SELinux AVC Denials Breaking Web Application Access

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Application gets permission denied despite correct UNIX ownership.

Environment & Reproduction

Run getenforce and ausearch -m AVC -ts recent to identify denials.

Root Cause Analysis

Determine if issue is file context, port labeling, or boolean policy.

Quick Triage

New path or custom port is unlabeled for the service SELinux domain.

Step-by-Step Diagnosis

Apply correct context with semanage fcontext and restorecon.

Solution – Primary Fix

Set required boolean or port type and retest application behavior.

Solution – Alternative Approaches

Restart service using systemctl and confirm successful request flow.

Verification & Acceptance Criteria

Ensure firewalld rules are also open so SELinux is not the only change.

Rollback Plan

Keep SELinux enforcing; avoid permanent setenforce 0 as a fix.

Prevention & Hardening

Use journalctl and /var/log/audit/audit.log to validate no new AVCs.

Related Errors & Cross-Refs

Document required contexts and booleans in deployment automation.

Related tutorial: View the step-by-step tutorial for rhel-9.

View all rhel-9 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Revert specific semanage changes if they were incorrectly applied.