SELinux Denies httpd Write Access to Web Content

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Web uploads and cache writes fail despite correct Unix permissions, causing application errors and data loss risk.

Environment & Reproduction

Appears after deploying new directories, restoring backups, or mounting content paths without SELinux relabeling.

Root Cause Analysis

File context does not permit `httpd_t` writes, or required SELinux boolean remains disabled.

Quick Triage

Run `getenforce`, `ls -Z`, and `ausearch -m avc -ts recent`; confirm httpd service state via systemctl.

Step-by-Step Diagnosis

Correlate AVC denials with failing path, inspect context type, and review `journalctl -u httpd` for app-level failures.

Solution – Primary Fix

Apply correct context using `semanage fcontext` plus `restorecon`, set required boolean, and restart service.

Solution – Alternative Approaches

Relocate writable paths to standard labeled directories or build minimal policy module when justified.

Verification & Acceptance Criteria

Upload and write operations succeed with SELinux enforcing and no new AVC denials generated.

Rollback Plan

Revert boolean changes and custom labels if behavior regresses, then restore previously functioning path layout.

Prevention & Hardening

Include SELinux context checks in deployment scripts and block releases that create unlabeled writable paths.

Related Errors & Cross-Refs

`ausearch -m avc -ts recent | audit2why && journalctl -u httpd -n 80`

Related tutorial: View the step-by-step tutorial for rhel-7.

View all rhel-7 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

RHEL 7 SELinux User and Administrator Guide, including httpd booleans and labeling workflows.