Troubleshooting SELinux semanage port -a -t mysqld_port_t -p tcp 33061 semanage port -a -t mysqld_port_t -p tcp 33060 semanage port -a -t mysqld_port_t -p tcp 6446 semanage port -a -t mysqld_port_t -p tcp 6447 semanage port -a -t mysqld_port_t -p tcp 64460 semanage port -a -t mysqld_port_t -p tcp 64470 semanage permissive -a mysqld_t semanage permissive -d mysqld_t grep "denied" /var/log/audit/audit.log shell>  systemctl start mysql.service Job for mysqld.service failed because the control process exited with error code. Attempting to start the MySQL service on a non-default data directory with an invalid SELinux context causes the following startup failure. If a MySQL directory or file has an incorrect SELinux context, access may be denied. This issue can occur if MySQL is configured to read from or write to a non-default directory or file. For example, if you configure MySQL to use a non-default data directory, the directory may not have the expected SELinux context. The following sections describes a few common areas where SELinux-related issues may be encountered. SELinux writes logs for denied operations to  /var/log/audit/audit.log . You can check for denials by searching for “denied”  messages. When you are finished troubleshooting, use this command to place the  mysqld_t  domain back into enforcing mode: To avoid placing the entire system into permissive mode using  setenforce , you can permit only the MySQL service to run permissively by placing its SELinux domain ( mysqld_t ) into permissive mode using the  semanage  command: Troubleshooting SELinux typically involves placing SELinux into permissive mode, rerunning problematic operations, checking for access denial messages in the SELinux audit log, and placing SELinux back into enforcing mode after problems are resolved. If SELinux is enabled, you must set the port context for the communication ports used by MySQL Router. Assuming the additional communication ports used by MySQL Router are the default 6446, 6447, 64460 and 64470, on each instance set the port context by issuing: Assuming the X Plugin communication port is 33060, set the port context by issuing: If SELinux is enabled, you must set the port context for the communication port used by X Plugin, which is defined by the  mysqlx_port  variable.  mysqld  must be able to bind to the X Plugin communication port and listen there. Setting the TCP Port Context for Document Store Setting the TCP Port Context for MySQL Router 6.7.6 Troubleshooting SELinux File Contexts 1606