How to Run MariaDB as a Custom User and Group on RHEL, AlmaLinux and Rocky Linux

Updated: 28 September 2026 · Applies to: MariaDB 10.5, 10.11 and 11.8 from the AlmaLinux, Rocky Linux and RHEL 9 and 10 repositories (systemd)

MariaDB normally runs as the system user mysql. Some security policies or shared setups require it to run as another account. On current systems you do this with a systemd override, not by editing the service file or my.cnf. The start scripts of the AlmaLinux, Rocky Linux and RHEL packages read the user and group from the service, and we tested the result with MariaDB 10.5 on AlmaLinux 9.

Before you start

• Take a backup of your databases (mariadb-dump --all-databases) and stop MariaDB: systemctl stop mariadb.
• Only change this if you must: the default mysql user is what package updates and documentation expect.

Steps

1. Create the new system user and group, without a login shell:

   useradd -r -s /usr/sbin/nologin -d /var/lib/mysql dbsvc

2. Tell systemd to run MariaDB as that user:

   systemctl edit mariadb

   In the editor, add:

   [Service]
   User=dbsvc
   Group=dbsvc

3. Give the new user the data, log and runtime folders:

   chown -R dbsvc:dbsvc /var/lib/mysql /var/log/mariadb /run/mariadb

4. Make the runtime folder get the right owner at every boot. Create /etc/tmpfiles.d/mariadb.conf:

   d /run/mariadb 0755 dbsvc dbsvc -

5. Start MariaDB and check who it runs as:

   systemctl daemon-reload
   systemctl start mariadb
   ps -o user,cmd -C mariadbd

   The first column should show dbsvc.

SELinux

SELinux labels files by type, not by owner, so the change of owner needs no new SELinux rules. If you also move the data folder, label the new location with semanage fcontext -a -t mysqld_db_t "/data/mysql(/.*)?" and restorecon -Rv /data/mysql.

Common problems

• "Permission denied" in the log after the change: a folder or file still belongs to mysql. Check with find /var/lib/mysql /var/log/mariadb ! -user dbsvc.
• The socket or PID file cannot be created after a reboot: the tmpfiles entry in step 4 is missing.
• Going back: remove the override with systemctl revert mariadb, delete /etc/tmpfiles.d/mariadb.conf, and give the folders back to mysql:mysql.

If MariaDB will not start at all, see MySQL or MariaDB fails to start with systemctl.

Official documentation: systemd.exec (User and Group) and MariaDB and systemd.