SELinux vs AppArmor, without folklore

SELinux and AppArmor are both mandatory access control systems. They sit above normal file permissions and can deny an action that chmod would otherwise allow. When a write fails after you set a sensible mode, you are often looking at MAC, not a broken permission bit. The two tools are not interchangeable: your guest usually runs one of them, and advice written for the other will not help.

getenforce 2>/dev/null || true
aa-status 2>/dev/null | head || true
ls -Z /var/www 2>/dev/null | head

Run those commands first so you know which system is present. If getenforce reports Enforcing, AppArmor profile tips from an Ubuntu guide will do nothing useful. If aa-status lists loaded profiles, SELinux booleans will not apply. On LogicWeb shared hosting you do not manage either layer; CageFS handles isolation there. On a VPS the default belongs to your template, and you keep or change it on purpose.

Ubuntu-based guests often ship AppArmor. AlmaLinux and Rocky Linux guests often ship SELinux. Mixing both sets of advice in one session is a common way to disable the system you actually have.

Find the real denial

Reproduce the failed write, then inspect the path with ls -Z, not only ls -l. A PHP process writing outside the document root may need a correct type such as httpd_sys_rw_content_t, or your distro’s equivalent, rather than a looser mode. Read the AVC from the journal with ausearch or journalctl | grep AVC. On AppArmor, check dmesg for lines that include apparmor="DENIED". The message may say “Permission denied,” but the cause can still be MAC.

Try restorecon -v on the path when SELinux is in use. If the denial continues, a boolean such as httpd_can_network_connect, or a small local policy module, is the next step. audit2allow can help build that module; it is not a reason to leave the system off. A narrow rule for one path is safer than turning MAC off entirely.

Keep enforcing while you fix the app

Enforcing is the normal operating mode. Permissive only logs what would have been blocked. Disabled removes the control until you turn it back on. Note which mode you chose in your runbook, because a later kernel or package update will not remind you. If you already switched to permissive, return to enforcing after the rule exists, not merely after the site loads once.

Booleans such as httpd_can_network_connect exist because default policy often assumes a web app should not open outbound connections. A store talking to a payment API may need that boolean set persistently with your distro’s tools, or a small policy module, instead of a disabled MAC stack. After the change, keep enforcing and confirm the app still works. If it only works with MAC off, the rule is not finished yet.

What this means on LogicWeb

Shared hosting customers do not tune SELinux or AppArmor; the platform isolates accounts for you. On a KVM VPS you have root, so the guest’s default is yours to understand and maintain. Check which MAC system the template enabled, fix denials with context and policy, and avoid setenforce 0 as a standing workaround for WordPress or other web apps.