SELinux Allowances for Chart Rendering

These instructions assume SELinux is enforcing. PHP ChartDirector runs as a child of APPX and writes a local image file. It does not need an HTTP port or a web-server SELinux boolean. The permissions that matter are the APPX process domain, access to PHP and the ChartDirector libraries, and access to the chart directory.

On fresh Rocky 9 and Rocky 10 systems, the documented PHP installation and the shipped APPX simple-bar chart worked with SELinux enforcing. A systemd-launched APPX session ran in unconfined_service_t and rendered successfully. No additional ChartDirector allow module or SELinux boolean was required. Your service may use a different domain; check it before copying a policy change from another installation.

Check the paths used by the failing session

If a chart fails, reproduce it once through the APPX session that failed. Then inspect the process contexts, path labels and recent denials:

ps -eZ | grep -E 'appx|php'
ls -ldZ /opt/ChartDirector /opt/ChartDirector/lib \
  /var/lib/appx-charts
ls -lZ /usr/bin/php /opt/ChartDirector/lib/phpchartdir830.dll \
  /opt/ChartDirector/lib/libchartdir.so
sudo ausearch -m AVC,USER_AVC -ts recent -i

Use your actual library and chart paths. PHP may have finished before ps runs; the audit event still records the denied process, its source context (scontext), the target context (tcontext), the object class and the denied permission. Match the event's time, executable and path to the chart request before changing policy. A permission error with no matching AVC may be an ordinary ownership, directory-traversal or filesystem permission problem.

Restore an incorrect label

Files copied from a home directory or unpacked in a temporary directory can retain an unsuitable label. Compare their current labels with the policy's expected labels:

matchpathcon -V /opt/ChartDirector/lib/phpchartdir830.dll
matchpathcon -V /opt/ChartDirector/lib/libchartdir.so
matchpathcon -V /var/lib/appx-charts
sudo restorecon -Rv /opt/ChartDirector /var/lib/appx-charts

restorecon applies the file-context rules already installed on your server. It does not grant a new permission. Retry the chart after correcting a label. For different installation paths, substitute those paths in every command.

A service with a confined SELinux domain

Your APPX service may use a site-specific confined domain. Check the actual scontext in its denial; a successful test from an administrator's shell does not establish that the service has access.

The service needs to execute its selected PHP CLI, read the PHP configuration and include files, load the ChartDirector native libraries, read the fonts and any chart image assets, and create and update files in its dedicated chart directory. Give chart-output write access only to that directory. PHP and ChartDirector program files need read and execute access, not runtime write access.

Use the file types provided by that service's existing policy. If a dedicated chart-output type already exists, add a persistent mapping for the exact chart directory with semanage fcontext, then apply it with restorecon. The type name depends on your policy; substituting a web-content type does not establish that APPX can use it. Keep a local policy exception limited to the source domain, destination type, object class and permissions identified in the matching AVC. Review those rules before installing them. There is no single additional APPX or ChartDirector allow module required by every installation.

Rocky 9 compatibility container on Rocky 10

The container command earlier in this chapter uses :Z on each dedicated bind mount. Podman assigns a private container label so that the APPX process inside that container can use its data and chart directories while the host remains enforcing. Do not apply that private relabel to a directory shared with unrelated services. Your host paths will differ if you chose another container location.

After rendering, confirm the new PNG exists and review the matching audit interval again. Keep SELinux enforcing while correcting a label or adding a narrowly scoped policy rule.