...

The system needs to access the following, commonly guarded (encrypted) folders: 

• /var/lib/mysql

• /var/lib/mysql/mysql.sock

...

Access to GuardPoints

The resource is relative to the GuardPoint. In other words, if the GuardPoint is /var/lib/mysql, and you want to allow access to a particular file in that directory, you would only need to specify that specific file in your resource parameter.

...