CentOS Stream 9 – Common Problem 070 – Diagnosis and Fix

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

httpd fails to start with `permission denied` on a non-standard port.

Environment & Reproduction

SELinux restricts httpd to a fixed set of ports.

Root Cause Analysis

The required port is not labeled `http_port_t`.

Quick Triage

Run `semanage port -l | grep http_port_t` to list allowed ports.

Step-by-Step Diagnosis

Check audit logs for the AVC matching the bind attempt.

Solution – Primary Fix

Add the port: `semanage port -a -t http_port_t -p tcp `.

Solution – Alternative Approaches

Open the port in firewalld and reload.

Verification & Acceptance Criteria

`systemctl start httpd` succeeds; service listens on the new port.

Rollback Plan

Remove the port label if the port is no longer needed.

Prevention & Hardening

Document port-label changes in your config repo.

Related Errors & Cross-Refs

Linked to firewalld and SELinux http_port_t entries.

Related tutorial: View the step-by-step tutorial for centos-stream-9.

View all centos-stream-9 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Apache and SELinux integration guide.