Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am running CentOS 5.5 and attempting to place MySQL on a non-standard port...which SELinux complains about. MySQL starts perfectly fine on with SELinux off and refuses to start with it on. SELinux is currently running a the type of "targeted"

Not wanting to entirely disable SELinux, I would like to exempt MySQL from the list of targeted daemons. Can anyone tell me how to disable SELinux for this one service?

share|improve this question

2 Answers 2

You don't need to disable SELinux at all. What you need to do is label the port you want use.

To check for the labeled ports for MySQL in the policy:


 # semanage port -l | grep mysql
mysqld_port_t                  tcp      1186, 3306, 63132-63163
mysqlmanagerd_port_t           tcp      2273

To label a $custom port:


 # semanage port -a -t mysqld_port_t -p tcp $custom

The main reference for this is the semanage(8) manpage.

share|improve this answer
    
This is the way to do it. It lets you keep SELinux protection. –  Michael Hampton Aug 24 '13 at 15:11

If you turn of domain transitioning for MySQL with the mysqld_disable_trans boolean, MySQL is no longer protected by SELinux.

More in detail: setting this boolean will make mysqld run as initrc_t, which is more or less the same as unconfined_t. This means that SELinux's restrictions on which port MySQL can and cannot use is taken away.

Flip the boolean using:

setsebool mysqld_disable_trans 1

or directly make it permanent with

setsebool -P mysqld_disable_trans 1

In even more detail: the boolean disables the transition from the initrc_t domain to the mysqld_t domain at the time mysqld is started by the init daemon during boot, or the transition from unconfined_t to mysqld_t if it is started manually after boot. So mysqld is not running outside of SELinux at all, but in a domain that has much less restrictions than mysqld_t has.

A lot of services that exist in the native RHEL5 / CentOS 5 policy have *_disable_trans booleans to turn off domain transitioning for that service. In newer distributions and newer policy, like on Fedora and RHEL6, you just unload the complete module for mysqld to prevent SELinux for blocking your app doing stuff.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.