MySQL数据库与SELinux文件权限设置

本文所有操作参考了MySQL官方文档：8.7 SELinux。本实验环境为已安装MySQL 8的Linux 8：

$ cat /etc/redhat-release
Red Hat Enterprise Linux release 8.10 (Ootpa)

$ mysqld --version
/usr/sbin/mysqld  Ver 8.4.2 for Linux on x86_64 (MySQL Community Server - GPL)

SELinux 表示 Security-Enhanced Linux。

SELinux 上下文（应用于系统对象的标签）具有以下字段：用户、角色、类型和安全级别。类型信息（而不是整个 SELinux 上下文）最常用于定义进程与其他系统对象交互的规则。例如，MySQL SELinux 策略模块使用类型信息定义策略规则。

上面所说的类型即type。

ls和ps的-Z选型可以查看文件或进程的上下文信息。

例如：

$ ps -eZ|grep mysql
system_u:system_r:mysqld_t:s0     46745 ?        00:00:51 mysqld

$ ls -Z /sbin/mysqld
system_u:object_r:mysqld_exec_t:s0 /sbin/mysqld

$ ls -Z /var/lib/mysql
     system_u:object_r:mysqld_db_t:s0  auto.cnf                 system_u:object_r:mysqld_db_t:s0 '#innodb_temp'
     system_u:object_r:mysqld_db_t:s0  binlog.000001            system_u:object_r:mysqld_db_t:s0  mysql
     system_u:object_r:mysqld_db_t:s0  binlog.000002            system_u:object_r:mysqld_db_t:s0  mysql.ibd
     system_u:object_r:mysqld_db_t:s0  binlog.index        system_u:object_r:mysqld_var_run_t:s0  mysql.sock
     system_u:object_r:mysqld_db_t:s0  ca-key.pem               system_u:object_r:mysqld_db_t:s0  mysql.sock.lock
     system_u:object_r:mysqld_db_t:s0  ca.pem                   system_u:object_r:mysqld_db_t:s0  mysql_upgrade_history
     system_u:object_r:mysqld_db_t:s0  client-cert.pem          system_u:object_r:mysqld_db_t:s0  performance_schema
     system_u:object_r:mysqld_db_t:s0  client-key.pem           system_u:object_r:mysqld_db_t:s0  private_key.pem
     system_u:object_r:mysqld_db_t:s0  employees                system_u:object_r:mysqld_db_t:s0  public_key.pem
     system_u:object_r:mysqld_db_t:s0 '#ib_16384_0.dblwr'       system_u:object_r:mysqld_db_t:s0  server-cert.pem
     system_u:object_r:mysqld_db_t:s0 '#ib_16384_1.dblwr'       system_u:object_r:mysqld_db_t:s0  server-key.pem
     system_u:object_r:mysqld_db_t:s0  ib_buffer_pool           system_u:object_r:mysqld_db_t:s0  sys
     system_u:object_r:mysqld_db_t:s0  ibdata1                  system_u:object_r:mysqld_db_t:s0  undo_001
     system_u:object_r:mysqld_db_t:s0  ibtmp1                   system_u:object_r:mysqld_db_t:s0  undo_002
     system_u:object_r:mysqld_db_t:s0 '#innodb_redo'

在以上输出中：

• system_u 是用于系统进程和对象的 SELinux 用户。
• system_r 是用于系统进程的 SELinux 角色。
• objects_r 是用于系统对象的 SELinux 角色。
• mysqld_t 是与 mysqld 进程关联的类型。
• mysqld_db_t 是与 MySQL 数据目录及其文件关联的类型。
• s0 是安全级别。

查看SELinux当前模式：

$ sestatus
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     actual (secure)
Max kernel policy version:      33

简单的命令：

$ getenforce
Enforcing

如果想不重启，临时修改SELinux模式：

$ setenforce 0
$ getenforce
Permissive

$ setenforce 1
$ getenforce
Enforcing

下面进入本文的主旨，设置SELinux的文件上下文。

场景为：我们的秘钥文件为/usr/local/mysql/keyring/component_keyring_file，我们希望mysqld在SELinux下可以有权限访问他。

为此，我们可以先来看一下已经具备权限的文件：

$ ls -Zd /var/lib/mysql
system_u:object_r:mysqld_db_t:s0 /var/lib/mysql

$ semanage fcontext -l | grep -i mysql
/etc/my\.cnf                                       regular file       system_u:object_r:mysqld_etc_t:s0
/etc/my\.cnf\.d(/.*)?                              all files          system_u:object_r:mysqld_etc_t:s0
/etc/mysql(/.*)?                                   all files          system_u:object_r:mysqld_etc_t:s0
/etc/rc\.d/init\.d/mysqld                          regular file       system_u:object_r:mysqld_initrc_exec_t:s0
/etc/rc\.d/init\.d/mysqlmanager                    regular file       system_u:object_r:mysqlmanagerd_initrc_exec_t:s0
/home/[^/]+/\.my\.cnf                              regular file       unconfined_u:object_r:mysqld_home_t:s0
/root/\.my\.cnf                                    regular file       system_u:object_r:mysqld_home_t:s0
/usr/bin/mysql_upgrade                             regular file       system_u:object_r:mysqld_exec_t:s0
/usr/bin/mysqld_safe                               regular file       system_u:object_r:mysqld_safe_exec_t:s0
/usr/bin/mysqld_safe_helper                        regular file       system_u:object_r:mysqld_exec_t:s0
/usr/lib(64)?/nagios/plugins/check_mysql           regular file       system_u:object_r:nagios_services_plugin_exec_t:s0
/usr/lib(64)?/nagios/plugins/check_mysql_query     regular file       system_u:object_r:nagios_services_plugin_exec_t:s0
/usr/lib/systemd/system/mariadb.*                  regular file       system_u:object_r:mysqld_unit_file_t:s0
/usr/lib/systemd/system/mysqld.*                   regular file       system_u:object_r:mysqld_unit_file_t:s0
/usr/libexec/mysqld                                regular file       system_u:object_r:mysqld_exec_t:s0
/usr/libexec/mysqld_safe-scl-helper                regular file       system_u:object_r:mysqld_safe_exec_t:s0
/usr/local/mysql(/.*)?                             all files          system_u:object_r:mysqld_db_t:s0
/usr/sbin/mysqld(-max|-debug)?                     regular file       system_u:object_r:mysqld_exec_t:s0
/usr/sbin/mysqlmanager                             regular file       system_u:object_r:mysqlmanagerd_exec_t:s0
/usr/sbin/ndbd                                     regular file       system_u:object_r:mysqld_exec_t:s0
/usr/sbin/zabbix_proxy_mysql                       regular file       system_u:object_r:zabbix_exec_t:s0
/usr/sbin/zabbix_server_mysql                      regular file       system_u:object_r:zabbix_exec_t:s0
/usr/share/munin/plugins/mysql_.*                  regular file       system_u:object_r:services_munin_plugin_exec_t:s0
/var/lib/mysql(-files|-keyring)?(/.*)?             all files          system_u:object_r:mysqld_db_t:s0
/var/lib/mysql/mysql\.sock                         socket             system_u:object_r:mysqld_var_run_t:s0
/var/log/mariadb(/.*)?                             all files          system_u:object_r:mysqld_log_t:s0
/var/log/mysql(/.*)?                               all files          system_u:object_r:mysqld_log_t:s0
/var/log/mysql.*                                   regular file       system_u:object_r:mysqld_log_t:s0
/var/run/mariadb(/.*)?                             all files          system_u:object_r:mysqld_var_run_t:s0
/var/run/mysql(/.*)?                               all files          system_u:object_r:mysqld_var_run_t:s0
/var/run/mysqld(/.*)?                              all files          system_u:object_r:mysqld_var_run_t:s0
/var/run/mysqld/mysqlmanager.*                     regular file       system_u:object_r:mysqlmanagerd_var_run_t:s0
/var/lib/mysql-files = /var/lib/mysql
/var/lib/mysql-keyring = /var/lib/mysql

然后参照以上权限设置就好，注意，前面已经强调过，主要是设置type，在本例中，即mysqld_db_t。

# 以下脚本以root执行
$ ls -Z /usr/local/mysql
unconfined_u:object_r:usr_t:s0 keyring

$ semanage fcontext -a -t mysqld_db_t "/usr/local/mysql(/.*)?"

$ ls -Z /usr/local/mysql
unconfined_u:object_r:usr_t:s0 keyring

$ restorecon -Rv /usr/local/mysql
Relabeled /usr/local/mysql from unconfined_u:object_r:usr_t:s0 to unconfined_u:object_r:mysqld_db_t:s0
Relabeled /usr/local/mysql/keyring from unconfined_u:object_r:usr_t:s0 to unconfined_u:object_r:mysqld_db_t:s0
Relabeled /usr/local/mysql/keyring/component_keyring_file from unconfined_u:object_r:usr_t:s0 to unconfined_u:object_r:mysqld_db_t:s0

$ ls -Z /usr/local/mysql
unconfined_u:object_r:mysqld_db_t:s0 keyring

经过以上命令，type由usr_t变为了mysqld_db_t。现在MySQL就具备访问/usr/local/mysql目录下文件的权限了。