RHEL 8 SELinux Denies httpd Binding to Custom Port

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

httpd fails to start on port 8080 while systemctl shows permission-related errors and site downtime occurs.

Environment & Reproduction

Set Listen 8080 in Apache config on RHEL 8 with SELinux enforcing, then restart httpd.

Root Cause Analysis

SELinux policy allows httpd only on labeled http ports unless semanage updates the port context.

Quick Triage

Run getenforce, journalctl -u httpd, and ausearch -m AVC to confirm SELinux denials.

Step-by-Step Diagnosis

Review audit messages, map denials with sealert, and inspect allowed http_port_t assignments.

Solution – Primary Fix

Add the custom port with semanage port -a -t http_port_t -p tcp 8080 and restart httpd.

Solution – Alternative Approaches

If temporary mitigation is required, bind back to an allowed port and front with reverse proxy.

Verification & Acceptance Criteria

httpd starts cleanly, AVC denials stop, and remote clients reach the service on the intended port.

Rollback Plan

Remove custom mapping with semanage port -d and restore original Apache Listen directives.

Prevention & Hardening

Include SELinux policy checks in deployment pipelines instead of disabling SELinux enforcement.

Related Errors & Cross-Refs

Related: AH00072 make_sock could not bind, permission denied, and recurring AVC type=AVC messages.

Related tutorial: View the step-by-step tutorial for rhel-8.

View all rhel-8 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Refer to RHEL 8 SELinux and semanage administration documentation.