# 查看默认的MySQL安全上下文类型
# semanage fcontext -l | grep mysqld
/mysql(/.*)? all files system_u:object_r:mysqld_db_t:s0
/var/lib/mysql(/.*)? all files system_u:object_r:mysqld_db_t:s0
/var/lib/mysql-files(/.*)? all files system_u:object_r:mysqld_var_run_t:s0
/var/lib/mysql-keyring(/.*)? all files system_u:object_r:mysqld_keyring_t:s0
/var/lib/mysql/mysql.sock socket system_u:object_r:mysqld_var_run_t:s0
/var/run/mysqld(/.*)? all files system_u:object_r:mysqld_var_run_t:s0
/var/log/mysql(/.*)? all files system_u:object_r:mysqld_log_t:s0

# 查看SELinux日志中的MySQL相关错误
# grep mysqld /var/log/audit/audit.log
type=AVC msg=audit(1712000000.123:456): avc: denied { write } for pid=1234 comm=”mysqld” name=”data” dev=”sdb” ino=123456789 scontext=system_u:system_r:mysqld_t:s0 tcontext=system_u:object_r:default_t:s0 tclass=dir permissive=0

# 检查SELinux状态
# sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: targeted
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Max kernel policy version: 33

# 检查SELinux模式
# getenforce
Enforcing

# 临时切换SELinux模式（用于测试）
# setenforce 0
# getenforce
Permissive

# 恢复SELinux模式
# setenforce 1
# getenforce
Enforcing

# 安装MySQL SELinux模块（如果未安装）
# yum install -y mysql-selinux

# 查看MySQL SELinux模块
# semodule -l | grep mysql
mysql 1.0.0

# 查看MySQL相关的SELinux布尔值
# getsebool -a | grep mysql
mysql_connect_any –> off
mysql_execmem –> off
mysql_setrlimit –> off
mysql_tls_enabled –> on
mysql_zone_transition –> off

# 创建自定义SELinux规则文件
# vi mysql_custom.te

module mysql_custom 1.0;

require {
type mysqld_t;
type default_t;
class dir { read write add_name remove_name search };
class file { read write create unlink };
}

allow mysqld_t default_t:dir { read write add_name remove_name search };
allow mysqld_t default_t:file { read write create unlink };

# 编译SELinux模块
# checkmodule -M -m -o mysql_custom.mod mysql_custom.te

# 创建SELinux模块包
# semodule_package -o mysql_custom.pp -m mysql_custom.mod

# 安装SELinux模块
# semodule -i mysql_custom.pp

# 查看已安装的SELinux模块
# semodule -l | grep mysql
mysql 1.0.0
mysql_custom 1.0

# 步骤1：创建自定义数据目录
# mkdir -p /mysql/data
# chown -R mysql:mysql /mysql/data

# 步骤2：设置SELinux安全上下文
# semanage fcontext -a -t mysqld_db_t “/mysql/data(/.*)?”

# 步骤3：应用安全上下文
# restorecon -Rv /mysql/data
restorecon reset /mysql/data context system_u:object_r:default_t:s0->system_u:object_r:mysqld_db_t:s0
restorecon reset /mysql/data/auto.cnf context system_u:object_r:default_t:s0->system_u:object_r:mysqld_db_t:s0
restorecon reset /mysql/data/ibdata1 context system_u:object_r:default_t:s0->system_u:object_r:mysqld_db_t:s0

# 步骤4：验证安全上下文
# ls -Z /mysql/data/
drwxr-xr-x. mysql mysql system_u:object_r:mysqld_db_t:s0 .
drwxr-xr-x. root root system_u:object_r:default_t:s0 ..
-rw-r—–+ mysql mysql system_u:object_r:mysqld_db_t:s0 auto.cnf
-rw——-+ mysql mysql system_u:object_r:mysqld_db_t:s0 ca-key.pem
-rw-r–r–+ mysql mysql system_u:object_r:mysqld_db_t:s0 ca.pem

# 步骤1：查看MySQL网络端口的SELinux上下文
# semanage port -l | grep mysql
mysqld_port_t tcp 3306, 33060-33061

# 步骤2：添加自定义端口到MySQL端口类型
# semanage port -a -t mysqld_port_t -p tcp 3307

# 步骤3：验证端口配置
# semanage port -l | grep mysql
mysqld_port_t tcp 3306, 3307, 33060-33061

# 步骤4：允许MySQL连接到网络
# setsebool -P mysql_connect_any on

# 验证布尔值设置
# getsebool mysql_connect_any
mysql_connect_any –> on

# 步骤1：查看SELinux日志中的MySQL相关错误
# grep mysqld /var/log/audit/audit.log
type=AVC msg=audit(1712000000.123:456): avc: denied { write } for pid=1234 comm=”mysqld” name=”data” dev=”sdb” ino=123456789 scontext=system_u:system_r:mysqld_t:s0 tcontext=system_u:object_r:default_t:s0 tclass=dir permissive=0

# 步骤2：使用audit2allow工具分析错误
# grep mysqld /var/log/audit/audit.log | audit2allow -M mysql_custom

# 步骤3：安装生成的SELinux模块
# semodule -i mysql_custom.pp

# 步骤4：验证MySQL是否正常运行
# systemctl status mysqld
● mysqld.service – MySQL Server
Loaded: loaded (/usr/lib/systemd/system/mysqld.service; enabled; vendor preset: disabled)
Active: active (running) since Fri 2026-04-01 11:00:00 CST; 5min ago
Docs: man:mysqld(8)
http://dev.mysql.com/doc/refman/en/using-systemd.html
Process: 1234 ExecStart=/usr/sbin/mysqld –daemonize –pid-file=/var/run/mysqld/mysqld.pid $MYSQLD_OPTS (code=exited, status=0/SUCCESS)
Process: 1230 ExecStartPre=/usr/bin/mysqld_pre_systemd (code=exited, status=0/SUCCESS)
Main PID: 1234 (mysqld)
Status: “Server is operational”
Tasks: 38
Memory: 300.0M
CGroup: /system.slice/mysqld.service
└─1234 /usr/sbin/mysqld –daemonize –pid-file=/var/run/mysqld/mysqld.pid