How to debug un-listed selinx permissions problems for httpd?

edit

The best answer on finding hidden denials was given by randomuser: ausearch --message avc --start today

That lets me find the python denials without trekking to the server and opening a local GUI. That reveals the Local ID of the denials. Then I can use sealert --lookupid $id (for example sealert --lookupid 02edf874-c2ce-46f2-a18f-f8254a43cacf) to display the details of the denial, and some possible fixes. In this case, the best chose was to set the selinux contexts for both the mercurial web directory and the all the repository directories. Here is the belt-and-suspenders bash script I used to correct permissions and security contexts. I hope it helps someone, or at least myself in the future. The echos are there for reassurance, as some commands took more than 20 minutes to run on my server.

#!/bin/bash
#Remember that semanage fcontext uses regular expressions, not bash globbing
set -e
set -u

hg_web_dir=/var/mercurial
hg_repo_dir=/var/repositories/mercurial

echo chown hguser:repo_users "$hg_web_dir"/*
sudo chown hguser:repo_users "$hg_web_dir"/*
echo chown -R hguser:repo_users "$hg_repo_dir"
sudo chown -R hguser:repo_users "$hg_repo_dir"

sudo chmod 664 "$hg_web_dir""/"*
sudo chmod 775 "$hg_web_dir""hgwebdir.fcgi"

echo find "$hg_repo_dir" -type f -exec sudo chmod 664 {} \;
find      "$hg_repo_dir" -type f -exec sudo chmod 664 {} \;
echo find "$hg_repo_dir" -type d -exec sudo chmod 775 {} \;
find      "$hg_repo_dir" -type d -exec sudo chmod 775 {} \;

echo semanage fcontext --add --type httpd_sys_content_t     "$hg_web_dir""(/.*)?"
sudo semanage fcontext --add --type httpd_sys_content_t     "$hg_web_dir""(/.*)?"
echo semanage fcontext --add --type httpd_sys_script_exec_t "$hg_web_dir""/hgwebdir.fcgi"
sudo semanage fcontext --add --type httpd_sys_script_exec_t "$hg_web_dir""/hgwebdir.fcgi"
echo semanage fcontext --add --type httpd_sys_rw_content_t  "$hg_repo_dir""(/.*)?"
sudo semanage fcontext --add --type httpd_sys_rw_content_t  "$hg_repo_dir""(/.*)?"

echo restorecon -R "$hg_web_dir"
sudo restorecon -R "$hg_web_dir"
echo restorecon -R "$hg_repo_dir"
sudo restorecon -R "$hg_repo_dir"