How do I install and use Galera and MariaDB >= version 10.1 with TLS on RHEL 7 or CentOS 7 and keep SELinux enabled in enforcing mode without using SCL (software collections)?

1 Answer 1



  • You are not using RHEL 7 SCL (software collections) or rh-mariadb101{,-galera}
  • You have RHEL 7 / CentOS 7 servers with EPEL already installed
  • SELinux is required, running, and enforcing
  • Firewalld is running and blocks by default
  • Your 3 host IPs are,, and

Firewall Configuration

The ports required for Galera & MariaDB to function properly are TCP ports 4444, 4567, and 4568 and UDP port 4567. MariaDB requires TCP port 3306. In this configuration we assume hosts,, and are permitted to be part of the cluster, as well as a future host IP This configuration also assumes any host is allowed to connect on port 3306. Login and su - to root. Run the following commands.

# firewall-cmd --zone=public --add-port=3306/tcp
# firewall-cmd --zone=public --add-port=3306/tcp --permanent
# firewall-cmd --zone=public --add-rich-rule 'rule family="ipv4" source address="" port port=4444 protocol=tcp accept'
# firewall-cmd --zone=public --add-rich-rule 'rule family="ipv4" source address="" port port=4444 protocol=tcp accept' --permanent
# firewall-cmd --zone=public --add-rich-rule 'rule family="ipv4" source address="" port port=4567 protocol=tcp accept'
# firewall-cmd --zone=public --add-rich-rule 'rule family="ipv4" source address="" port port=4567 protocol=tcp accept' --permanent
# firewall-cmd --zone=public --add-rich-rule 'rule family="ipv4" source address="" port port=4568 protocol=tcp accept'
# firewall-cmd --zone=public --add-rich-rule 'rule family="ipv4" source address="" port port=4568 protocol=tcp accept' --permanent
# firewall-cmd --zone=public --add-rich-rule 'rule family="ipv4" source address="" port port=4567 protocol=udp accept'
# firewall-cmd --zone=public --add-rich-rule 'rule family="ipv4" source address="" port port=4567 protocol=udp accept' --permanent

SELinux Policy Preparation

Login and su - to root. Run or perform the following steps. The last line is only required for a non-default data location. Note that if you set a data location within /home or /usr systemd will prohibit MariaDB from writing and MariaDB will fail. To work around this, set ProtectSystem=false in the unit file /lib/systemd/system/mariadb.service. Then run systemctl daemon-reload.

# mkdir selinux && cd selinux
# cat > galera.te << XYZZY
module galera 1.0;

require {
        type unconfined_t;
        type initrc_tmp_t;
        type rsync_exec_t;
        type init_t;
        type mysqld_t;
        class process setpgid;
        class file { execute execute_no_trans getattr open read };
        class service enable;

#============= mysqld_t ==============
allow mysqld_t initrc_tmp_t:file open;
allow mysqld_t rsync_exec_t:file { execute execute_no_trans getattr open read };
allow mysqld_t self:process setpgid;

#============= unconfined_t ==============
allow unconfined_t init_t:service enable;

# checkmodule -M -m galera.te -o galera.mod
# semodule_package -m galera.mod -o galera.pp
# semodule -i galera.pp
# semanage port -m -t mysqld_port_t -p tcp 4567
# semanage port -m -t mysqld_port_t -p udp 4567
# semanage port -m -t mysqld_port_t -p tcp 4444
# semanage port -m -t mysqld_port_t -p tcp 4568
# semanage fcontext -a -t mysqld_db_t "/alternate/path/to/data/mysql(/.*)?"

MariaDB Repository Addition, Package Installation, Configuration

Download https://yum.mariadb.org/RPM-GPG-KEY-MariaDB. Ensure that web server giving you this key is trustworthy; the security of your new repository depends on this.

# cp RPM-GPG-KEY-MariaDB /etc/pki/rpm-gpg/ ; chmod ugo+r /etc/pki/rpm-gpg/RPM-GPG-KEY-MariaDB
# cat > /etc/yum.repos.d/mariadb.repo << XYZZY
name = MariaDB
baseurl = http://yum.mariadb.org/10.1/rhel7-amd64
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-MariaDB
gpgcheck = 1
enabled = 1
# chmod ugo+r /etc/yum.repos.d/mariadb.repo
# yum install MariaDB-server galera

Once you’ve got the packages installed, you must configure MariaDB per normal procedure before creating the cluster. The first line below is only necessary if you wish to use a different data location from the default.

# mysql_install_db --user=mysql --group=mysql --ldata=/alternate/path/to/data/mysql
# systemctl start mariadb
# mysql_secure_installation
# systemctl stop mariadb
# galera_new_cluster

Check to see if MariaDB + Galera is running. If so, you can configure the next two hosts. Install the SELinux rules and software packages as before, but immediately add the following lines to the [galera] section in /etc/my.cnf.d/server.cnf. Assumes the original galera server’s IP is and its peers will be and Set the cache size to something appropriate for your systems.

wsrep_provider_options="gcache.size=1024M; gcache.page_size=1024M"

# systemctl start mariadb

At this point, logs should indicate that data has replicated from the first server to the current server. Repeat these steps on the remaining server(s).

Now stop MariaDB on the original server and add the galera configuration to /etc/my.cnf.d/server.cnf. Restart MariaDB on the original server. Verify that data is synchronizing between the peers.

Enable TLS

This optional section assumes that you have already generated an X.509v3 certificate and corresponding private key. Both the certificate and key should be stored in unencrypted PEM format. For this example the filenames are assumed to be server.crt and server.key respectively.

# cp server.crt /etc/pki/tls/certs/ ; chmod ugo+r /etc/pki/tls/certs/server.crt ; cp server.key /etc/pki/tls/private/server.key ; chmod 640 /etc/pki/tls/private/server.key ; chgrp mysql /etc/pki/tls/private/server.key

Add the following lines into /etc/my.cnf.d/server.cnf in the [mysqld] section: ssl_cert=/etc/pki/tls/certs/server.crt ssl_key=/etc/pki/tls/private/server.key

Create /etc/systemd/system/mariadb.service.d/TLS.conf with the following content:


Systemd is as systemd does, so run systemctl daemon-reload again to read the new configuration.

Server restart is required in order for MariaDB to accept TLS connections. Note that TLS is available, but not required at this stage of configuration.

Check the logs to verify that MariaDB loaded with TLS enabled: journalctl _SYSTEMD_UNIT=mariadb.service. Failure to start TLS is only logged as a [Warning] :^(

This is my first pass at this. I'll be happy to incorporate improvements :^)

  • Great answer, thanks! I am struggling with this at the moment and was using the often-cited approach of "start up the system in Permissive mode, then parse the entries in audit.log into SELinux modules". Obviously, your approach takes all the guesswork out of that and would be far preferable. However, where did you find the source info for the rules you give, and how can one check whether the rules still cover everything needed for upcoming versions?
    – jstarek
    Apr 29, 2020 at 7:31
  • 1
    The source for the SELinux rules came from /var/log/audit/audit.log; I watched what MariaDB tried to do, then added rules as required. The best way I know to verify if the rules still work on newer releases is to try them by testing those rules with the newer version with SELinux running in enforcing mode. The ideal thing, would be for the MariaDB folks to take SELinux into account and ship their own rules in their RPMs. Hopefully they will in the future :-)
    – Liczyrzepa
    Jul 14, 2020 at 19:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .