RHEL 9 SELinux denies web application file access

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Web app writes or reads fail although Unix permissions look correct.

Environment & Reproduction

Permission denied errors appear while SELinux is in enforcing mode.

Root Cause Analysis

Incorrect file context labels, missing booleans, or nonstandard content paths.

Quick Triage

Run getenforce, ls -Z on content paths, and inspect AVC entries in audit logs.

Step-by-Step Diagnosis

Use ausearch -m avc -ts recent and sealert output to map denial to policy expectation.

Solution – Primary Fix

Apply semanage fcontext and restorecon -Rv to keep labels correct after relabeling.

Solution – Alternative Approaches

Check booleans like httpd_can_network_connect and set with setsebool -P when justified.

Verification & Acceptance Criteria

Do not set permissive globally for convenience; fix policy-aligned labels instead.

Rollback Plan

When unavoidable, generate minimal local policy modules from audited denials.

Prevention & Hardening

Restart affected services with systemctl restart after applying context and boolean changes.

Related Errors & Cross-Refs

Standardize deployment paths and include SELinux context checks in release scripts.

Related tutorial: View the step-by-step tutorial for rhel-9.

View all rhel-9 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Confirm no new AVC denials while performing write and read operations in the app.