restorecon -Rv /var/lib/mysql-files 

Edit this path if you used a different location. For security purposes, this directory should never be within the data directory. 

For more information about this variable, see the secure_file_priv  documentation. 

## 6.7.5 SELinux TCP Port Context 

The instructions that follow use the semanage  binary to manage port context; on RHEL, it’s part of the policycoreutils-python-utils  package: 

yum install -y policycoreutils-python-utils 

After installing the semanage  binary, you can list ports defined with the mysqld_port_t  context using semanage  with the port  option. 

## 6.7.5.1 Setting the TCP Port Context for mysqld 

shell> semanage port -l | grep mysqld mysqld_port_t tcp 1186, 3306, 63132-63164 

The default TCP port for mysqld  is 3306 ; and the SELinux context type used is mysqld_port_t . 

If you configure mysqld  to use a different TCP port , you may need to set the context for the new port. For example to define the SELinux context for a non-default port such as port 3307: 

## 6.7.5.2 Setting the TCP Port Context for MySQL Features 

semanage port -a -t mysqld_port_t -p tcp 3307 

To confirm that the port is added: 

shell> semanage port -l | grep mysqld mysqld_port_t tcp 3307, 1186, 3306, 63132-63164 

If you enable certain MySQL features, you might need to set the SELinux TCP port context for additional ports used by those features. If ports used by MySQL features do not have the correct SELinux context, the features might not function correctly. 

The following sections describe how to set port contexts for MySQL features. Generally, the same method can be used to set the port context for any MySQL features. For information about ports used by MySQL features, refer to the MySQL Port Reference. 

From MySQL 8.0.14 to MySQL 8.0.17, the mysql_connect_any  SELinux boolean must be set to ON . As of MySQL 8.0.18, enabling mysql_connect_any  is not required or recommended. 

## Setting the TCP Port Context for Group Replication 

setsebool -P mysql_connect_any=ON 

If SELinux is enabled, you must set the port context for the Group Replication communication port, which is defined by the group_replication_local_address  variable. mysqld  must be able to bind to the Group Replication communication port and listen there. InnoDB Cluster relies on Group Replication so this applies equally to instances used in a cluster. To view ports currently used by MySQL, issue: 

semanage port -l | grep mysqld 

Assuming the Group Replication communication port is 33061, set the port context by issuing: 

