CentOS Stream 9 – Common Problem 068 – Diagnosis and Fix

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Nginx returns 502 with `permission denied` connecting to upstream.

Environment & Reproduction

SELinux blocks nginx from connecting to non-default ports.

Root Cause Analysis

Boolean `httpd_can_network_connect` is off.

Quick Triage

Tail `/var/log/audit/audit.log` and grep `nginx`.

Step-by-Step Diagnosis

Confirm with `sealert -a /var/log/audit/audit.log`.

Solution – Primary Fix

Enable boolean: `setsebool -P httpd_can_network_connect 1`.

Solution – Alternative Approaches

If upstream uses a custom port, label it appropriately.

Verification & Acceptance Criteria

Reverse proxy returns 200 from upstream.

Rollback Plan

Disable the boolean again if a tighter policy is preferred.

Prevention & Hardening

Use module-specific contexts rather than broad booleans.

Related Errors & Cross-Refs

Linked to httpd context for ports and reverse proxies.

Related tutorial: View the step-by-step tutorial for centos-stream-9.

View all centos-stream-9 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

SELinux httpd boolean reference.