# SELinux is preventing /usr/sbin/php-fpm from connectto access

**URL:** <https://forums.rockylinux.org/t/selinux-is-preventing-usr-sbin-php-fpm-from-connectto-access/18598>\
**Category:** Rocky Linux Help & Support\
**Tags:** rocky-linux-9\
**Created:** [May 30, 2025, 6:42am UTC](https://forums.rockylinux.org/t/selinux-is-preventing-usr-sbin-php-fpm-from-connectto-access/18598 "2025-05-30T06:42:47Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![mh\_le](https://avatars.discourse-cdn.com/v4/letter/m/91b2a8/32.png) [@mh\_le](https://forums.rockylinux.org/u/mh_le)\
**Post date:** [May 30, 2025, 6:42am UTC](https://forums.rockylinux.org/t/selinux-is-preventing-usr-sbin-php-fpm-from-connectto-access/18598/1 "2025-05-30T06:42:47Z")

</div>

I am trying to set up Nextcloud, but I am having issues with SELinux, I get the following error in journalctl:

```auto
SELinux is preventing /usr/sbin/php-fpm from connectto access on the unix_stream_socket /var/lib/mysql/mysql.sock.

```

How can I resolve this?

I am using MariaDB 11.4.7 from MariaDB and Rocky 9.5

Any help would be greatly appreciated.

---

<div class="post-metadata">

**Author:** ![jlehtone](https://avatars.discourse-cdn.com/v4/letter/j/e9a140/32.png) [@jlehtone](https://forums.rockylinux.org/u/jlehtone)\
**Post date:** [May 30, 2025, 7:30am UTC](https://forums.rockylinux.org/t/selinux-is-preventing-usr-sbin-php-fpm-from-connectto-access/18598/2 "2025-05-30T07:30:35Z")

</div>

That is what journalctl says. How does `audit2why` formulate it?  
The `audit2allow` can create custom policy (SELinux rules).

---

<div class="post-metadata">

**Author:** ![mh\_le](https://avatars.discourse-cdn.com/v4/letter/m/91b2a8/32.png) [@mh\_le](https://forums.rockylinux.org/u/mh_le)\
**Post date:** [May 30, 2025, 8:34am UTC](https://forums.rockylinux.org/t/selinux-is-preventing-usr-sbin-php-fpm-from-connectto-access/18598/3 "2025-05-30T08:34:54Z")

</div>

Hi, and thank you for your reply!  
The output of audit2why is

```auto
type=AVC msg=audit(1748594013.719:3750): avc: denied { connectto } for pid=5750 comm="php-fpm" path="/var/lib/mysql/mysql.sock" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=unix_stream_socket permissive=1

        Was caused by:
                Missing type enforcement (TE) allow rule.

                You can use audit2allow to generate a loadable module to allow this access.

```

---

<div class="post-metadata">

**Author:** ![jlehtone](https://avatars.discourse-cdn.com/v4/letter/j/e9a140/32.png) [@jlehtone](https://forums.rockylinux.org/u/jlehtone)\
**Post date:** [May 30, 2025, 8:54am UTC](https://forums.rockylinux.org/t/selinux-is-preventing-usr-sbin-php-fpm-from-connectto-access/18598/4 "2025-05-30T08:54:24Z")

</div>

The journalctl got a more humane message from someone. Interesting.  
Anyway, the output of audit2allow (without “create module” option) will be text too, rules.

---

<div class="post-metadata">

**Author:** ![mh\_le](https://avatars.discourse-cdn.com/v4/letter/m/91b2a8/32.png) [@mh\_le](https://forums.rockylinux.org/u/mh_le)\
**Post date:** [May 30, 2025, 8:59am UTC](https://forums.rockylinux.org/t/selinux-is-preventing-usr-sbin-php-fpm-from-connectto-access/18598/5 "2025-05-30T08:59:03Z")

</div>

Got the following output:

```auto
# ausearch -c 'php-fpm' --raw | audit2allow my-phpfpm

#============= httpd_t ==============
allow httpd_t httpd_sys_script_exec_t:dir write;
allow httpd_t httpd_sys_script_exec_t:file { append write };
allow httpd_t unconfined_service_t:unix_stream_socket connectto;
allow httpd_t var_t:file { getattr open read };

#!!!! This avc is allowed in the current policy
allow httpd_t var_t:file map;

```

---

<div class="post-metadata">

**Author:** ![jlehtone](https://avatars.discourse-cdn.com/v4/letter/j/e9a140/32.png) [@jlehtone](https://forums.rockylinux.org/u/jlehtone)\
**Post date:** [May 30, 2025, 9:12am UTC](https://forums.rockylinux.org/t/selinux-is-preventing-usr-sbin-php-fpm-from-connectto-access/18598/6 "2025-05-30T09:12:43Z")

</div>

See `man audit2allow` for examples of making a module policy.

You don’t need to include the `allow httpd_t var_t:file map;` as it is already set.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/rockylinux/original/1X/91b7219eec10e30013422e4df76c1d898711a5d5.svg) [@system](https://forums.rockylinux.org/u/system)\
**Post date:** [July 29, 2025, 9:13am UTC](https://forums.rockylinux.org/t/selinux-is-preventing-usr-sbin-php-fpm-from-connectto-access/18598/7 "2025-07-29T09:13:02Z")

</div>

Closed on July 29, 2025, 9:13am UTC

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.