When executing an automated database restore or point-in-time log replay on a Linux target host...

SELinux enforcing mode permits access only when files, directories, mount points, and processes carry labels allowed by the active policy. NDB’s supported model uses database-engine-specific SELinux configuration and policies so restored storage paths receive the expected security contexts and remain accessible after attachment. This is why predefined contexts and file policies tailored to the database paths are the valid mechanism. NDB does not guarantee restores by switching the host to permissive mode, because that would suspend enforcement. It also does not install kernel-bypass modules or disable auditing. Dynamically inventing policies during every restore would be operationally unsafe and inconsistent with the documented requirement to prepare SELinux for the relevant database engine. Correctly applied persistent contexts allow the kernel to authorize mount and database access while SELinux remains fully enforcing. Nutanix describes the supported model in Security-Enhanced Linux Configuration.