It's problematic to have socket inside datadir as liberal access
rights to socket file is required. Moving socket to
/var/run/mysqld/mysql.sock is the correct solution, however it might
break a number of applications which for years have used
/var/lib/mysql/mysql.sock.

For existing Linux distributions we change permissions of datadir to
more strict mode of 0751 (previous mode was 0755).