NGINX + PHP-FPM Permission denied

Question

I have few WordPress websites, all with same config - difference only with user and domain, but got 403 only for newly created virtualhost:

# cat barelef-art.kiev.ua.conf
server {
    server_name barelef-art.kiev.ua;
    access_log /var/log/nginx/barelef-art.kiev.ua-access.log;
    error_log /var/log/nginx/barelef-art.kiev.ua-error.log;
    root /var/www/vhosts/barelef_art/barelef-art.kiev.ua;

    location / {
        index index.php;
    }

    location ~ \.php$ {
        include /etc/nginx/fastcgi_params;
        fastcgi_pass  127.0.0.1:9012;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME /var/www/vhosts/barelef_art/barelef-art.kiev.ua$fastcgi_script_name;
    }
}

And also - similar php-fpm configs for few sites:

# cat barelef-art.kiev.ua.conf
[barelef-art.kiev.ua]

listen = 127.0.0.1:9012

listen.allowed_clients = 127.0.0.1

user = barelef_art
group = barelef_art

pm = dynamic
pm.max_children = 20
pm.start_servers = 1
pm.min_spare_servers = 1
pm.max_spare_servers = 1
pm.max_requests = 50

slowlog = /var/log/nginx/barelef-art.kiev.ua-slow.log

;php_admin_value[sendmail_path] = /usr/sbin/sendmail -t -i -f [email protected]
;php_flag[display_errors] = off
php_admin_value[error_log] = /var/log/nginx/barelef-art.kiev.ua-error.log
php_admin_flag[log_errors] = on
;php_admin_value[memory_limit] = 128M

; Set session path to a directory owned by process user
php_value[session.save_handler] = files
php_value[session.save_path] = /var/lib/php/session

php_admin_value[session.save_path] = /var/lib/php/session/barelef_art

User exist:

# id barelef_art
uid=523(barelef_art) gid=523(barelef_art) groups=523(barelef_art)

And virtualhost directory have correct owner:

# ls -l /var/www/vhosts/barelef_art/barelef-art.kiev.ua/
total 192
-rw-r--r--  1 barelef_art barelef_art   418 Dec 11 18:59 index.php
-rw-r--r--  1 barelef_art barelef_art 19930 Dec 11 18:59 license.txt
-rw-r--r--  1 barelef_art barelef_art 10691 Dec 11 18:59 readme.html
-rw-r--r--  1 barelef_art barelef_art  4951 Dec 11 18:59 wp-activate.php
...
drwxr-xr-x 12 barelef_art barelef_art  4096 Dec 11 18:59 wp-includes
...

# ls -l /var/lib/php/session/
total 328
drwxr-xr-x 2 barelef_art barelef_art   4096 Dec 11 19:06 barelef_art

But when I try open index.php - I got in log:

2014/12/11 20:39:18 [error] 13839#0: *133 "/var/www/vhosts/barelef_art/barelef-art.kiev.ua/index.php" is forbidden (13: Permission denied), client: 37.***.***.56, server: barelef-art.kiev.ua, request: "GET / HTTP/1
.1", host: "barelef-art.kiev.ua"

What I'm doing wrong?

Once again - same configuration files used for few websites with same CMS, and they works. One of them I added today morning. In evening - added this new - and it's don't work... Seems - I missed something, but - can't understood what and where.

CentOS 6.6, Nginx 1.6.2.

UPD

Adding index.html and open it directly with http://barelef-art.kiev.ua/index.html also returns 403;

ps return correct user for PHP-FPM process:

# ps -eo user:$(cut -d: -f1 /etc/passwd | wc -L),pid,ppid,c,stime,tname,time,cmd | grep "php-fpm.*barelef" | grep -v grep
barelef_art 14883 14868  0 21:33 ?        00:00:00 php-fpm: pool barelef-art.kiev.ua

# lsof -p 14883 | head
COMMAND   PID        USER   FD   TYPE  DEVICE SIZE/OFF    NODE NAME
php-fpm 14883 barelef_art  cwd    DIR   253,0     4096       2 /
php-fpm 14883 barelef_art  rtd    DIR   253,0     4096       2 /
php-fpm 14883 barelef_art  txt    REG   253,0  3309952 1051669 /usr/sbin/php-fpm
php-fpm 14883 barelef_art  mem    REG   253,0    65928 1709260 /lib64/libnss_files-2.12.so
php-fpm 14883 barelef_art  mem    REG   253,0    83088 1179907 /usr/lib64/php/modules/zip.so

But it seems more NGINX issue...

Answer 1

Check the permissions of directories /var/www/vhosts/barelef_art/barelef-art.kiev.ua/ & /var/www/vhosts/barelef_art/.

When getting forbidden errors in either Nginx or Apache it is always worth working your way back up the tree of directories to ensure the web server can access at each level.