## Setting the TCP Port Context for Document Store 

semanage port -a -t mysqld_port_t -p tcp 33061 

If SELinux is enabled, you must set the port context for the communication port used by X Plugin, which is defined by the mysqlx_port  variable. mysqld  must be able to bind to the X Plugin communication port and listen there. 

Assuming the X Plugin communication port is 33060, set the port context by issuing: 

## Setting the TCP Port Context for MySQL Router 

semanage port -a -t mysqld_port_t -p tcp 33060 

If SELinux is enabled, you must set the port context for the communication ports used by MySQL Router. Assuming the additional communication ports used by MySQL Router are the default 6446, 6447, 64460 and 64470, on each instance set the port context by issuing: 

## 6.7.6 Troubleshooting SELinux 

semanage port -a -t mysqld_port_t -p tcp 6446 semanage port -a -t mysqld_port_t -p tcp 6447 semanage port -a -t mysqld_port_t -p tcp 64460 semanage port -a -t mysqld_port_t -p tcp 64470 

Troubleshooting SELinux typically involves placing SELinux into permissive mode, rerunning problematic operations, checking for access denial messages in the SELinux audit log, and placing SELinux back into enforcing mode after problems are resolved. 

To avoid placing the entire system into permissive mode using setenforce , you can permit only the MySQL service to run permissively by placing its SELinux domain ( mysqld_t ) into permissive mode using the semanage  command: 

semanage permissive -a mysqld_t 

When you are finished troubleshooting, use this command to place the mysqld_t  domain back into enforcing mode: 

semanage permissive -d mysqld_t 

SELinux writes logs for denied operations to /var/log/audit/audit.log . You can check for denials by searching for “denied”  messages. 

grep "denied" /var/log/audit/audit.log 

The following sections describes a few common areas where SELinux-related issues may be encountered. 

## File Contexts 

If a MySQL directory or file has an incorrect SELinux context, access may be denied. This issue can occur if MySQL is configured to read from or write to a non-default directory or file. For example, if you configure MySQL to use a non-default data directory, the directory may not have the expected SELinux context. 

Attempting to start the MySQL service on a non-default data directory with an invalid SELinux context causes the following startup failure. 

shell> systemctl start mysql.service Job for mysqld.service failed because the control process exited with error code. 

