I have installed httpd and php on a fresh centos7 and put some files into /var/www/html including an install script I wrote. This script needs to write to a config file in the /var/www/html directory. I created an empty config file and chowned it to apache:apache. However trying to fopen this file with write access always gives the error:

fopen(/var/www/html/config-local.php): failed to open stream: Permission denied

Doing research I read this quote: "in order to reach a file, ALL parent directories must be readable." So I checked and they are. /, /var, /var/www and /var/www/html are all readable by everyone.

So what's going on here? It appears that the apache user is some kind of specially restricted user since testing the same scenario with a standard user works fine.

  • "in order to reach a file, ALL parent directories must be readable" -- orthogonal to your problem, but this statement is incorrect. All parent directories must be executable in order to reach a file. – womble Jun 30 '17 at 5:39

It's likely an SELinux permissions issue. /var/log/audit/audit.log should be able to confirm.

SELinux context is probably system_u:object_r:httpd_sys_content_t:s0, but should be system_u:object_r:httpd_sys_rw_content_t:s0. This can be altered with chcon.

I'm also not sanguine about having a config file within the DocumentRoot of your webserver. I could be mistaken as you haven't provided enough detail, but that would be the case if you haven't altered the defaults.

  • i had just discovered that it was an SELinux problem: chcon -t httpd_sys_rw_content_t config-local.php re config file location - it's not an uncommon scenario to put it there. wordpress does that. – jpro Jun 30 '17 at 3:31
  • consider using semanage to update the fcontext definition or restorecond; which should be running, may eventually put it back to the incorrect context. chcon changes can be easily reverted by moving files around or by restorecond. – Aaron Jun 30 '17 at 12:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.