# After update selinux no access to mariadb from apache cms **URL:** \ **Category:** Rocky Linux Help & Support\ **Tags:** rocky-linux-9\ **Created:** [February 16, 2025, 6:28pm UTC](https://forums.rockylinux.org/t/after-update-selinux-no-access-to-mariadb-from-apache-cms/17575 "2025-02-16T18:28:29Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![robkalmeijer](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/robkalmeijer/32/6039_2.png) [@robkalmeijer](https://forums.rockylinux.org/u/robkalmeijer)\ **Post date:** [February 16, 2025, 6:28pm UTC](https://forums.rockylinux.org/t/after-update-selinux-no-access-to-mariadb-from-apache-cms/17575/1 "2025-02-16T18:28:29Z")
Rocky linux 9.5 2025-02-05T21:53:45+0100 SUBDEBUG Upgrade: mysql-selinux-1.0.13-1.el9\_5.noarch **Coppermine critical error** : Unable to connect to database ! MySQLi said: **2002 : Permission denied** also wordpress, nextcloud, roundcube are not working. Looks like selinux problem. Before the update verything worked. Only prodosy was not working with mariadb. mariadb -u root -p wokrks normal. ---
**Author:** ![iwalker](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/iwalker/32/2599_2.png) [@iwalker](https://forums.rockylinux.org/u/iwalker)\ **Post date:** [February 16, 2025, 6:50pm UTC](https://forums.rockylinux.org/t/after-update-selinux-no-access-to-mariadb-from-apache-cms/17575/2 "2025-02-16T18:50:56Z")
```auto setsebool -P httpd_can_network_connect 1 ``` or more restrictive for DB only: ```auto setsebool -P httpd_can_network_connect_db 1 ``` ---
**Author:** ![robkalmeijer](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/robkalmeijer/32/6039_2.png) [@robkalmeijer](https://forums.rockylinux.org/u/robkalmeijer)\ **Post date:** [February 16, 2025, 7:39pm UTC](https://forums.rockylinux.org/t/after-update-selinux-no-access-to-mariadb-from-apache-cms/17575/3 "2025-02-16T19:39:02Z")
Was already set but it is not the problem. [root@server5 log]# getsebool -a | grep httpd httpd\_anon\_write → off httpd\_builtin\_scripting → on httpd\_can\_check\_spam → off httpd\_can\_connect\_ftp → off httpd\_can\_connect\_ldap → off httpd\_can\_connect\_mythtv → off httpd\_can\_connect\_zabbix → off httpd\_can\_manage\_courier\_spool → off httpd\_can\_network\_connect → on httpd\_can\_network\_connect\_cobbler → off httpd\_can\_network\_connect\_db → on httpd\_can\_network\_memcache → off httpd\_can\_network\_relay → off httpd\_can\_sendmail → on httpd\_dbus\_avahi → off httpd\_dbus\_sssd → off httpd\_dontaudit\_search\_dirs → off httpd\_enable\_cgi → on httpd\_enable\_ftp\_server → off httpd\_enable\_homedirs → off httpd\_execmem → off httpd\_graceful\_shutdown → off httpd\_manage\_ipa → off httpd\_mod\_auth\_ntlm\_winbind → off httpd\_mod\_auth\_pam → off httpd\_read\_user\_content → off httpd\_run\_ipa → off httpd\_run\_preupgrade → off httpd\_run\_stickshift → off httpd\_serve\_cobbler\_files → off httpd\_setrlimit → off httpd\_ssi\_exec → off httpd\_sys\_script\_anon\_write → off httpd\_tmp\_exec → off httpd\_tty\_comm → off httpd\_unified → off httpd\_use\_cifs → off httpd\_use\_fusefs → off httpd\_use\_gpg → off httpd\_use\_nfs → off httpd\_use\_opencryptoki → off httpd\_use\_openstack → off httpd\_use\_sasl → off httpd\_verify\_dns → off [root@server5 log]# getsebool -a | grep mysql mysql\_connect\_any → off mysql\_connect\_http → off selinuxuser\_mysql\_connect\_enabled → off ---
**Author:** ![gerry666uk](https://avatars.discourse-cdn.com/v4/letter/g/dbc845/32.png) [@gerry666uk](https://forums.rockylinux.org/u/gerry666uk)\ **Post date:** [February 16, 2025, 8:32pm UTC](https://forums.rockylinux.org/t/after-update-selinux-no-access-to-mariadb-from-apache-cms/17575/4 "2025-02-16T20:32:02Z")
You can try running as root `rpm -q audit` `ausearch -m AVC` ---
**Author:** ![iwalker](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/iwalker/32/2599_2.png) [@iwalker](https://forums.rockylinux.org/u/iwalker)\ **Post date:** [February 16, 2025, 8:41pm UTC](https://forums.rockylinux.org/t/after-update-selinux-no-access-to-mariadb-from-apache-cms/17575/5 "2025-02-16T20:41:39Z")
You can also make sure `policycoreutils-python-utils` package is installed, and use: ```auto audit2why -a ``` which will give a load of information as to what the selinux violation is, and also: ```auto audit2allow -a ``` should also give some suggestions/hints for it as well. ---
**Author:** ![raffraff](https://avatars.discourse-cdn.com/v4/letter/r/e19adc/32.png) [@raffraff](https://forums.rockylinux.org/u/raffraff)\ **Post date:** [February 21, 2025, 11:40am UTC](https://forums.rockylinux.org/t/after-update-selinux-no-access-to-mariadb-from-apache-cms/17575/6 "2025-02-21T11:40:31Z")
Check Cockpit in browser, if you need a GUI. https://[servername]:9090/selinux ---
**Author:** ![robkalmeijer](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/robkalmeijer/32/6039_2.png) [@robkalmeijer](https://forums.rockylinux.org/u/robkalmeijer)\ **Post date:** [February 23, 2025, 1:20pm UTC](https://forums.rockylinux.org/t/after-update-selinux-no-access-to-mariadb-from-apache-cms/17575/7 "2025-02-23T13:20:08Z")
> Blockquote ``` > audit2why -a ````auto type=AVC msg=audit(1740316502.077:26155): avc: denied { connectto } for pid=989 comm="php-fpm" path="/var/lib/mysql/mysql.sock" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=unix_stream_socket permissive=0 Was caused by: Missing type enforcement (TE) allow rule. > Blockquote ``` audit2allow -a ```` #============= awstats\_t ============== allow awstats\_t node\_t:udp\_socket node\_bind; #============= httpd\_t ============== allow httpd\_t unconfined\_service\_t:unix\_stream\_socket connectto; #============= postfix\_cleanup\_t ============== allow postfix\_cleanup\_t mysqld\_etc\_t:file open; #============= postfix\_smtpd\_t ============== allow postfix\_smtpd\_t mysqld\_etc\_t:file read; Have als the same problem with prosody but this is not shown. Hoe to allow? ---
**Author:** ![gerry666uk](https://avatars.discourse-cdn.com/v4/letter/g/dbc845/32.png) [@gerry666uk](https://forums.rockylinux.org/u/gerry666uk)\ **Post date:** [February 23, 2025, 7:37pm UTC](https://forums.rockylinux.org/t/after-update-selinux-no-access-to-mariadb-from-apache-cms/17575/8 "2025-02-23T19:37:35Z")
Looks like you are trying to connect from php-fpm to local mysql unix socket (not tcp) Very similar discussion here [https://forums.almalinux.org/t/selinux-php-fpm-httpd-and-mariadb-socket-connection/1626](https://forums.almalinux.org/t/selinux-php-fpm-httpd-and-mariadb-socket-connection/1626) Check that all your packages are Rocky official as well. ---
**Author:** ![John316](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/john316/32/4991_2.png) [@John316](https://forums.rockylinux.org/u/John316)\ **Post date:** [February 25, 2025, 10:57pm UTC](https://forums.rockylinux.org/t/after-update-selinux-no-access-to-mariadb-from-apache-cms/17575/9 "2025-02-25T22:57:14Z")
1. Have you made sure the selinux context is correct on the files and directories. 2. Do you have setroubleshoot-server installed? The program sealert will help troubleshoot selinux issues. 3. If you set selinux to not enforcing, does everything work? If it does, then you may need to make your own policy and install it to selinux. ---
**Author:** ![jlehtone](https://avatars.discourse-cdn.com/v4/letter/j/e9a140/32.png) [@jlehtone](https://forums.rockylinux.org/u/jlehtone)\ **Post date:** [February 26, 2025, 6:53am UTC](https://forums.rockylinux.org/t/after-update-selinux-no-access-to-mariadb-from-apache-cms/17575/10 "2025-02-26T06:53:28Z")
SELinux at _enforcing_ denies and logs actions that policy does not allow. SELinux at _permissive_ logs but allows actions that policy does not allow. Since denying one action will prevent followup actions, those are not logged when enforcing. Hence permissive gives better picture of everything that policy might need. However, all actions are not logged by default. See `man semanage-dontaudit` * * * The `audit2why` ought to tell all the things that sealert/setroubleshoot tells. * * * > [@robkalmeijer](#): > > Hoe to allow? The `man audit2allow` has an examples of steps to create and load a module policy. ---
**Author:** ![robkalmeijer](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/robkalmeijer/32/6039_2.png) [@robkalmeijer](https://forums.rockylinux.org/u/robkalmeijer)\ **Post date:** [March 2, 2025, 7:59pm UTC](https://forums.rockylinux.org/t/after-update-selinux-no-access-to-mariadb-from-apache-cms/17575/11 "2025-03-02T19:59:14Z")
I found the solution. CMS in apache working again. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/rockylinux/original/1X/91b7219eec10e30013422e4df76c1d898711a5d5.svg) [@system](https://forums.rockylinux.org/u/system)\ **Post date:** [May 1, 2025, 7:59pm UTC](https://forums.rockylinux.org/t/after-update-selinux-no-access-to-mariadb-from-apache-cms/17575/12 "2025-05-01T19:59:53Z")
Closed on May 1, 2025, 7:59pm UTC This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.