SELiunux Make Any Directory Writable by Apache

For any regular hosting for to setup any laravel or wordpress website I do this type of permission

sudo chown -R apache:apache /var/www/html
sudo find /var/www/html -type f -exec chmod 644 {} \;
sudo find /var/www/html -type d -exec chmod 755 {} \;

But in SELinux any directory (and its contents) should have a read-write context for Apache. For for public dir or any dir that needs file uploads should have something like below:

semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/html/public(/.*)?"
restorecon -Rv "/var/www/html/public"
setfacl -R -m u:apache:rwX /var/www/html/public

These three lines are all about making a directory writable by Apache under SELinux, but each line plays a slightly different role. Let’s break them down carefully.

1️⃣ semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/html/public(/.*)?"

• Purpose: Tells SELinux that this directory (and its contents) should have a read-write context for Apache.

• Components:

  • semanage fcontext → manage file contexts (SELinux labels).

  • -a → add a new rule.

  • -t httpd_sys_rw_content_t → type: read-write content for web servers.

  • "/var/www/html/public(/.*)?" → regex pattern:

    • /var/www/html/public → the directory itself
    • (/.*)? → all files and subdirectories under it

• Effect: SELinux knows that files here are allowed to be written by Apache/PHP.

Think of it as marking the folder for write permissions in SELinux’s eyes.

2️⃣ restorecon -Rv "/var/www/html/public"

• Purpose: Applies the SELinux context physically to the filesystem.

• Components:

  • restorecon → restore the SELinux context on a file/directory to what semanage defined.
  • -R → recursively apply to all subdirectories/files.
  • -v → verbose, so you see what changed.

• Effect: Actually sets httpd_sys_rw_content_t on /var/www/html/public and everything inside.

Without this, semanage just records the rule, it doesn’t change existing files.

3️⃣ setfacl -R -m u:apache:rwX /var/www/html/public

• Purpose: Grants actual Linux permissions (Access Control List) for the Apache user.

• Components:

  • setfacl → set file ACLs (extra permissions beyond standard chmod).

  • -R → recursively.

  • -m u:apache:rwX → modify the ACL for user apache:

    • r → read
    • w → write
    • X → execute only if it’s a directory or already executable

• Effect: Ensures Apache can read/write/create files regardless of regular ownership/permissions.

✅ TL;DR

Together, these three lines guarantee that both SELinux and Linux permissions allow Apache/PHP to create or modify files in /var/www/html/public.