SELinux Denies Web App Access to Custom Directory

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Web service starts but returns permission denied errors when reading content or writing uploads in custom directories.

Environment & Reproduction

RHEL 8 running Apache/Nginx with SELinux in Enforcing mode and application data outside default paths.

Root Cause Analysis

File context labels do not match expected SELinux types for web service domains such as httpd_sys_content_t or httpd_sys_rw_content_t.

Quick Triage

Run sestatus, ls -Z on target directories, and ausearch -m AVC -ts recent to confirm policy denials.

Step-by-Step Diagnosis

Capture AVCs from /var/log/audit/audit.log and generate recommendations with audit2why.

Solution – Primary Fix

Define context mapping with semanage fcontext -a and apply restorecon -Rv. Use setsebool only when policy booleans are explicitly required.

Solution – Alternative Approaches

Retry application action, verify no new AVC denials, and confirm service function under Enforcing mode.

Verification & Acceptance Criteria

Revert fcontext rule with semanage fcontext -d if incorrect, then restore original labels. Avoid permissive as permanent fix.

Rollback Plan

Include SELinux labeling in deployment scripts and validate contexts in CI/CD preflight checks.

Prevention & Hardening

Maintain SELinux Enforcing in production to preserve mandatory access controls and auditability.

Related Errors & Cross-Refs

Deploy Ansible tasks for semanage fcontext and restorecon to keep labels consistent across nodes.

Related tutorial: View the step-by-step tutorial for rhel-8.

View all rhel-8 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

semanage(8), restorecon(8), SELinux Users and Administrators Guide for RHEL 8.