The Problem
Your PHP app needs to write uploaded files. DAC permissions are correct but uploads fail. The AVC log reveals:
avc: denied { write } for comm="httpd"
scontext=system_u:system_r:httpd_t:s0
tcontext=unconfined_u:object_r:httpd_sys_content_t:s0
tclass=filehttpd_sys_content_t is read-only. Apache can read but not write.
Master this topic with hands-on labs
Go beyond reading — build real projects in sandboxed environments with expert video guidance.
Browse Courses →The Solution: httpd_sys_rw_content_t
| Label | Permissions |
|---|---|
httpd_sys_content_t | Read-only |
httpd_sys_rw_content_t | Read + Write |
httpd_sys_script_exec_t | Execute (CGI) |
Step-by-Step
1. Create the upload directory
mkdir -p /srv/webroot/upload
chown apache: /srv/webroot/upload/2. Quick test
chcon -t httpd_sys_rw_content_t /srv/webroot/upload3. Make it persistent
semanage fcontext -a -t httpd_sys_rw_content_t '/srv/webroot/upload(/.*)?'
restorecon -Rv /srv/webroot/upload4. Verify
ls -Zd /srv/webroot/upload
system_u:object_r:httpd_sys_rw_content_t:s0 /srv/webroot/uploadGet weekly IT automation tips
Docker, Ansible, Terraform, MLOps — curated insights delivered to your inbox. No spam.
Subscribe Free →Why Separate Labels Matter
Only directories that need writes get httpd_sys_rw_content_t. This limits damage if an attacker exploits a vulnerability — they can only write to the upload directory, not the entire webroot.
Anti-Pattern
# DON'T: Makes everything writable
chcon -t httpd_sys_rw_content_t -R /srv/webrootOnly label directories that need writes.
Practice this in our SELinux for System Admins course.
---
Ready to go deeper? Check out our hands-on course: SELinux for System Admins — practical exercises you can follow along on your own machine.
Ready to learn by doing?
Stop reading tutorials — start building. Expert video courses with hands-on labs in real sandboxed environments.
Related Articles
Fix SELinux Apache Custom Webroot
Step-by-step guide to fix SELinux 403 Forbidden errors when using a custom Apache DocumentRoot like /srv/webroot on RHEL.
SELinux Cheat Sheet for RHEL
Quick reference for essential SELinux commands on RHEL 9/10. Modes, contexts, labels, booleans, logs, and troubleshooting in one page.
SELinux for Apache and PHP-FPM
Configure Apache with PHP-FPM over TCP on RHEL with SELinux enforcing. Diagnose and fix name_connect denials using the correct SELinux boolean and audit tools.
Sigstore Container Image Signing
Sigstore provides keyless signing for container images and software artifacts. Learn how to sign images with Cosign, verify signatures in Kubernetes.
Skupper Multi-Cluster Kubernetes
Skupper connects Kubernetes services across clusters without VPNs or special networking. Learn how to set up multi-cluster communication with Skupper.
Snyk Developer Security Platform
Snyk finds and fixes vulnerabilities in code, dependencies, containers, and infrastructure as code. Learn how to integrate Snyk into your development workflow.
Explore topics
Browse more articles on the topics covered here.