Fix 'Cannot manage PHP versions' when CageFS is disabled

The CloudLinux PHP Selector error "Cannot manage PHP versions: CageFS is disabled" looks like a single problem but covers three distinct failure modes. They have to be ruled out in order — the diagnostic for each one masks the next.

The audience here is a sysadmin staring at a customer ticket. Skip the explainer; below is the decision tree and the exact commands.

1. pam_lve in /etc/pam.d/sudo blocks the switch

The Selector enters the user's cage via sudo to swap interpreters. If pam_lve.so is loaded for the sudo stack, the LVE wrapper short-circuits the cage entry and the Selector reports CageFS disabled — even though CageFS is fine.

grep pam_lve /etc/pam.d/sudo

If the line exists, comment it out:

sed -i 's/^\(.*pam_lve.*\)/#\1/' /etc/pam.d/sudo

No service restart needed — PAM rereads on the next sudo invocation. Reload the PHP Selector page in cPanel. If the error persists, move to step 2.

2. CageFS is not enabled for the affected user

CageFS can be enabled globally but disabled per-user. Check the user's status:

cagefsctl --user-status username

Expected output: Enabled. If it reads Disabled, enable it:

cagefsctl --enable username

A bulk fix for "every user should be caged" is cagefsctl --enable-all. Note this only flips the toggle — it doesn't rebuild the cage skeleton, which is step 3.

To audit who's outside the cage:

cagefsctl --list-disabled

A long list usually means a previous admin used the WHM-level toggle to turn CageFS off for "convenience". Re-enable per user and audit shell sessions for hardcoded paths that broke.

3. CageFS skeleton is broken or missing

The cage skeleton is the read-only set of bind mounts and base files under /usr/share/cagefs-skeleton/. If a yum transaction was interrupted, or someone deleted files thinking they were stale, the cage mounts incompletely and the Selector reports disabled.

Symptom: cagefsctl --user-status username says Enabled but switching PHP versions still fails. Look for Cannot mount or Skeleton incomplete lines in /var/log/messages.

Rebuild the skeleton and remount everyone:

cagefsctl --force-update
cagefsctl --remount-all

--force-update repopulates the skeleton from the installed RPMs. --remount-all re-binds every active user cage against the rebuilt skeleton. On a server with 200 users this takes 2-3 minutes; sessions hold during the remount.

Verify the user is now properly caged:

cagefsctl --user-status username
su - username -c 'ls /etc'   # should show the limited cage view, not the host /etc

If the second command shows the host's full /etc (with files like shadow), the cage is not active — go back to step 2.

Confirm PHP Selector works

Once all three are clean, in cPanel Select PHP Version loads without the error and the dropdown is populated. From the command line, the user-facing wrapper should return the alt-php interpreter:

su - username -c 'which php'
# /usr/bin/php  (the alt-php wrapper, not /opt/cpanel/ea-phpXX/...)

If you haven't configured the Selector at all yet, the full setup is in the CloudLinux PHP Selector setup guide. If CageFS itself isn't installed because CloudLinux was added after cPanel, work through install CloudLinux on cPanel first — the PHP Selector depends on a working CageFS layer.

Next steps

• Configure the Selector from scratch with CloudLinux PHP Selector setup.
• If you're still on CentOS, plan migrating CentOS 7 to AlmaLinux on cPanel before EOL bites.
• Need to add CloudLinux to this server? Order a CloudLinux licence.