How do I Exempt MySQL from SELinux targeted list?

Question

I am running CentOS 5.5 and attempting to place MySQL on a non-standard port...which SELinux complains about. MySQL starts perfectly fine on with SELinux off and refuses to start with it on. SELinux is currently running a the type of "targeted"

Not wanting to entirely disable SELinux, I would like to exempt MySQL from the list of targeted daemons. Can anyone tell me how to disable SELinux for this one service?

Answer 1

If you turn of domain transitioning for MySQL with the mysqld_disable_trans boolean, MySQL is no longer protected by SELinux.

More in detail: setting this boolean will make mysqld run as initrc_t, which is more or less the same as unconfined_t. This means that SELinux's restrictions on which port MySQL can and cannot use is taken away.

Flip the boolean using:

setsebool mysqld_disable_trans 1

or directly make it permanent with

setsebool -P mysqld_disable_trans 1

In even more detail: the boolean disables the transition from the initrc_t domain to the mysqld_t domain at the time mysqld is started by the init daemon during boot, or the transition from unconfined_t to mysqld_t if it is started manually after boot. So mysqld is not running outside of SELinux at all, but in a domain that has much less restrictions than mysqld_t has.

A lot of services that exist in the native RHEL5 / CentOS 5 policy have *_disable_trans booleans to turn off domain transitioning for that service. In newer distributions and newer policy, like on Fedora and RHEL6, you just unload the complete module for mysqld to prevent SELinux for blocking your app doing stuff.