            /dev/hugepages
207            /usr/lib/udev/devices/hugepages
208
209       krb5_host_rcache_t
210
211            /var/cache/krb5rcache(/.*)?
212            /var/tmp/nfs_0
213            /var/tmp/DNS_25
214            /var/tmp/host_0
215            /var/tmp/imap_0
216            /var/tmp/HTTP_23
217            /var/tmp/HTTP_48
218            /var/tmp/ldap_55
219            /var/tmp/ldap_487
220            /var/tmp/ldapmap1_0
221
222       lastlog_t
223
224            /var/log/lastlog.*
225
226       mysqld_db_t
227
228            /var/lib/mysql(-files|-keyring)?(/.*)?
229
230       mysqld_log_t
231
232            /var/log/mysql.*
233            /var/log/mysql(/.*)?
234            /var/log/mariadb(/.*)?
235
236       mysqld_tmp_t
237
238
239       mysqld_var_run_t
240
241            /var/run/mysqld(/.*)?
242            /var/run/mariadb(/.*)?
243            /var/lib/mysql/mysql.sock
244
245       root_t
246
247            /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
248            /
249            /initrd
250
251       security_t
252
253            /selinux
254
255

FILE CONTEXTS

257       SELinux requires files to have an extended attribute to define the file
258       type.
259
260       You can see the context of a file using the -Z option to ls
261
262       Policy governs the access  confined  processes  have  to  these  files.
263       SELinux  mysqld  policy  is very flexible allowing users to setup their
264       mysqld processes in as secure a method as possible.
265
266       EQUIVALENCE DIRECTORIES
267
268
269       mysqld policy stores data with multiple different  file  context  types
270       under  the  /var/log/mysql  directory.   If you would like to store the
271       data in a different directory you can use the semanage command to  cre‐
272       ate an equivalence mapping.  If you wanted to store this data under the
273       /srv dirctory you would execute the following command:
274
275       semanage fcontext -a -e /var/log/mysql /srv/mysql
276       restorecon -R -v /srv/mysql
277
278       STANDARD FILE CONTEXT
279
280       SELinux defines the file context types for the mysqld, if you wanted to
281       store  files  with  these types in a diffent paths, you need to execute
282       the semanage command  to  sepecify  alternate  labeling  and  then  use
283       restorecon to put the labels on disk.
284
285       semanage fcontext -a -t mysqld_tmp_t '/srv/mymysqld_content(/.*)?'
286       restorecon -R -v /srv/mymysqld_content
287
288       Note:  SELinux  often  uses  regular expressions to specify labels that
289       match multiple files.
290
291       The following file types are defined for mysqld:
292
293
294
295       mysqld_db_t
296
297       - Set files with the mysqld_db_t type, if you want to treat  the  files
298       as mysqld database content.
299
300
301
302       mysqld_etc_t
303
304       -  Set  files  with  the mysqld_etc_t type, if you want to store mysqld
305       files in the /etc directories.
306
307
308       Paths:
309            /etc/mysql(/.*)?, /etc/my.cnf.d(/.*)?, /etc/my.cnf
310
311
312       mysqld_exec_t
313
314       - Set files with the mysqld_exec_t type, if you want to  transition  an
315       executable to the mysqld_t domain.
316
317
318       Paths:
319            /usr/sbin/mysqld(-max|-debug)?,                    /usr/sbin/ndbd,
320            /usr/libexec/mysqld,                       /usr/bin/mysql_upgrade,
321            /usr/bin/mysqld_safe_helper
322
323
324       mysqld_home_t
325
326       -  Set  files  with the mysqld_home_t type, if you want to store mysqld
327       files in the users home directory.
328
329
330       Paths:
331            /root/.my.cnf, /home/[^/]+/.my.cnf
332
333
334       mysqld_initrc_exec_t
335
336       - Set files with the mysqld_initrc_exec_t type, if you want to  transi‐
337       tion an executable to the mysqld_initrc_t domain.
338
339
340
341       mysqld_log_t
342
343       -  Set  files with the mysqld_log_t type, if you want to treat the data
344       as mysqld log data, usually stored under the /var/log directory.
345
346
347       Paths:
348            /var/log/mysql.*, /var/log/mysql(/.*)?, /var/log/mariadb(/.*)?
349
350
351       mysqld_safe_exec_t
352
353       - Set files with the mysqld_safe_exec_t type, if you want to transition
354       an executable to the mysqld_safe_t domain.
355
356
357       Paths:
358            /usr/bin/mysqld_safe, /usr/libexec/mysqld_safe-scl-helper
359
360
361       mysqld_tmp_t
362
363       -  Set  files  with  the mysqld_tmp_t type, if you want to store mysqld
364       temporary files in the /tmp directories.
365
366
367
368       mysqld_unit_file_t
369
370       - Set files with the mysqld_unit_file_t type, if you want to treat  the
371       files as mysqld unit content.
372
373
374       Paths:
375            /usr/lib/systemd/system/mysqld.*,    /usr/lib/systemd/system/mari‐
376            adb.*
377
378
379       mysqld_var_run_t
380
381       - Set files with the mysqld_var_run_t type, if you want  to  store  the
382       mysqld files under the /run or /var/run directory.
383
384
385       Paths:
386            /var/run/mysqld(/.*)?,                     /var/run/mariadb(/.*)?,
387            /var/lib/mysql/mysql.sock
388
389
390       Note: File context can be temporarily modified with the chcon  command.
391       If  you want to permanently change the file context you need to use the
392       semanage fcontext command.  This will modify the SELinux labeling data‐
393       base.  You will need to use restorecon to apply the labels.
394
395

COMMANDS

397       semanage  fcontext  can also be used to manipulate default file context
398       mappings.
399
400       semanage permissive can also be used to manipulate  whether  or  not  a
401       process type is permissive.
402
403       semanage  module can also be used to enable/disable/install/remove pol‐
404       icy modules.
405
406       semanage port can also be used to manipulate the port definitions
407
408       semanage boolean can also be used to manipulate the booleans
409
410
411       system-config-selinux is a GUI tool available to customize SELinux pol‐
412       icy settings.
413
414

AUTHOR

416       This manual page was auto-generated using sepolicy manpage .
417
418