apparmor

dmesg | grep -i apparmor | grep mysqld

[ 1237.535694] audit: type=1400 audit(1766687118.766:257): apparmor="DENIED" operation="mknod" class="file" profile="/usr/sbin/mysqld" name="/data/error.log" pid=5153 comm="mysqld" requested_mask="c" denied_mask="c" fsuid=108 ouid=108