after disabling and enabling SELinux the Apache and MySQL cannot start, this error shows in messages.log:

imjournal: rename() failed for new path: '/var/lib/rsyslog/imjournal.state': Permission denied [v8.24.0-34.el7 try http://www.rsyslog.com/e/0 ]


ausearch -ts recent -m avc -i:

type=PROCTITLE msg=audit(06/17/2019 12:50:55.444:179) : 
proctitle=/usr/sbin/httpd -DFOREGROUND 
type=SYSCALL msg=audit(06/17/2019 12:50:55.444:179) : arch=x86_64 
syscall=open success=no exit=EACCES(Permission denied) a0=0x55edf621f410 
a1=O_WRONLY|O_CREAT|O_APPEND|O_CLOEXEC a2=0666 a3=0x7ffc3f67e060 items=0 
ppid=1 pid=3966 auid=unset uid=root gid=root euid=root suid=root fsuid=root 
egid=root sgid=root fsgid=root tty=(none) ses=unset comm=httpd 
exe=/usr/sbin/httpd subj=system_u:system_r:httpd_t:s0 key=(null) 
type=AVC msg=audit(06/17/2019 12:50:55.444:179) : avc:  denied  { append } 
for  pid=3966 comm=httpd name=error.log dev="vda1" ino=318782163 
tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=file permissive=0 


SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Max kernel policy version:      31
  • Could you please rerun your commands and then add the output of ausearch -ts recent -m avc -i, sestatus, and journalctl -u rsyslog to your question. Also, which CentOS version are you running? I found access.redhat.com/solutions/3693211 as well, does this apply to you? – Edward Jun 17 at 12:49
  • I updated my question @Edward – Adnan Jun 17 at 12:56
  • Thanks. I see an access denied error for the Apache error.log. Are you sure that file has the correct SELinux context set? – Edward Jun 17 at 13:08
  • I set up apache step by step with digitalocean.com/community/tutorials/… article. Please look at Step 5 in this article @Edward – Adnan Jun 17 at 13:13
  • OK. Then I think something went wrong with applying the sudo semanage fcontext -a -t httpd_log_t "/var/www/example.com/log(/.*)?" and sudo restorecon -R -v /var/www/example.com/log steps because the file context of the error.log file isn't OK. Look at the the audit log: it states the error.log file has the httpd_sys_content_t context, but it should have the httpd_log_t context. Could you show us the directory structure in place and the file contexts (ls -laZ)? – Edward Jun 17 at 14:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.