Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running a stock RHEL6 installation and have pointed my httpd DocumentRoot to /path/does/exist (it exists!). I've granted permission to the apache user and added what I thought should be the necessary label via:

chcon -R  -t httpd_sys_content_t /path/does

but no dice.

audit2why shows a missing type enforcement allow rule for a request that looks like

avc:  denied  { search } for  pid=4793
   comm="httpd" name="/"  

Can someone help me interpret? Please note that I'm not looking for the answer "disable selinux" :-)



share|improve this question
up vote 3 down vote accepted

You will need to apply the following (assuming that path is /www)

chcon -R -u system_u /www
chcon -R -t httpd_sys_content_t /www

And then make it survive a label:

semanage fcontext -a -s system_u -t httpd_sys_content_t /www

What I find it is easier to use another directory as a template when apply SELinux context to a directory:

drwxr-xr-x. root root unconfined_u:object_r:default_t:s0 www
[root@kvm0001 /]# chcon --reference=/var/www www
[root@kvm0001 /]# ls -laZ
drwxr-xr-x. root root system_u:object_r:httpd_sys_content_t:s0 www
[root@kvm0001 /]#
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.