RHEL 7 SELinux Denies httpd Write Access to Web Content

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Web uploads or cache writes fail while Apache appears up. systemctl and service show running state, but application behavior is broken and journalctl reflects permission issues.

Environment & Reproduction

Typical on RHEL 7 when content paths were moved, restored, or copied without preserving labels. firewalld may be correct, yet SELinux policy blocks write operations.

Root Cause Analysis

Incorrect file context, missing booleans, or custom policy gaps are primary causes. yum package updates can alter policy packages and expose latent mislabeling.

Quick Triage

Check getenforce, run ls -Z on affected paths, inspect audit AVCs, and review journalctl -u httpd. Confirm network path through firewalld and service health.

Step-by-Step Diagnosis

Identify denied class and type, map required context with semanage fcontext, and confirm whether a boolean is required. Validate app and service user permissions.

Solution – Primary Fix

Apply correct SELinux contexts with restorecon, set required booleans, and restart httpd via systemctl. Validate write path and keep firewalld and yum state unchanged unless required.

Solution – Alternative Approaches

Create a minimal custom SELinux module, refactor writable paths, or use tmpfs-backed directories with approved labels.

Verification & Acceptance Criteria

Writes succeed without AVC denials, systemctl status is healthy, and journalctl no longer reports blocked operations. Application tests pass end-to-end.

Rollback Plan

Revert fcontext definitions and booleans to prior values if behavior regresses. Restore previous service config and package state with yum history as needed.

Prevention & Hardening

Enforce labeling checks in deployment pipelines and prohibit ad hoc chmod/chown fixes. Keep SELinux enforcing and monitor AVC bursts through journalctl pipelines.

Related Errors & Cross-Refs

Related cases include php-fpm socket denials and NFS content context mismatch. See linked tutorial 9054 for SELinux troubleshooting patterns.

Related tutorial: View the step-by-step tutorial for rhel-7.

View all rhel-7 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Consult man selinux, man semanage-fcontext, man restorecon, man systemctl, man service, man firewall-cmd, man yum, and man journalctl.