HTTP Service Starts but SELinux Blocks Outbound Connection

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Web app can serve local pages but fails when calling external APIs or databases over network.

Environment & Reproduction

RHEL 8 with SELinux Enforcing and httpd/php-fpm based workloads requiring outbound network access.

Root Cause Analysis

SELinux boolean controlling network connectivity for web domain is disabled by default.

Quick Triage

Run ausearch -m AVC -ts recent and getsebool -a | grep httpd_can_network_connect.

Step-by-Step Diagnosis

Extract AVC records showing denied name_connect attempts by httpd_t domain.

Solution – Primary Fix

Enable required boolean with setsebool -P httpd_can_network_connect on and restart affected services if needed.

Solution – Alternative Approaches

Retry outbound call from application and confirm no new AVC denials in audit logs.

Verification & Acceptance Criteria

If boolean is not acceptable, redesign to local proxy/service account pattern with approved SELinux policy.

Rollback Plan

Include SELinux boolean requirements in application deployment documentation and preflight checks.

Prevention & Hardening

Only enable booleans required by business function; document rationale and approval in change records.

Related Errors & Cross-Refs

Use configuration management to enforce required SELinux booleans and verify state drift.

Related tutorial: View the step-by-step tutorial for rhel-8.

View all rhel-8 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

getsebool(8), setsebool(8), and SELinux web service policy references for RHEL 8.