SELinux Preventing Apache Start

selinux

When running in strict mode, SELinux would not let me start HTTPD since my mod_jk.so module was copied from an external server.

I copied mod_jk.so externally since I couldn't find the package to install it.

But, now, in order to run HTTPD, I need to put SELinux in Permissive mode.

I read on the wiki that I could add a custom policy to allow this mod_jk.so to be used.

Is this the recommended way so that I can use my external mod_jk.so file?

Best Answer

List the current security context of the file:

# ls -lrtZ /full/path/to/mod_jk.so

Compare the output with the expected context for that path:

# matchpathcon /full/path/to/mod_jk.so

Restore the expected security context of the file:

# restorecon -v /full/path/to/mod_jk.so

Restart the web server and check for new AVC denials:

# ausearch -m avc -ts recent

Related Topic