CentOS Stream 9 – Common Problem 054 – Diagnosis and Fix

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Service fails to start and audit.log shows AVC denied entries.

Environment & Reproduction

Happens after relocating files or upgrading services on CentOS Stream 9.

Root Cause Analysis

File contexts on non-default paths don’t match policy.

Quick Triage

Tail `/var/log/audit/audit.log` and grep for `AVC`.

Step-by-Step Diagnosis

Use `ausearch -m AVC -ts recent` and `sealert -a`.

Solution – Primary Fix

Restore default contexts with `restorecon -Rv /path` to the affected tree.

Solution – Alternative Approaches

If a custom path is required, add via `semanage fcontext -a -t ‘/path(/.*)?’`.

Verification & Acceptance Criteria

The service starts and no further AVC denials are logged.

Rollback Plan

Toggle to permissive temporarily with `setenforce 0` while gathering data.

Prevention & Hardening

Always set custom contexts in policy; avoid permanent permissive mode.

Related Errors & Cross-Refs

Related to httpd, nginx, container, and mount-point denials.

Related tutorial: View the step-by-step tutorial for centos-stream-9.

View all centos-stream-9 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

SELinux user’s guide and `audit2allow` workflow.