CentOS Stream 10 – Common Problem 179 – Diagnosis and Fix

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Services fail to bind sockets or open files with SELinux AVC denials in audit.log.

Environment & Reproduction

Common after package upgrades that change file contexts.

getenforce
ls -Z /var/www

Root Cause Analysis

File contexts or booleans no longer match what the service expects.

Quick Triage

Capture recent denials before changing policy.

ausearch -m AVC -ts recent
sealert -a /var/log/audit/audit.log | head

Step-by-Step Diagnosis

Identify the missing context or boolean.

audit2why < /var/log/audit/audit.log
audit2allow -a -m local

Solution – Primary Fix

Relabel files and toggle the required boolean.

restorecon -Rv /var/www
setsebool -P httpd_can_network_connect on

Solution – Alternative Approaches

Build a targeted local policy module for the exception.

audit2allow -a -M local
semodule -i local.pp

Verification & Acceptance Criteria

Service starts and audit.log shows no new denials.

ausearch -m AVC -ts recent
systemctl status httpd

Rollback Plan

Remove the local policy or revert booleans.

semodule -r local
setsebool -P httpd_can_network_connect off

Prevention & Hardening

Audit denials weekly and codify booleans in config management.

ausearch -m AVC -ts today | tee /var/log/avc-daily.log

Related Errors & Cross-Refs

Permission denied, EACCES, AVC denials at boot.

Related tutorial: View the step-by-step tutorial for centos-stream-10.

View all centos-stream-10 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

SELinux user guide, audit2allow tips.