SELinux blocks httpd access to content

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Apache returns 403 or cannot read files despite correct Unix permissions.

Environment & Reproduction

RHEL 7 with SELinux enforcing and web content moved to non-default path.

Root Cause Analysis

Incorrect SELinux context labels or missing boolean for network/file access pattern.

Quick Triage

Run getenforce and check recent denials with ausearch -m avc -ts recent.

Step-by-Step Diagnosis

Use sealert -a /var/log/audit/audit.log and ls -Z on content directories to pinpoint label mismatch.

Solution – Primary Fix

Apply semanage fcontext and restorecon -Rv, then set required booleans via setsebool -P.

Solution – Alternative Approaches

For temporary testing only, permissive mode can isolate SELinux influence before policy update.

Verification & Acceptance Criteria

HTTP responses return 200 and no new AVC denials appear during workload replay.

Rollback Plan

Revert fcontext rules and boolean changes using documented pre-change values.

Prevention & Hardening

Include SELinux context checks in deployment pipeline for web content paths.

Related Errors & Cross-Refs

AVC denied { read }, httpd permission denied, AH00035 access denied.

Related tutorial: View the step-by-step tutorial for rhel-7.

View all rhel-7 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

SELinux User and Administrator Guide, semanage man page, Apache on RHEL docs.