centos7启动mongodb4.4由于selinux权限问题导致报错

环境：

系统：CentOS Linux release 7.9.2009 (Core)
          Linux node1 3.10.0-1160.11.1.el7.x86_64 #1 SMP Fri Dec 18 16:34:56 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
MongoDB：

         > db.version()
         4.4.5

启动MongoDB，报如下错误：

-- Unit mongod.service has begun starting up.
5月 07 15:21:18 localhost.localdomain mongod[2475]: Error parsing YAML config file: yaml-cpp: error at line 37, column 
5月 07 15:21:18 localhost.localdomain mongod[2475]: try '/usr/bin/mongod --help' for more information
5月 07 15:21:18 localhost.localdomain polkitd[802]: Unregistered Authentication Agent for unix-process:2454:512460 (sys
5月 07 15:21:18 localhost.localdomain systemd[1]: mongod.service: control process exited, code=exited status=2
5月 07 15:21:18 localhost.localdomain systemd[1]: Failed to start MongoDB Database Server.
或者如下：

May  6 11:50:08 #localhost setroubleshoot: SELinux is preventing /usr/bin/mongod from read access on the file netstat. For complete SELinux messages run: sealert -l 55ea312e-d8c8-4805-bb99-bc47af79f350
May  6 11:50:08 #localhost python: SELinux is preventing /usr/bin/mongod from read access on the file netstat.#012#012*****  Plugin catchall (100. confidence) suggests   **************************#012#012If you believe that mongod should be allowed read access on the netstat file by default.#012Then you should report this as a bug.#012You can generate a local policy module to allow this access.#012Do#012allow this access for now by executing:#012# ausearch -c 'ftdc' --raw | audit2allow -M my-ftdc#012# semodule -i my-ftdc.pp#012
解决办法，运行如下命令：

先用semanage fcontext -l|grep "mongo"查询monogdb相关的上下文

再运行如下命令进行修改：

semanage fcontext -a -t mongod_log_t '/var/log/'
restorecon -v '/var/log/mongodb/'
semanage fcontext -a -t mongod_exec_t /usr/lib/systemd/system/
semanage fcontext -a -t mongod_exec_t /usr/libexec/
semanage fcontext -a -t mongod_exec_t /usr/bin/
semanage fcontext -a -t mongod_unit_file_t /usr/lib/systemd/system/
semanage fcontext -a -t mongod_initrc_exec_t /etc/rc.d/init.d/
restorecon-v /usr/lib/systemd/system
restorecon -v /usr/lib/systemd/system
restorecon -v /usr/bin
restorecon -v /etc/rc.d/init.d/
restorecon -v /usr/libexec/
semanage fcontext -a -t mongod_var_run_t /var/run
restorecon -v /var/run

semanage命令是查询和修改selinux默认目录的安全上下文

semanage {login|user|port|interface|fcontext|translation} -l 
semanage fcontext -{a|d|m} [-frst] file_spec

restorecon 命令可以将文件或目录恢复成默认的安全上下文