Install MongoDB Community Edition on Red Hat or CentOS¶

By default, MongoDB runs using the mongod user account and uses the following default directories:默认情况下，MongoDB使用mongod用户帐户运行，并使用以下默认目录：

• /var/lib/mongo (the data directory)
• /var/log/mongodb (the log directory)

➤ If you installed via the package manager,如果您是通过软件包管理器安装的，

The default directories are created, and the owner and group for these directories are set to mongod.将创建默认目录，并将这些目录的所有者和组设置为mongod。

➤ If you installed by downloading the tarballs,如果你是通过下载tarballs安装的，

The default MongoDB directories are not created.不会创建默认的MongoDB目录。To create the MongoDB data and log directories:要创建MongoDB数据和日志目录，请执行以下操作：

sudo mkdir -p /var/lib/mongo sudo mkdir -p /var/log/mongodb

By default, MongoDB runs using the mongod user account.默认情况下，MongoDB使用mongod用户帐户运行。Once created, set the owner and group of these directories to mongod:创建后，将这些目录的所有者和组设置为mongod：

sudo chown -R mongod:mongod <directory>

To use a data directory and/or log directory other than the default directories:要使用默认目录以外的数据目录和/或日志目录，请执行以下操作：

1. Create the new directory or directories.创建一个或多个新目录。
2. Edit the configuration file /etc/mongod.conf and modify the following fields accordingly:编辑配置文件/etc/mongod.conf文件并相应修改以下字段：
   • storage.dbPath to specify a new data directory path (e.g. /some/data/directory)指定新的数据目录路径（例如/some/data/directory）
   • systemLog.path to specify a new log file path (e.g. /some/log/directory/mongod.log)指定新的日志文件路径（例如/some/log/directory/mongod.log)
3. Ensure that the user running MongoDB has access to the directory or directories:确保运行MongoDB的用户可以访问以下目录：

   sudo chown -R mongod:mongod <directory>

   If you change the user that runs the MongoDB process, you must give the new user access to these directories.如果更改运行MongoDB进程的用户，则必须授予新用户访问这些目录的权限。

4. Configure SELinux if enforced. 配置SELinux（如果强制）。See Configure SELinux.请参见配置SELinux。

The current SELinux Policy does not allow the MongoDB process to access /sys/fs/cgroup, which is required to determine the available memory on your system. If you intend to run SELinux in enforcing mode, you will need to make the following adjustment to your SELinux policy:

1. Ensure your system has the checkpolicy package installed:

   sudo yum install checkpolicy

2. Create a custom policy file mongodb_cgroup_memory.te:

   cat > mongodb_cgroup_memory.te <<EOF
   module mongodb_cgroup_memory 1.0;
   
   require {
   type cgroup_t;
   type mongod_t;
   class dir search;
   class file { getattr open read };
   }
   
   #============= mongod_t ==============
   allow mongod_t cgroup_t:dir search;
   allow mongod_t cgroup_t:file { getattr open read };
   EOF

3. Once created, compile and load the custom policy module by running these three commands:创建后，通过运行以下三个命令编译并加载自定义策略模块：

   checkmodule -M -m -o mongodb_cgroup_memory.mod mongodb_cgroup_memory.te semodule_package -o mongodb_cgroup_memory.pp -m mongodb_cgroup_memory.mod sudo semodule -i mongodb_cgroup_memory.pp

The MongoDB process is now able to access the correct files with SELinux set to enforcing.MongoDB进程现在可以在SELinux设置为enforced的情况下访问正确的文件。

The current SELinux Policy does not allow the MongoDB process to open and read /proc/net/netstat, which is required for Full Time Diagnostic Data Capture (FTDC).当前的SELinux策略不允许MongoDB进程打开和读取/proc/net/netstat，这是全职诊断数据捕获（FTDC）所必需的。If you intend to run SELinux in enforcing mode, you will need to make the following adjustment to your SELinux policy:如果要在enforcing模式下运行SELinux，则需要对SELinux策略进行以下调整：

1. Ensure your system has the checkpolicy package installed:确保系统已安装checkpolicy包：

   sudo yum install checkpolicy

2. Create a custom policy file mongodb_proc_net.te:

   cat > mongodb_proc_net.te <<EOF
   module mongodb_proc_net 1.0;
   
   require {
   type proc_net_t;
   type mongod_t;
   class file { open read };
   }
   
   #============= mongod_t ==============
   allow mongod_t proc_net_t:file { open read };
   EOF

3. Once created, compile and load the custom policy module by running these three commands:

   checkmodule -M -m -o mongodb_proc_net.mod mongodb_proc_net.te semodule_package -o mongodb_proc_net.pp -m mongodb_proc_net.mod sudo semodule -i mongodb_proc_net.pp

1. Update the SELinux policy to allow the mongod service to use the new directory:

   sudo semanage fcontext -a -t <type> </some/MongoDB/directory.*>

   where specify one of the following types as appropriate:

   • mongod_var_lib_t for data directory
   • mongod_log_t for log file directory
   • mongod_var_run_t for pid file directory

   Note

   Be sure to include the .* at the end of the directory.

2. Update the SELinux user policy for the new directory:

   sudo chcon -Rv -u system_u -t <type> </some/MongoDB/directory>

   where specify one of the following types as appropriate:

   • mongod_var_lib_t for data directory
   • mongod_log_t for log directory
   • mongod_var_run_t for pid file directory
3. Apply the updated SELinux policies to the directory:

   restorecon -R -v </some/MongoDB/directory>

For example:例如：

• If using a non-default MongoDB data path of /mongodb/data:

  sudo semanage fcontext -a -t mongod_var_lib_t '/mongodb/data.*'
  sudo chcon -Rv -u system_u -t mongod_var_lib_t '/mongodb/data'
  restorecon -R -v '/mongodb/data'

• If using a non-default MongoDB log directory of /mongodb/log (e.g. if the log file path is /mongodb/log/mongod.log):

  sudo semanage fcontext -a -t mongod_log_t '/mongodb/log.*'
  sudo chcon -Rv -u system_u -t mongod_log_t '/mongodb/log'
  restorecon -R -v '/mongodb/log'