Panellicense

Fix 'Cannot manage PHP versions' when CageFS is disabled

Resolve the CloudLinux PHP Selector error by removing pam_lve from sudo, rebuilding CageFS, and enabling CageFS for the affected user.

CLAll CloudLinux articlesTroubleshooting4 min readUpdated 2026-05-16
php-selectorcagefscpanelpam_lveerror
schema: HowToschema: FAQPage

The CloudLinux PHP Selector error "Cannot manage PHP versions: CageFS is disabled" looks like a single problem but covers three distinct failure modes. They have to be ruled out in order — the diagnostic for each one masks the next.

The audience here is a sysadmin staring at a customer ticket. Skip the explainer; below is the decision tree and the exact commands.

1. pam_lve in /etc/pam.d/sudo blocks the switch

The Selector enters the user's cage via sudo to swap interpreters. If pam_lve.so is loaded for the sudo stack, the LVE wrapper short-circuits the cage entry and the Selector reports CageFS disabled — even though CageFS is fine.

grep pam_lve /etc/pam.d/sudo

If the line exists, comment it out:

sed -i 's/^\(.*pam_lve.*\)/#\1/' /etc/pam.d/sudo

No service restart needed — PAM rereads on the next sudo invocation. Reload the PHP Selector page in cPanel. If the error persists, move to step 2.

2. CageFS is not enabled for the affected user

CageFS can be enabled globally but disabled per-user. Check the user's status:

cagefsctl --user-status username

Expected output: Enabled. If it reads Disabled, enable it:

cagefsctl --enable username

A bulk fix for "every user should be caged" is cagefsctl --enable-all. Note this only flips the toggle — it doesn't rebuild the cage skeleton, which is step 3.

To audit who's outside the cage:

cagefsctl --list-disabled

A long list usually means a previous admin used the WHM-level toggle to turn CageFS off for "convenience". Re-enable per user and audit shell sessions for hardcoded paths that broke.

3. CageFS skeleton is broken or missing

The cage skeleton is the read-only set of bind mounts and base files under /usr/share/cagefs-skeleton/. If a yum transaction was interrupted, or someone deleted files thinking they were stale, the cage mounts incompletely and the Selector reports disabled.

Symptom: cagefsctl --user-status username says Enabled but switching PHP versions still fails. Look for Cannot mount or Skeleton incomplete lines in /var/log/messages.

Rebuild the skeleton and remount everyone:

cagefsctl --force-update
cagefsctl --remount-all

--force-update repopulates the skeleton from the installed RPMs. --remount-all re-binds every active user cage against the rebuilt skeleton. On a server with 200 users this takes 2-3 minutes; sessions hold during the remount.

Verify the user is now properly caged:

cagefsctl --user-status username
su - username -c 'ls /etc'   # should show the limited cage view, not the host /etc

If the second command shows the host's full /etc (with files like shadow), the cage is not active — go back to step 2.

Confirm PHP Selector works

Once all three are clean, in cPanel Select PHP Version loads without the error and the dropdown is populated. From the command line, the user-facing wrapper should return the alt-php interpreter:

su - username -c 'which php'
# /usr/bin/php  (the alt-php wrapper, not /opt/cpanel/ea-phpXX/...)

If you haven't configured the Selector at all yet, the full setup is in the CloudLinux PHP Selector setup guide. If CageFS itself isn't installed because CloudLinux was added after cPanel, work through install CloudLinux on cPanel first — the PHP Selector depends on a working CageFS layer.

Why does PHP Selector say CageFS is disabled when it isn't?+
Usually pam_lve.so loaded in /etc/pam.d/sudo. The Selector uses sudo to enter the user's cage; pam_lve short-circuits the entry and the Selector misreports it as disabled. Comment out the line in the sudo PAM stack only.
How do I check if a user is in CageFS?+
Run cagefsctl --user-status username — it returns Enabled or Disabled. Confirm with su - username -c 'ls /etc'; the caged view shows a limited /etc, not the host's full one.
Does cagefsctl --remount-all break active SSH sessions?+
No. Existing sessions hold through the remount. On a server with 200 users the operation takes 2-3 minutes and is safe to run during business hours.
Can I disable CageFS for one user without disabling it globally?+
Yes — cagefsctl --disable username. Do this sparingly; users outside CageFS share the host filesystem view and undo most of CloudLinux's tenant isolation.

Next steps

Related articles

All CloudLinux →All troubleshooting →
how to
Set up CloudLinux PHP Selector on a cPanel server
Let each cPanel user pick their own PHP version and extensions, without breaking shared-server stability. Install alt-php, enable CageFS, and avoid the three configuration mistakes that turn this into a support flood.
7 min read
troubleshoot
Fix 508 Resource Limit Is Reached on CloudLinux cPanel
A 508 error means one LVE limit got hit — usually entry processes. The decision tree for finding which limit, which user, and whether to raise it or fix the cause.
5 min read
how to
Add custom binaries to the CageFS skeleton on CloudLinux
Expose Composer, WP-CLI, Node tools, or any custom binary inside CageFS so end users can run them over SSH or cron without leaking the rest of the host.
8 min read
how to
Set up CloudLinux Node.js Selector on a cPanel server
Give shared-hosting customers their own Node.js runtime per app — version 18/20/22, isolated under CageFS, managed from cPanel's Setup Node.js App icon. End-to-end in about 25 minutes.
9 min read
how to
Set up CloudLinux Python Selector on a cPanel server
Let shared-hosting customers pick their own Python runtime per app — Django, Flask, or FastAPI on Python 3.9 through 3.12, isolated under CageFS, managed from cPanel. End-to-end in about 30 minutes.
10 min read
how to
How to install CloudLinux OS on an existing cPanel server
Convert a CentOS, AlmaLinux, or Rocky cPanel server to CloudLinux OS in place — license activation, cldeploy, CageFS, and verifying the lve kernel after reboot.
6 min read
Switch in an afternoon

Switch from your current reseller — free.

We migrate active cPanel, Plesk, LiteSpeed and CloudLinux licenses from any reseller. We prorate the first month so you never pay twice, and your customers see zero downtime during the swap.