SELinux Denies httpd Outbound Network Connections

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Web applications on RHEL 7 fail to reach backend APIs because SELinux policy blocks httpd outbound network access.

Environment & Reproduction

Application pages error at runtime, while curl from shell works and httpd service itself appears active.

Root Cause Analysis

SELinux boolean for network connections is disabled or custom policy does not permit required destination access.

Quick Triage

Run getenforce, getsebool -a | grep httpd_can_network_connect, and inspect service health with systemctl status httpd.

Step-by-Step Diagnosis

Review audit logs and journalctl for AVC denials tied to httpd_t context and blocked socket operations.

Solution – Primary Fix

Capture boolean and context state before changing policy controls, then test with minimal required permissions.

Solution – Alternative Approaches

Enable required boolean with setsebool -P httpd_can_network_connect on, restart httpd, and validate application calls.

Verification & Acceptance Criteria

Ensure firewalld also allows egress to backend destination ports; both SELinux policy and firewall policy must align.

Rollback Plan

Confirm web transactions succeed and verify httpd remains healthy via systemctl status and journalctl -u httpd.

Prevention & Hardening

If change is not acceptable, set boolean off and implement a narrower custom SELinux policy module.

Related Errors & Cross-Refs

Define required SELinux booleans during provisioning and test application network paths in staging.

Related tutorial: View the step-by-step tutorial for rhel-7.

View all rhel-7 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Use sepolicy and setsebool documentation alongside RHEL 7 SELinux web server hardening guides.