diff --git a/mariadb.spec b/mariadb.spec
index 26d34e7..5a8c118 100644
--- a/mariadb.spec
+++ b/mariadb.spec
@@ -1463,6 +1463,7 @@ fi
   Resolves: #1485777
 - Allow 4567 port for tcp as well
 - Install mysql-wait-ready on RHEL-6 for the SysV init
+- Run mysql-prepare-db-dir as non-root
 
 * Sun Aug 20 2017 Honza Horak <hhorak@redhat.com> - 3:10.2.8-1
 - Rebase to 10.2.8
diff --git a/mysql.init.in b/mysql.init.in
index 146fcfa..01c5d5b 100644
--- a/mysql.init.in
+++ b/mysql.init.in
@@ -69,8 +69,8 @@ start(){
 	# already running, do nothing
 	action $"Starting $prog: " /bin/true
     else
-        @libexecdir@/mysql-prepare-db-dir $MYUSER $MYGROUP || return 4
         @libexecdir@/mysql-check-socket || return 1
+        su - $MYUSER -s /bin/bash -c "@libexecdir@/mysql-prepare-db-dir $MYUSER $MYGROUP" || return 4
 
 	# Pass all the options determined above, to ensure consistent behavior.
 	# In many cases mysqld_safe would arrive at the same conclusions anyway