Linux · medium · Core system faults

SELinux is blocking an application (AVC denial)

The file permissions are correct and the operation still fails, because SELinux policy does not allow that process type to touch that file type.

What you see

A service cannot read a file, bind a port or write a directory, despite ls showing the right ownership and mode. Setting the service to permissive makes it work.

What is actually wrong

The file has the wrong SELinux context — very common after moving files with mv, restoring from a backup, or putting web content outside /var/www. Or the action genuinely needs a boolean turning on.

Codes and articles

avc: deniedSELinux is preventingPermission denied13 (Permission denied)

Fixes (2)

Set the right file context — do not disable SELinux

Shell as root20 minuteslow riskreversible

A file or directory access is being denied.

Confirm it really is SELinux and read the denial.
Shell
```
sudo ausearch -m AVC,USER_AVC -ts recent | tail -40
```
Get the human-readable explanation, which usually names the exact fix.
Shell
```
sudo sealert -a /var/log/audit/audit.log | head -60
```
Compare the context on the problem path with one that works.
Shell
```
ls -Z /srv/www/index.htmlls -Z /var/www/html/index.html
```
mv preserves the original context; cp assigns the destination's. That single difference is behind most of these.
Add a permanent context rule for the path, then apply it.
Shell
```
sudo semanage fcontext -a -t httpd_sys_content_t '/srv/www(/.*)?'sudo restorecon -Rv /srv/www
```
semanage writes the rule to policy so it survives a relabel; restorecon alone would be undone the next time the filesystem is relabelled.
If the app needs to write as well, use httpd_sys_rw_content_t for those directories only.
Check whether a boolean covers what you need before writing a custom policy.
Shell
```
getsebool -a | grep httpd | grep ' on$\| off$'
```

Confirm it workedThe operation succeeds and no new AVC is logged.

Shell

sudo ausearch -m AVC -ts recent | tail -5

If you need to undo itsudo semanage fcontext -d '/srv/www(/.*)?' then restorecon -Rv /srv/www.

Allow a service to bind a non-standard port

Shell as root10 minuteslow riskreversible

A daemon cannot bind the port you configured.

See which ports the type is already allowed.
Shell
```
sudo semanage port -l | grep http_port_t
```

Add the port to the type.

Shell

sudo semanage port -a -t http_port_t -p tcp 8085

If it reports the port is already defined under another type, modify instead of adding.
Shell
```
sudo semanage port -m -t http_port_t -p tcp 8085
```
Restart the service.
Shell
```
sudo systemctl restart httpd
```

Confirm it workedThe service is listening on the port.

Shell

sudo ss -tlnp | grep 8085

If you need to undo itsudo semanage port -d -t http_port_t -p tcp 8085

Related faults

Where this stops. This write-up was written and checked by hand. It says what each step changes, how to confirm it worked and how to reverse it, and anything destructive is flagged before you reach it. If it does not match what your machine is doing, search the Support Centre for the exact code or message — and when something needs a person, get in touch.