MySQL Secure Deployment Guide  /  Installation Directory and File Permissions

Appendix C Installation Directory and File Permissions

The following table shows directory and file permissions for the generic binary distribution installation of MySQL Enterprise Edition for Linux x86-64 on Oracle Linux that is described in this guide.

As a general rule, distributed files and resources should follow the principal of least privilege, which requires that users, processes, programs, and other system components only have access to information and resources that are required for their legitimate purpose.

As indicated previously, most of the MySQL installation can be owned by root. The exceptions are the data directory, the error log file, the mysql-files directory, the pid file, and the socket file, to which the mysql user must have write access. Files and resources that the mysql user requires read access to include configuration files (/etc/my.cnf) and the MySQL binaries (/usr/local/mysql/bin).

Table C.1 MySQL Linux Generic Binary Installation Directory and File Permissions

File or Resource Location Owner Directory Permissions File Permissions
Client and utility programs directory /usr/local/mysql/bin root drwxr-xr-x  
mysqld server /usr/local/mysql/bin root drwxr-xr-x -rwxr-xr-x
MySQL configuration file /etc/my.cnf root drwxr-xr-x -rw-r--r--
Data directory /usr/local/mysql/data mysql drwxr-x---  
Error log file /usr/local/mysql/data/host_name.err mysql drwxr-x--- -rw-------
secure_file_priv directory /usr/local/mysql/mysql-files mysql drwxr-x---  
mysqld systemd service file /usr/lib/systemd/system/mysqld.service root drwxr-xr-x -rw-r--r--
systemd tmpfiles configuration file /usr/lib/tmpfiles.d/mysql.conf root drwxr-xr-x -rw-r--r--
pid file /usr/local/mysql/data/mysqld.pid mysql drwxr-x--- -rw-r-----
socket file /tmp/mysql.sock mysql drwxrwxrwt srwxrwxrwx
Unix manual pages directory /usr/local/mysql/man root drwxr-xr-x  
Include Header files directory /usr/local/mysql/include root drwxr-xr-x  
Libraries directory /usr/local/mysql/lib root drwxr-xr-x  
Miscellaneous support files directory /usr/local/mysql/support-files root drwxr-xr-x  
Miscellaneous files directory /usr/local/mysql/share root drwxr-xr-x