RHEL 10 – NFS mount permission denied due to SELinux context mismatch – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

NFS share mounts but applications cannot read/write expected paths.

Environment & Reproduction

Occurs with SELinux enforcing and non-standard mount targets.

mount -t nfs server:/share /mnt/share
getenforce
ls -Zd /mnt/share

Root Cause Analysis

SELinux type mismatch or missing booleans blocks access despite valid NFS permissions.

Quick Triage

Collect AVC denials and mount option state.

ausearch -m avc -ts recent
mount | grep nfs
cat /etc/exports

Step-by-Step Diagnosis

Evaluate context labels and required SELinux booleans.

getsebool -a | grep nfs
semanage fcontext -l | grep /mnt/share
ls -lZ /mnt/share

Solution – Primary Fix

Apply proper context and enable required boolean for NFS access pattern.

setsebool -P use_nfs_home_dirs on
semanage fcontext -a -t nfs_t '/mnt/share(/.*)?'
restorecon -Rv /mnt/share

Solution – Alternative Approaches

Use dedicated mount path with policy-compatible context.

mkdir -p /srv/nfsdata
semanage fcontext -a -t nfs_t '/srv/nfsdata(/.*)?'
restorecon -Rv /srv/nfsdata

Verification & Acceptance Criteria

Application can read/write and no new AVC denials appear.

touch /mnt/share/.rw-test
ausearch -m avc -ts recent
rm -f /mnt/share/.rw-test

Rollback Plan

Revert custom context/boolean changes if broader policy impact is observed.

semanage fcontext -d '/mnt/share(/.*)?'
setsebool -P use_nfs_home_dirs off
restorecon -Rv /mnt/share

Prevention & Hardening

Include SELinux label validation in NFS onboarding procedures.

findmnt -t nfs
ls -Zd /mnt/share

Related Errors & Cross-Refs

Related to firewalld NFS service rules and idmapd domain mismatch.

Related tutorial: View the step-by-step tutorial for rhel-10.

View all rhel-10 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

RHEL NFS and SELinux integration documentation.