Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How do I go about troubleshooting the following error below:

type=AVC msg=audit(1365523330.609:4846): avc:  denied  { append } for  pid=12542 comm="" name="user_list" dev=dm-0 ino=2884237 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file

Was caused by:
    Unknown - would be allowed by active policy
    Possible mismatch between this policy and the one under which the audit message was generated.

    Possible mismatch between current in-memory boolean settings vs. permanent ones.

There wasn't much documentation on this particular error.

share|improve this question
Please specify the steps that lead to this situation, e.g. custom modules, custom booleans, commands you issued, specially setsebool, semodule, and friends. – dawud Apr 9 '13 at 18:16
This is not necessarily a solution, but a suggestion so that you can familiarize yourself with selinux, policy creation, etc... Install setroubleshoot. It will issue verbatim instructions for using tools like audit2allow to generate policies that mitigate issues on an individual basis. On new server installs I always run selinux in permissive mode until I have everything installed and tested. After which I check the /var/log/audit/audit.log and update the policy using audit2allow. – burf Jul 21 '15 at 18:31
You can also pipe your avc denial, or the log itself into audit2why and see if there is a boolean that will address the issue. In which case, you can use setsebool to fix it. – burf Jul 21 '15 at 18:37

Check the apache logs for the actual file causing the problem (for me it was hopefully you'll find a line in the error log like

Cannot load /opt/coldfusion10/config/wsconfig/1/ into server: /opt/coldfusion10/config/wsconfig/1/ failed to map segment from shared object: Permission denied

then compare the selinux permissions of that file with the permissions of the http executable. for me they were

# ls -ldZ /opt/coldfusion10/config/wsconfig/1/
-rwxr-xr-x. nobody nobody unconfined_u:object_r:httpd_log_t:s0 /opt/coldfusion10/config/wsconfig/1/
# ls -ldZ /usr/sbin/httpd
-rwxr-xr-x. root root system_u:object_r:httpd_exec_t:s0 /usr/sbin/httpd

You can see the has different permissions to the httpd binary. To fix it, simply make them the same

# sudo chcon -R -u system_u -r object_r -t httpd_exec_t /opt/coldfusion10/config/wsconfig/1/ 

Now they match, and for me apache started up again (without compromising my server security)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.