Configure the MongoDB SELinux Policy

Supported Platforms

MongoDB provides an SELinux policy for use with mongod. This is available for MongoDB Enterprise and MongoDB Community on systems that use:

• Red Hat Enterprise Linux or related distributions

• MongoDB installed with the package manager

Supported Configuration

If your MongoDB deployment uses a custom value for any of the following settings, you cannot use the MongoDB SELinux policy:

• Connection Ports: Default MongoDB Port

• Data Directory: dbPath

• Log Directory: path

• Process ID Path: pidFilePath

Policy Coverage

The MongoDB SELinux policy only covers mongod. If you want to use SELinux on a system that also uses mongos, mongosh, or mongocryptd, you need to configure a custom policy.

Backward Compatibility

You must run the following command from the directory into which the SELinux policy was previously cloned before you can downgrade to an earlier MongoDB version:

sudo make uninstall

Customize SELinux Policies

You can customize the MongoDB SELinux policy with the semanage command. For example, to add port 30000 to mongod_port_t, run the following command:

sudo semanage port -at mongod_port_t -p tcp 30000

This configures SELinux to allow TCP connections on both the standard MongoDB ports and port 30000.

Enforcement

SELinux enforces policies by default, which means it blocks processes that violate its configured restrictions. In development environments, users sometimes disable SELinux or configure it to log but permit all operations. Before you begin, check that SELinux is enforcing its policies.

To check which mode SELinux is in, run the following command:

getenforce

Enforcing

If the command returns Permissive, you can reset it to enforcing with the setenforce command:

sudo setenforce 1

To make the change persistent, set the SELINUX variable in the /etc/selinux/config file:

SELINUX=enforcing