MySQL 8.4 Release Notes
排查 SELinux 问题通常涉及将 SELinux 设置为宽容模式，重新运行有问题的操作，检查 SELinux 审计日志中的访问拒绝信息，并在问题解决后将 SELinux 重新设置为强制模式。Troubleshooting SELinux typically involves placing SELinux into permissive mode, rerunning problematic operations, checking for access denial messages in the SELinux audit log, and placing SELinux back into enforcing mode after problems are resolved.
为了避免使用 setenforce 将整个系统置于宽容模式，你可以只允许 MySQL 服务以宽容模式运行，通过使用 semanage 命令将其 SELinux 域 (mysqld_t) 置于宽容模式：To avoid placing the entire system into permissive mode using
setenforce, you can permit only the MySQL
service to run permissively by placing its SELinux domain
(mysqld_t) into permissive mode using the
semanage command:
semanage permissive -a mysqld_t
当你完成故障排除后，使用此命令将 mysqld_t 域重新置入强制模式：When you are finished troubleshooting, use this command to place
the mysqld_t domain back into enforcing mode:
semanage permissive -d mysqld_t
SELinux 会将被拒绝的操作记录到 /var/log/audit/audit.log。你可以通过搜索 “denied” 消息来检查拒绝情况。SELinux writes logs for denied operations to
/var/log/audit/audit.log. You can check for
denials by searching for “denied” messages.
grep "denied" /var/log/audit/audit.log
以下各节描述了一些可能遇到 SELinux 相关问题的常见领域。The following sections describes a few common areas where SELinux-related issues may be encountered.
如果 MySQL 目录或文件的 SELinux 上下文不正确，可能会被拒绝访问。如果 MySQL 配置为从非默认目录或文件读取或写入数据，可能会发生此问题。例如，如果您将 MySQL 配置为使用非默认数据目录，该目录可能没有预期的 SELinux 上下文。If a MySQL directory or file has an incorrect SELinux context, access may be denied. This issue can occur if MySQL is configured to read from or write to a non-default directory or file. For example, if you configure MySQL to use a non-default data directory, the directory may not have the expected SELinux context.
在具有无效 SELinux 上下文的非默认数据目录上尝试启动 MySQL 服务会导致以下启动失败。Attempting to start the MySQL service on a non-default data directory with an invalid SELinux context causes the following startup failure.
$> systemctl start mysql.service
Job for mysqld.service failed because the control process exited with error code.
See "systemctl status mysqld.service" and "journalctl -xe" for details.
在这种情况下，一条“拒绝”消息会被记录到/var/log/audit/audit.log：In this case, a “denial” message is logged to
/var/log/audit/audit.log:
$> grep "denied" /var/log/audit/audit.log
type=AVC msg=audit(1587133719.786:194): avc: denied { write } for pid=7133 comm="mysqld"
name="mysql" dev="dm-0" ino=51347078 scontext=system_u:system_r:mysqld_t:s0
tcontext=unconfined_u:object_r:default_t:s0 tclass=dir permissive=0
有关为 MySQL 目录和文件设置正确 SELinux 上下文的信息，请参见第 8.7.4 节，“SELinux 文件上下文”。For information about setting the proper SELinux context for MySQL directories and files, see Section 8.7.4, “SELinux File Context”.
SELinux 期望像 MySQL 服务器这样的服务使用特定端口。更改端口而不更新 SELinux 策略可能会导致服务失败。SELinux expects services such as MySQL Server to use specific ports. Changing ports without updating the SELinux policies may cause a service failure.
mysqld_port_t 端口类型定义了 MySQL 所监听的端口。如果你将 MySQL 服务器配置为使用非默认端口，例如端口 3307，并且没有更新策略以反映此更改，则 MySQL 服务将无法启动：The mysqld_port_t port type defines the ports
that the MySQL listens on. If you configure the MySQL Server to
use a non-default port, such as port 3307, and do not update the
policy to reflect the change, the MySQL service fails to start:
$> systemctl start mysqld.service
Job for mysqld.service failed because the control process exited with error code.
See "systemctl status mysqld.service" and "journalctl -xe" for details.
在这种情况下，一条拒绝消息会记录到 /var/log/audit/audit.log：In this case, a denial message is logged to
/var/log/audit/audit.log:
$> grep "denied" /var/log/audit/audit.log
type=AVC msg=audit(1587134375.845:198): avc: denied { name_bind } for pid=7340
comm="mysqld" src=3307 scontext=system_u:system_r:mysqld_t:s0
tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket permissive=0
有关为 MySQL 设置正确 SELinux 端口上下文的信息，请参见 第 8.7.5 节，“SELinux TCP 端口上下文”。在启用使用未定义所需上下文端口的 MySQL 功能时，也可能出现类似的端口访问问题。有关更多信息，请参见 第 8.7.5.2 节，“为 MySQL 功能设置 TCP 端口上下文”。For information about setting the proper SELinux port context for MySQL, see Section 8.7.5, “SELinux TCP Port Context”. Similar port access issues can occur when enabling MySQL features that use ports that are not defined with the required context. For more information, see Section 8.7.5.2, “Setting the TCP Port Context for MySQL Features”.
SELinux 可能无法识别应用程序的更改。例如，新的发布版本、应用程序扩展或新功能可能会以 SELinux 不允许的方式访问系统资源，从而导致访问被拒。在这种情况下，你可以使用 audit2allow 工具创建自定义策略，以在需要时允许访问。创建自定义策略的典型方法是将 SELinux 模式更改为宽容模式，识别 SELinux 审计日志中的访问拒绝信息，然后使用 audit2allow 工具创建自定义策略以允许访问。SELinux may not be aware of application changes. For example, a new release, an application extension, or a new feature may access system resources in a way that is not permitted by SELinux, resulting in access denials. In such cases, you can use the audit2allow utility to create custom policies to permit access where it is required. The typical method for creating custom policies is to change the SELinux mode to permissive, identify access denial messages in the SELinux audit log, and use the audit2allow utility to create custom policies to permit access.
有关使用 audit2allow 工具的信息，请参阅你所使用的发行版的 SELinux 文档。For information about using the audit2allow utility, refer to your distribution's SELinux documentation.
如果您遇到 MySQL 的访问问题，并且您认为这些问题应由标准 MySQL SELinux 策略模块处理，请在您的发行版的错误跟踪系统中提交错误报告。If you encounter access issues for MySQL that you believe should be handled by standard MySQL SELinux policy modules, please open a bug report in your distribution's bug tracking system.