## 6.7.2 Changing the SELinux Mode 

SELinux supports enforcing, permissive, and disabled modes. Enforcing mode is the default. Permissive mode allows operations that are not permitted in enforcing mode and logs those operations to the SELinux audit log. Permissive mode is typically used when developing policies or troubleshooting. In disabled mode, polices are not enforced, and contexts are not applied to system objects, which makes it difficult to enable SELinux later. 

To view the current SELinux mode, use the sestatus  command mentioned previously or the getenforce  utility. 

shell> getenforce Enforcing 

To change the SELinux mode, use the setenforce  utility: 

shell> setenforce 0 shell> getenforce Permissive 

shell> setenforce 1 shell> getenforce Enforcing 

Changes made with setenforce  are lost when you restart the system. To permanently change the SELinux mode, edit the /etc/selinux/config  file and restart the system. 

## 6.7.3 MySQL Server SELinux Policies 

MySQL Server SELinux policy modules are typically installed by default. You can view installed modules using the semodule -l  command. MySQL Server SELinux policy modules include: 

• myqld_selinux 

• myqld_safe_selinux 

For information about MySQL Server SELinux policy modules, refer to the SELinux manual pages. The manual pages provide information about types and Booleans associated with the MySQL service. Manual pages are named in the service-name _selinux  format. 

man mysqld_selinux 

If SELinux manual pages are not available, refer to your distribution’s SELinux documentation for information about how to generate manual pages using the sepolicy manpage  utility. 

## 6.7.4 SELinux File Context 

The MySQL Server reads from and writes to many files. If the SELinux context is not set correctly for these files, access to the files could be denied. 

The instructions that follow use the semanage  binary to manage file context; on RHEL, it’s part of the policycoreutils-python-utils  package: 

yum install -y policycoreutils-python-utils 

After installing the semanage  binary, you can list MySQL file contexts using semanage  with the fcontext option. 

semanage fcontext -l | grep -i mysql 

