Sample Header Ad - 728x90

chcon: failed to change context of ‘/usr/sbin/httpd’, Permission denied

0 votes
2 answers
3239 views
I am new to SELiunx concept and as per the [RHEL7 > SELinux User's and Administrator's Guide > 3.2. UNCONFINED PROCESSES](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/selinux_users_and_administrators_guide/sect-security-enhanced_linux-targeted_policy-unconfined_processes) **Audit log** type=IPC msg=audit(1624375715.312:4225): ouid=0 ogid=0 mode=0666 obj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 type=PROCTITLE msg=audit(1624375715.312:4225): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44 type=AVC msg=audit(1624375724.580:4226): avc: denied { unix_read unix_write } for pid=25626 comm="httpd" key=1392707921 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=shm permissive=0 type=SYSCALL msg=audit(1624375724.580:4226): arch=c000003e syscall=29 success=no exit=-13 a0=53030951 a1=4338 a2=1b6 a3=6b items=0 ppid=25612 pid=25626 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null) I have changed the httpd to run in unconfind_t domain but now I am not able to change back the httpd to httpd_t domain. I made httpd to unconfined_t domain to make shmget function to work, called by one php process hosted by httpd. [user@rhel7 ~]$ sudo chcon -t bin_t /usr/sbin/httpd [user@rhel7 ~]$ ls -Z /usr/sbin/httpd -rwxr-xr-x. root root system_u:object_r:bin_t:s0 /usr/sbin/httpd [user@rhel7 ~]$ systemctl start httpd.service ..... [root@rhel7 user]# chcon -r system_r -t httpd_t /usr/sbin/httpd chcon: failed to change context of ‘/usr/sbin/httpd’ to ‘system_u:system_r:httpd_t:s0’: Permission denied [root@rhel7 user]#
Asked by Aryaman Gupta (61 rep)
Jun 22, 2021, 04:49 PM
Last activity: Jun 16, 2025, 02:11 PM