FIPS Support See "systemctl status mysqld.service" and "journalctl -xe" for details. In this case, a “denial”  message is logged to  /var/log/audit/audit.log : shell>  grep "denied" /var/log/audit/audit.log type=AVC msg=audit(1587133719.786:194): avc: denied { write } for pid=7133 comm="mysqld" name="mysql" dev="dm-0" ino=51347078 scontext=system_u:system_r:mysqld_t:s0 tcontext=unconfined_u:object_r:default_t:s0 tclass=dir permissive=0 For information about setting the proper SELinux context for MySQL directories and files, see Section 6.7.4, “SELinux File Context” . SELinux expects services such as MySQL Server to use specific ports. Changing ports without updating the SELinux policies may cause a service failure. The  mysqld_port_t  port type defines the ports that the MySQL listens on. If you configure the MySQL Server to use a non-default port, such as port 3307, and do not update the policy to reflect the change, the MySQL service fails to start: Port Access shell>  systemctl start mysqld.service Job for mysqld.service failed because the control process exited with error code. See "systemctl status mysqld.service" and "journalctl -xe" for details. In this case, a denial message is logged to  /var/log/audit/audit.log : shell>  grep "denied" /var/log/audit/audit.log type=AVC msg=audit(1587134375.845:198): avc: denied { name_bind } for pid=7340 comm="mysqld" src=3307 scontext=system_u:system_r:mysqld_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket permissive=0 For information about setting the proper SELinux port context for MySQL, see Section 6.7.5, “SELinux TCP Port Context” . Similar port access issues can occur when enabling MySQL features that use ports that are not defined with the required context. For more information, see Section 6.7.5.2, “Setting the TCP Port Context for MySQL Features” . SELinux may not be aware of application changes. For example, a new release, an application extension, or a new feature may access system resources in a way that is not permitted by SELinux, resulting in access denials. In such cases, you can use the  audit2allow  utility to create custom policies to permit access where it is required. The typical method for creating custom policies is to change the SELinux mode to permissive, identify access denial messages in the SELinux audit log, and use the  audit2allow  utility to create custom policies to permit access. Application Changes For information about using the  audit2allow  utility, refer to your distribution’s SELinux documentation. If you encounter access issues for MySQL that you believe should be handled by standard MySQL SELinux policy modules, please open a bug report in your distribution’s bug tracking system. MySQL supports FIPS mode, if compiled using OpenSSL 1.0.2, and an OpenSSL library and FIPS Object Module are available at runtime. FIPS mode on the server side applies to cryptographic operations performed by the server. This includes replication (source/replica and Group Replication) and X Plugin, which run within the server. FIPS mode also applies to attempts by clients to connect to the server. 6.8 FIPS Support 1607