Troubleshooting SELinux on Files and Directories

Trying to run systemctl start httpd will error. Running journalctl -xe will show lines similar to this:

Jan 09 20:32:46 Server1 httpd[7107]: (13)Permission denied: AH00091: httpd: could not open error log file /etc/httpd/l>
Jan 09 20:32:46 Server1 httpd[7107]: AH00015: Unable to open logs

It looks like a problem with the error log file, which is /var/log/httpd/error_log.

ls -lZ /var/log/httpd/error_log shows:

-rw-r--r--. 1 root root unconfined_u:object_r:admin_home_t:s0 0 Jan  9 20:17 /var/log/httpd/error_log

So let's use restorecon.

restorecon /var/log/httpd/error_log
systemctl start httpd

The service starts!

Based on /etc/httpd/conf.d/userdir.conf we should have a public_html directory in the developer's home directory. Since we don't, let's create it, set the permissions to 755, set the home directory permissions to 711, and see what happens with a test file:

mkdir /home/developer/public_html
chmod 0755 /home/developer/public_html
chmod 0711 /home/developer
touch /home/developer/public_html/file
curl localhost/~developer/file

We're still getting an error. Looking at /var/log/audit/audit.log, we see an AVC denial for the file we're trying to load, so it's SELinux related.

The contexts are correct, but the enable homedir boolean defaults to off.

setsebool httpd_enable_homedirs on

Now the curl should work correctly.

The instructions say to move the index page, so let's do it:

mv /home/developer/index.html /home/developer/public_html/index.html
curl localhost/~developer/index.html

That failed. Let's look at SELinux contexts.