up vote 1 down vote favorite
share [g+] share [fb]

I'd like to for once leave selinux running on a server for the alleged increased security.
I usually disable selinux to get anything to work.
How do I tell selinux to allow mysql connections?
The most documentation I've found is this line from mysql.com:
If you are running under Linux and Security-Enhanced Linux (SELinux) is enabled, make sure you have disabled SELinux protection for the mysqld process.
wow ... that's really helpful.

link|improve this question
Please provide all of the following information for us to have a chance of helping you. 1. Linux Distro and Version, 2. MySQL version and installation source, 3. AVC log entries from a denied connection, 4. Relevant MySQL logs, if any 5. The output of getsebool -a | grep mysql 6. Exact steps you have taken to reproduce this – hobodave Feb 24 '11 at 23:25
feedback

migrated from stackoverflow.com Feb 24 '11 at 23:20

This question came from our site for professional and enthusiast programmers.

4 Answers

up vote 1 down vote

Do you get an error? What flavor of linux are you using? Security context is a good place to start if you are getting an error. ls -Z will give context... But your question is very vague.

link|improve this answer
I am connecting from a windows box. There is no error ... the connection is just refused and the page times out. I know if I turn off selinux everything will be fine. – xivix Feb 24 '11 at 21:17
since the connection is incoming from a windows box, ls -Z only gives me info about the files in whatever directory I'm in on the linux box. – xivix Feb 24 '11 at 21:18
In my question above I cited a mysql reference ... which said to disable selinux protection for the mysqld process ... but it doesn't say how to do that :( Nor can I find out how. – xivix Feb 24 '11 at 21:20
Anything in the logs on the linux box? selinux can stop httpd from making a socket connection... – Tamler Feb 24 '11 at 21:35
Nothing in messages or secure logs ... is there a particular log you had in mind? – xivix Feb 24 '11 at 21:46
show 3 more comments
feedback
up vote 1 down vote

Apparently configuring selinux isn't trivial. You may wish to start here.

setenforce 0

puts selinux into permissive mode, where it allows anything but logs what it's allowing. A reboot or

setenforce 1

returns to blocking whatever the policy doesn't permit.

Check out these selinux policy docs for mySQL in Fedora.

link|improve this answer
feedback
up vote 0 down vote

ausearch command can help find the error log.

link|improve this answer
ausearch -m avc -ts today | audit2why , command can suggest solution – vnix27 Feb 26 '11 at 7:01
feedback
up vote 0 down vote

Are you sure it's selinux? Normal connections from outside should be allowed by selinux. So it could also be the firewall. If you have local services trying to connect to mysqld, that's something different: http://docs.fedoraproject.org/en-US/Fedora/13/html/Managing_Confined_Services/sect-Managing_Confined_Services-MySQL-Booleans.html

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.